fix(09): WR-11 reject ambiguous admin logins and cross-field login or email collisions

modules/cabana/commands_test.go

@@ -195,3 +195,34 @@ func (f flagInput) Flag(name string) (string, bool) {
 }
 
 func (f flagInput) Flags(string) []string { return nil }
+
+// TestAdminCreateRejectsCrossFieldCollision pins WR-11: admin:create refuses a
+// login that equals another admin's email and an email that equals another
+// admin's login, because either makes the login identifier ambiguous.
+func TestAdminCreateRejectsCrossFieldCollision(t *testing.T) {
+	gdb := adminGorm(t)
+	app := commandApp(t, gdb)
+	create := commandByName(t, cabana.RuntimeCommands(app), "admin:create")
+	out := bonfire.NewOutput(nil, &bytes.Buffer{}, &bytes.Buffer{})
+	const password = "correct-horse-battery"
+	if err := create.Run(context.Background(), flagInput{flags: map[string]string{
+		"email": "a-xf@example.test", "login": "login-xf@example.test", "password": password,
+	}}, out); err != nil {
+		t.Fatal(err)
+	}
+	for name, flags := range map[string]map[string]string{
+		"email equals an existing login": {"email": "login-xf@example.test", "login": "b-xf"},
+		"login equals an existing email": {"email": "c-xf@example.test", "login": "a-xf@example.test"},
+		"email differs only by case":     {"email": "A-XF@example.test", "login": "d-xf"},
+	} {
+		flags["password"] = password
+		err := create.Run(context.Background(), flagInput{flags: flags}, out)
+		if err == nil || !strings.Contains(err.Error(), "already exists") {
+			t.Fatalf("%s: err = %v, want an already-exists refusal", name, err)
+		}
+	}
+	var n int64
+	if err := gdb.Model(&cabana.BackendUser{}).Where("login LIKE ?", "%-xf%").Count(&n).Error; err != nil || n != 1 {
+		t.Fatalf("admins after refused creates = %d, %v; want 1", n, err)
+	}
+}