fix: resolve P1 backend consistency issues

server/user_verification_test.go

@@ -2,6 +2,7 @@ package main
 
 import (
 	"bytes"
+	"errors"
 	"net/http"
 	"net/http/httptest"
 	"strings"
@@ -65,6 +66,50 @@ func TestConsumeProductVerificationCred(t *testing.T) {
 	}
 }
 
+func TestConsumeProductVerificationCredReturnsDuplicateCredential(t *testing.T) {
+	ctrl := gomock.NewController(t)
+	defer ctrl.Finish()
+
+	oldUsers := store.Users
+	oldVerifications := store.Verifications
+	defer func() {
+		store.Users = oldUsers
+		store.Verifications = oldVerifications
+	}()
+
+	makeTestAPIKey(t)
+	token := "verified-token"
+	tokenHash := hashIMSecret(7, "register", "challenge-duplicate", "phone-hash", token)
+	store.Verifications = &testVerificationStore{get: &types.VerificationCode{
+		TenantID:              7,
+		ChallengeID:           "challenge-duplicate",
+		Scene:                 "register",
+		PhoneHash:             "phone-hash",
+		VerificationTokenHash: &tokenHash,
+		State:                 types.VerificationStateVerified,
+		ExpiresAt:             time.Now().UTC().Add(time.Minute),
+	}}
+	users := mock_store.NewMockUsersPersistenceInterface(ctrl)
+	users.EXPECT().UpsertCred(types.TenantID(7), gomock.Any()).Return(true, types.ErrDuplicate)
+	store.Users = users
+
+	_, ok, err := consumeProductVerificationCred(7, 42, &MsgCredClient{
+		Method:   "tel",
+		Value:    "+8613800138000",
+		Response: token,
+		Params:   map[string]any{"challenge_id": "challenge-duplicate"},
+	}, func(value string, _ map[string]any) (string, error) {
+		return "tel:" + value, nil
+	})
+	if !ok || !errors.Is(err, types.ErrDuplicate) {
+		t.Fatalf("duplicate phone: ok=%v err=%v", ok, err)
+	}
+	reply := decodeStoreError(err, "acc-1", time.Now(), nil)
+	if reply.Ctrl == nil || reply.Ctrl.Code != http.StatusConflict || reply.Ctrl.Text != "duplicate credential" {
+		t.Fatalf("unexpected duplicate reply: %#v", reply)
+	}
+}
+
 func TestConsumeProductVerificationCredRejectsBadToken(t *testing.T) {
 	oldUsers := store.Users
 	oldVerifications := store.Verifications