From 48143cdbf53c552e3a6e053b0c7ff6b02df9af70 Mon Sep 17 00:00:00 2001
From: Niko Marmeladkov <niko@n1kt.ru>
Date: Wed, 1 Jul 2026 15:41:00 +0300
Subject: [PATCH] Allocate: deduplicate by pubkey, GetByPubKey: return latest

Allocate now checks if pubkey already has an identity and returns it. Prevents duplicate identities for same pubkey (was causing random number assignment on cert auth). GetByPubKey returns identity with highest CreatedAt for deterministic behavior.
---
 internal/identity/manager.go | 9 +++++++--
 1 file changed, 7 insertions(+), 2 deletions(-)

diff --git a/internal/identity/manager.go b/internal/identity/manager.go
index 7588aa1..88f1801 100644
--- a/internal/identity/manager.go
+++ b/internal/identity/manager.go
@@ -44,6 +44,10 @@ func NewManager(engine *store.Engine, masterKey [32]byte, prefix string, cooldow
 }
 
 func (m *Manager) Allocate(pubKey [32]byte) (*Identity, error) {
+	if existing, err := m.GetByPubKey(pubKey); err == nil {
+		return existing, nil
+	}
+
 	var number string
 	for attempts := 0; attempts < 100; attempts++ {
 		number = GenerateNumber(m.prefix)
@@ -141,11 +145,12 @@ func (m *Manager) Exists(number string) bool {
 
 func (m *Manager) GetByPubKey(pubKey [32]byte) (*Identity, error) {
 	var found *Identity
+	var latest int64
 	err := m.store.Iterate(func(keyHash uint64, payload []byte) bool {
 		ident := m.unmarshalIdentity(payload)
-		if ident != nil && ident.PubKey == pubKey {
+		if ident != nil && ident.PubKey == pubKey && ident.CreatedAt > latest {
 			found = ident
-			return false
+			latest = ident.CreatedAt
 		}
 		return true
 	}, m.masterKey)