From 34d827730ac3c1305c1170ed51f9907a499b9680 Mon Sep 17 00:00:00 2001
From: Lain Soykaf <lain@lain.com>
Date: Fri, 24 Jul 2026 22:15:14 +0400
Subject: [PATCH] fix(admin-api): preserve user batch validation

---
 .../admin_api/controllers/user_controller.ex  |  2 +-
 .../controllers/user_controller_test.exs      | 36 ++++++++++++++++++-
 2 files changed, 36 insertions(+), 2 deletions(-)

diff --git a/lib/pleroma/web/admin_api/controllers/user_controller.ex b/lib/pleroma/web/admin_api/controllers/user_controller.ex
index 23af5b53c..4552f32c7 100644
--- a/lib/pleroma/web/admin_api/controllers/user_controller.ex
+++ b/lib/pleroma/web/admin_api/controllers/user_controller.ex
@@ -181,7 +181,7 @@ defmodule Pleroma.Web.AdminAPI.UserController do
         User.register_changeset(%User{}, user_data, need_confirmation: false)
       end)
       |> Enum.reduce(Multi.new(), fn changeset, multi ->
-        Multi.insert(multi, "user-" <> changeset.changes.nickname, changeset)
+        Multi.insert(multi, Ecto.UUID.generate(), changeset)
       end)
 
     case Pleroma.Repo.transaction(multi) do
diff --git a/test/pleroma/web/admin_api/controllers/user_controller_test.exs b/test/pleroma/web/admin_api/controllers/user_controller_test.exs
index 9808f9d0d..c2802164d 100644
--- a/test/pleroma/web/admin_api/controllers/user_controller_test.exs
+++ b/test/pleroma/web/admin_api/controllers/user_controller_test.exs
@@ -177,7 +177,7 @@ defmodule Pleroma.Web.AdminAPI.UserControllerTest do
     end
 
     test "Creating without a password returns a password reset link", %{conn: conn} do
-      [account1, account2] =
+      accounts =
         conn
         |> put_req_header("accept", "application/json")
         |> put_req_header("content-type", "application/json")
@@ -195,6 +195,10 @@ defmodule Pleroma.Web.AdminAPI.UserControllerTest do
           ]
         })
         |> json_response_and_validate_schema(200)
+        |> Map.new(fn account -> {account["data"]["nickname"], account} end)
+
+      account1 = accounts["lain"]
+      account2 = accounts["lain2"]
 
       assert account1["type"] == "success"
       assert %{"password_reset_link" => link} = account1["data"]
@@ -204,6 +208,36 @@ defmodule Pleroma.Web.AdminAPI.UserControllerTest do
       refute Map.has_key?(account2["data"], "password_reset_link")
     end
 
+    test "Duplicate nicknames in a batch return a conflict", %{conn: conn} do
+      conn =
+        conn
+        |> put_req_header("accept", "application/json")
+        |> put_req_header("content-type", "application/json")
+        |> post("/api/pleroma/admin/users", %{
+          "users" => [
+            %{"nickname" => "lain", "email" => "lain1@example.org", "password" => "test"},
+            %{"nickname" => "lain", "email" => "lain2@example.org", "password" => "test"}
+          ]
+        })
+
+      assert [_first, _second] = json_response(conn, 409)
+      refute User.get_by_nickname("lain")
+    end
+
+    test "Blank nicknames return a conflict", %{conn: conn} do
+      conn =
+        conn
+        |> put_req_header("accept", "application/json")
+        |> put_req_header("content-type", "application/json")
+        |> post("/api/pleroma/admin/users", %{
+          "users" => [
+            %{"nickname" => "", "email" => "lain@example.org", "password" => "test"}
+          ]
+        })
+
+      assert [%{"error" => "nickname can't be blank"}] = json_response(conn, 409)
+    end
+
     test "Cannot create user with existing email", %{conn: conn} do
       user = insert(:user)