Cargo owner username disambiguation

crates/crates_io_database/src/models/krate.rs

@@ -213,7 +213,8 @@ impl Crate {
         Ok(users.chain(teams).collect())
     }
 
-    pub async fn owner_remove(
+    /// Remove owner given a crates.io username.
+    pub async fn owner_remove_with_username(
         &self,
         mut conn: &AsyncPgConnection,
         login: &str,
@@ -225,7 +226,7 @@ impl Crate {
                     CASE WHEN crate_owners.owner_kind = 1 THEN
                          teams.login
                     ELSE
-                         users.gh_login
+                         users.username
                     END AS login
                 FROM crate_owners
                 LEFT JOIN teams
@@ -243,7 +244,47 @@ impl Crate {
             WHERE crate_owners.crate_id = crate_owners_with_login.crate_id
                 AND crate_owners.owner_id = crate_owners_with_login.owner_id
                 AND crate_owners.owner_kind = crate_owners_with_login.owner_kind
-                AND lower(crate_owners_with_login.login) = lower($2);"#,
+                AND canon_username(crate_owners_with_login.login) = canon_username($2);"#,
+        );
+
+        let num_updated_rows = query
+            .bind::<Integer, _>(self.id)
+            .bind::<Text, _>(login)
+            .execute(&mut conn)
+            .await?;
+
+        if num_updated_rows == 0 {
+            return Err(OwnerRemoveError::not_found(login));
+        }
+
+        Ok(())
+    }
+
+    /// Remove owner given a github username.
+    pub async fn owner_remove_with_gh_login(
+        &self,
+        mut conn: &AsyncPgConnection,
+        login: &str,
+    ) -> Result<(), OwnerRemoveError> {
+        let query = diesel::sql_query(
+            r#"WITH crate_owners_with_gh_login AS (
+                SELECT
+                    crate_owners.*,
+                    login
+                FROM crate_owners
+                JOIN oauth_github
+                    ON crate_owners.owner_id = oauth_github.user_id
+                    AND crate_owners.owner_kind = 0
+                WHERE crate_owners.crate_id = $1
+                    AND crate_owners.deleted = false
+            )
+            UPDATE crate_owners
+            SET deleted = true
+            FROM crate_owners_with_gh_login
+            WHERE crate_owners.crate_id = crate_owners_with_gh_login.crate_id
+                AND crate_owners.owner_id = crate_owners_with_gh_login.owner_id
+                AND crate_owners.owner_kind = crate_owners_with_gh_login.owner_kind
+                AND canon_username(crate_owners_with_gh_login.login) = canon_username($2);"#,
         );
 
         let num_updated_rows = query
@@ -265,7 +306,7 @@ impl Crate {
 pub enum NewOwnerInvite {
     /// The invitee was a [`User`], and they must accept the invite through the
     /// UI or via the provided invite token.
-    User(User, SecretString),
+    User(User, SecretString, String),
 
     /// The invitee was a [`Team`], and they were immediately added as an owner.
     Team(Team),

crates/crates_io_database/src/models/owner.rs

@@ -102,13 +102,20 @@ impl Owner {
         }
     }
 
-    pub fn login(&self) -> &str {
+    pub fn username(&self) -> &str {
         match self {
-            Owner::User(user) => &user.gh_login,
+            Owner::User(user) => &user.username,
             Owner::Team(team) => &team.login,
         }
     }
 
+    pub fn gh_login(&self) -> Option<&str> {
+        match self {
+            Owner::User(user) => user.gh_username.as_deref(),
+            Owner::Team(team) => Some(&team.login),
+        }
+    }
+
     pub fn id(&self) -> i32 {
         match self {
             Owner::User(user) => user.id,

crates/crates_io_database/src/models/user.rs

@@ -77,6 +77,10 @@ pub struct User {
     pub name: Option<String>,
     pub gh_id: i32,
     pub gh_login: String,
+    // This is the same as gh_login, but reads from oauth_github instead.
+    // Can rename to `gh_login` or something more appropriate when gh_login is removed from this struct.
+    #[diesel(select_expression = oauth_github::login.nullable())]
+    pub gh_username: Option<String>,
     #[diesel(select_expression = oauth_github::avatar.nullable())]
     pub gh_avatar: Option<String>,
     #[diesel(select_expression = oauth_github::encrypted_token.nullable())]
@@ -216,6 +220,20 @@ pub struct OauthGithub {
     pub user_id: i32,
 }
 
+impl OauthGithub {
+    pub async fn find_by_login(
+        mut conn: &AsyncPgConnection,
+        login: &str,
+    ) -> QueryResult<OauthGithub> {
+        oauth_github::table
+            .filter(canon_username(oauth_github::login).eq(canon_username(login)))
+            .filter(oauth_github::account_id.ne(-1))
+            .order(oauth_github::account_id.desc())
+            .first(&mut conn)
+            .await
+    }
+}
+
 /// Represents a new crates.io user to GitHub user OAuth link to be inserted into the
 /// `oauth_github` table.
 #[derive(Insertable, Debug, Builder)]
@@ -245,3 +263,53 @@ impl NewOauthGithub<'_> {
         Ok(())
     }
 }
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+    use crates_io_test_db::TestDatabase;
+
+    async fn insert_user(
+        conn: &AsyncPgConnection,
+        username: &str,
+        gh_login: &str,
+        gh_id: i32,
+    ) -> QueryResult<i32> {
+        let user_id = NewUser::builder()
+            .gh_id(gh_id)
+            .gh_login(gh_login)
+            .username(username)
+            .build()
+            .insert(conn)
+            .await?;
+
+        NewOauthGithub::builder()
+            .account_id(gh_id as i64)
+            .encrypted_token(&[])
+            .login(gh_login)
+            .user_id(user_id)
+            .build()
+            .insert(conn)
+            .await?;
+
+        Ok(user_id)
+    }
+
+    #[tokio::test]
+    async fn test_find_by_login_returns_highest_account_id_account() {
+        let test_db = TestDatabase::new();
+        let conn = test_db.async_connect().await;
+
+        insert_user(&conn, "alice", "alice", 100).await.unwrap();
+        let user_id = insert_user(&conn, "alice", "Alice", 200).await.unwrap();
+
+        // case-insensitive checks
+        for login in ["alice", "Alice", "ALICE"] {
+            let user = OauthGithub::find_by_login(&conn, login).await.unwrap();
+
+            assert_eq!(user.account_id, 200);
+            assert_eq!(user.user_id, user_id);
+            assert_eq!(user.login, "Alice");
+        }
+    }
+}

crates/crates_io_test_utils/src/builders/user.rs

@@ -60,8 +60,9 @@ impl<'a> UserBuilder<'a> {
     pub fn build(self) -> User {
         User {
             id: 1,
-            gh_login: self.gh_login.into(),
             name: self.display_name.map(ToString::to_string),
+            gh_login: self.gh_login.into(),
+            gh_username: Some(self.gh_login.into()),
             gh_id: 123,
             gh_avatar: None,
             gh_encrypted_token: None,

migrations/2026-07-18-120001-0000_add_oauth_github_login_index/down.sql

@@ -0,0 +1 @@
+DROP INDEX CONCURRENTLY IF EXISTS index_oauth_github_login;

migrations/2026-07-18-120001-0000_add_oauth_github_login_index/metadata.toml

@@ -0,0 +1 @@
+run_in_transaction = false

migrations/2026-07-18-120001-0000_add_oauth_github_login_index/up.sql

@@ -0,0 +1 @@
+CREATE INDEX CONCURRENTLY IF NOT EXISTS index_oauth_github_login ON oauth_github (lower(login));

packages/crates-io-api-client/schema.ts

@@ -3293,9 +3293,14 @@ export interface operations {
                      *
                      *     For users, use just the username (e.g., `"octocat"`).
                      *     For GitHub teams, use the format `github:org:team` (e.g., `"github:rust-lang:owners"`).
+                     *
+                     *     To disambiguate between crates.io and GitHub usernames, use
+                     *     the `crates.io:username` or `github:username` prefix.
                      * @example [
                      *       "octocat",
-                     *       "github:rust-lang:owners"
+                     *       "github:rust-lang:owners",
+                     *       "crates.io:some_user",
+                     *       "github:other_user"
                      *     ]
                      */
                     owners: string[];
@@ -3358,9 +3363,14 @@ export interface operations {
                      *
                      *     For users, use just the username (e.g., `"octocat"`).
                      *     For GitHub teams, use the format `github:org:team` (e.g., `"github:rust-lang:owners"`).
+                     *
+                     *     To disambiguate between crates.io and GitHub usernames, use
+                     *     the `crates.io:username` or `github:username` prefix.
                      * @example [
                      *       "octocat",
-                     *       "github:rust-lang:owners"
+                     *       "github:rust-lang:owners",
+                     *       "crates.io:some_user",
+                     *       "github:other_user"
                      *     ]
                      */
                     owners: string[];