alias uniqueness is never enforced: replySetTags checks a list of prefixes, replyCreateUser checks nothing

[akiva1132]

replySetTags (server/topic.go, master) is meant to refuse a tag in the unique namespace (alias_tag) that another user already holds — "Check for global uniqueness" via store.Users.FindOne. On the me topic that check never runs:

if t.cat == types.TopicCatMe && len(added) > 0 {
	// User tags must all be prefixed. Users are not rearchable by generic tags.
	var prefixed []string
	for _, tag := range added {
		if prefix, _ := validateTag(tag); prefix != "" {
			prefixed = append(prefixed, prefix)   // appends "alias", not "alias:bob"
		}
	}
	added = prefixed
}
...
if unique := filterTags(added, map[string]bool{globals.aliasTagNS: true}); len(unique) > 0 {
	// FindOne per tag

prefixed collects the prefixes, so added becomes ["alias"]; filterTags matches with prefixedTagRegexp (^prefix:value$), which a bare prefix never satisfies, so unique is empty and FindOne is never called.

Reproduced on 0.25.x with postgres: user A {set topic:"me" tags:["alias:fresh", ...]} → 200; user B the same alias:fresh → 200 (added:1). {get topic:"fnd"} with alias:fresh then returns both users.

replyCreateUser (server/user.go) has no uniqueness check for msg.Acc.Tags at all, so {acc user:"new" tags:["alias:taken"]} also succeeds. Presumably the loop should keep tag when it has a prefix, and account creation should run the same FindOne check.

[or-else]

Fixed in d5b01ca

Thanks.