fix(auth): #69: guard login while a session is active

internal/features/auth/service.go

@@ -154,7 +154,7 @@ func (s *Service) Register(input RegisterInput) (*RegisterResult, error) {
 	// Registration targets the new user's own database, which would disconnect
 	// any active session. Refuse while signed in.
 	if s.session != nil {
-		return nil, errors.ErrInvalidInput
+		return nil, errors.ErrAlreadySignedIn
 	}
 
 	// Reject usernames already taken on this machine: every registered account
@@ -303,6 +303,12 @@ func (s *Service) Login(input LoginInput) (bool, error) {
 		return false, errors.ErrInvalidInput
 	}
 
+	// Login targets the (potential) new user's own database, which would
+	// disconnect any active session. Refuse while signed in.
+	if s.session != nil {
+		return false, errors.ErrAlreadySignedIn
+	}
+
 	passwordBytes := []byte(input.Password)
 	defer crypto.Wipe(passwordBytes)
 

internal/shared/errors/errors.go

@@ -61,6 +61,12 @@ var (
 		"you must be logged in to access this resource",
 	)
 
+	// ErrAlreadySignedIn means a sign-in was attempted while a session is
+	// already active. Callers must sign out before signing in as another user.
+	ErrAlreadySignedIn = errors.New(
+		"you are already signed in. Please sign out before signing in as another user",
+	)
+
 	// ErrJobNotFound means the requested queue entry does not exist.
 	ErrJobNotFound = errors.New(
 		"the file entry you are looking for no longer exists",