From 1d536bca7230e6799374f4e38e2554c141e69245 Mon Sep 17 00:00:00 2001
From: Quentin Gliech <quenting@element.io>
Date: Wed, 21 Jan 2026 12:15:09 +0100
Subject: [PATCH] Consume upstream authorization sessions later in the user
 registration flow

The main goal of this is to allow tracking user sessions authed by an
upstream authorization session, but this also has the nice side effect
of allowing 'going back' in browser history within the registration flow
---
 crates/handlers/src/upstream_oauth2/link.rs     |  4 ----
 .../handlers/src/views/register/steps/finish.rs | 17 +++++++++++++++++
 2 files changed, 17 insertions(+), 4 deletions(-)

diff --git a/crates/handlers/src/upstream_oauth2/link.rs b/crates/handlers/src/upstream_oauth2/link.rs
index ba24ed311..ab73520c7 100644
--- a/crates/handlers/src/upstream_oauth2/link.rs
+++ b/crates/handlers/src/upstream_oauth2/link.rs
@@ -1246,10 +1246,6 @@ async fn prepare_user_registration(
         .set_upstream_oauth_authorization_session(registration, &upstream_session)
         .await?;
 
-    repo.upstream_oauth_session()
-        .consume(clock, upstream_session)
-        .await?;
-
     Ok(registration)
 }
 
diff --git a/crates/handlers/src/views/register/steps/finish.rs b/crates/handlers/src/views/register/steps/finish.rs
index 6b7b5bfc5..b1a58c76d 100644
--- a/crates/handlers/src/views/register/steps/finish.rs
+++ b/crates/handlers/src/views/register/steps/finish.rs
@@ -221,6 +221,18 @@ pub(crate) async fn get(
             .context("Authorization session has no upstream link associated with it")
             .map_err(InternalError::from_anyhow)?;
 
+        if upstream_oauth_authorization_session.is_consumed() {
+            // This means an authorization session was used to create multiple
+            // user registrations. This can happen if the user goes back in
+            // their navigation history and basically registers twice. We also
+            // used to consume the session earlier in the flow, so it's also
+            // possible that it happens during the rollout of that version. This
+            // is not going to happen often enough to have a dedicated page
+            return Err(InternalError::from_anyhow(anyhow::anyhow!(
+                "The upstream authorization session was already used. Try registering again"
+            )));
+        }
+
         let upstream_oauth_link = repo
             .upstream_oauth_link()
             .lookup(link_id)
@@ -307,6 +319,11 @@ pub(crate) async fn get(
     }
 
     if let Some((upstream_session, upstream_link)) = upstream_oauth {
+        let upstream_session = repo
+            .upstream_oauth_session()
+            .consume(&clock, upstream_session)
+            .await?;
+
         repo.upstream_oauth_link()
             .associate_to_user(&upstream_link, &user)
             .await?;