fix: registration overwrite, recovery chip/payout edge cases, bulk-delete rollback

1 files changed, 13 insertions, 0 deletions

diff --git a/internal/game/core_login_account.go b/internal/game/core_login_account.go
index fbd9e3a..60cca2c 100644
--- a/internal/game/core_login_account.go
+++ b/internal/game/core_login_account.go
@@ -145,6 +145,19 @@ func (g *Game) handleNewAccount(sess *net.Session, input string) {
 		return
 	}
 
+	// Re-check existence as part of the same owner step as the save. The
+	// name was validated as new when it was typed, but another session (or
+	// the admin API) may have created it in the meantime; saving without
+	// this check would overwrite that account's password and characters.
+	if _, findErr := g.AccountStore.FindAccount(sess.Account.Name); findErr == nil {
+		sess.Conn.SetEcho(true)
+		sess.Account = nil
+		sess.State = net.StateAccountName
+		sess.WriteLine("That account name was just taken; please sign in instead.")
+		sess.Write("Account name: ")
+		return
+	}
+
 	acc := &player.Account{
 		Name:         sess.Account.Name,
 		PasswordHash: hash,