diff --git a/lib/account.js b/lib/account.js index f6c3e1f2b..c54f173d8 100644 --- a/lib/account.js +++ b/lib/account.js @@ -634,11 +634,20 @@ class Account { // check if already exists let existingAppBinding = await this.redis.hget(`${REDIS_PREFIX}oapp:h:${accountData.oauth2.provider}`, accountData.oauth2.auth?.user); if (existingAppBinding && existingAppBinding !== this.account) { - let message = 'Another account for the same OAuth2 user already exists'; - let error = Boom.boomify(new Error(message), { statusCode: 400 }); - error.output.payload.code = 'AccountAlreadyExists'; - error.output.payload.existingAccount = existingAppBinding; - throw error; + let existingAccount; + try { + existingAccount = await this.loadAccountData(existingAppBinding); + } catch (err) { + // account not found + } + + if (existingAccount?.oauth2?.auth?.user === accountData.oauth2.auth?.user) { + let message = 'Another account for the same OAuth2 user already exists'; + let error = Boom.boomify(new Error(message), { statusCode: 400 }); + error.output.payload.code = 'AccountAlreadyExists'; + error.output.payload.existingAccount = existingAppBinding; + throw error; + } } pipeline = pipeline.hset(`${REDIS_PREFIX}oapp:h:${addProvider}`, accountData.oauth2?.auth?.user, this.account); } @@ -768,11 +777,20 @@ class Account { // check if already exists let existingAppBinding = await this.redis.hget(`${REDIS_PREFIX}oapp:h:${accountData.oauth2.provider}`, accountData.oauth2.auth?.user); if (existingAppBinding && existingAppBinding !== this.account) { - let message = 'Another account for the same OAuth2 user already exists'; - let error = Boom.boomify(new Error(message), { statusCode: 400 }); - error.output.payload.code = 'AccountAlreadyExists'; - error.output.payload.existingAccount = existingAppBinding; - throw error; + let existingAccount; + try { + existingAccount = await this.loadAccountData(existingAppBinding); + } catch (err) { + // account not found + } + + if (existingAccount?.oauth2?.auth?.user === accountData.oauth2.auth?.user) { + let message = 'Another account for the same OAuth2 user already exists'; + let error = Boom.boomify(new Error(message), { statusCode: 400 }); + error.output.payload.code = 'AccountAlreadyExists'; + error.output.payload.existingAccount = existingAppBinding; + throw error; + } } pipeline = pipeline.hset(`${REDIS_PREFIX}oapp:h:${accountData.oauth2.provider}`, accountData.oauth2.auth?.user, this.account); }