[grade=B urn:ump:bbfbsfru4nizg75wcxum7mwzhie6txhr22hw6jvz36wiihmgzmlq] P7 people store: dedupe upsert by providerUserId

Dogfood finding #3: upsertPerson resolved existing records by id only.
The wizard upserts a bootstrap admin AFTER a provider sync has already
created a person for the same Tailscale user (no id passed), so the same
providerUserId was duplicated into two records. Resolve existing by
providerUserId when no id is given; bootstrap Admin group + protectedAt are
preserved on the merge. New regression test; full suite 3414/3414.

dashcaddy-api/__tests__/network-people-store.test.js

@@ -82,6 +82,26 @@ describe('network-people-store: CRUD', () => {
     expect(list).toHaveLength(1); // merged, not duplicated
   });
 
+  test('upsertPerson merges by providerUserId when id is omitted (wizard after provider sync)', async () => {
+    const synced = await store.upsertPerson({
+      displayName: 'SamiAhmed7777',
+      providerUserId: 'ughVnuLDu621CNTRL',
+    });
+    expect(synced.groups).toEqual(['Admin']); // bootstrap identity
+
+    const fromWizard = await store.upsertPerson({
+      displayName: 'Sami Ahmed',
+      providerUserId: 'ughVnuLDu621CNTRL',
+    });
+
+    expect(fromWizard.id).toBe(synced.id);
+    expect(fromWizard.displayName).toBe('Sami Ahmed');
+    expect(fromWizard.groups).toEqual(['Admin']);
+    expect(fromWizard.protectedAt).toBe(synced.protectedAt);
+    const list = await store.listPeople();
+    expect(list).toHaveLength(1);
+  });
+
   test('updatePerson patches only provided fields', async () => {
     const p = await store.upsertPerson({ displayName: 'Bob', providerUserId: 'ts-2', groups: ['G'] });
     const u = await store.updatePerson(p.id, { displayName: 'Bobby' });

dashcaddy-api/src/app.js

@@ -779,7 +779,29 @@ async function createApp() {
   // Private Network wizard (DC-152). Dogfood finding 2026-10-04: the wizard
   // factory needs INSTANCES keyed by mode id; without them every mode
   // selection 503s provider_unavailable (unit tests inject their own map).
-  const p7TailscaleProvider = require('./network/providers/tailscale').createTailscaleProvider(); // eslint-disable-line global-require
+  // Coord client wiring (dogfood finding #2, 2026-10-04): the provider is
+  // built with coordClient=null and nothing ever called attachCoordClient()
+  // in prod (the promised routes/network.js wiring never landed), so wizard
+  // credential validation always failed not_configured. Delegate every coord
+  // method to a FRESH client per call — the sanctioned context pattern
+  // (ctx.tailscaleCoord.getClient re-reads the token from credentialManager
+  // each call, so wizard-stored tokens take effect without a restart).
+  const p7CoordProxy = new Proxy({}, {
+    get(_t, prop) {
+      if (typeof prop !== 'string') return undefined;
+      return async (...args) => {
+        const client = await ctx.tailscaleCoord.getClient();
+        const fn = client ? client[prop] : null;
+        if (typeof fn !== 'function') {
+          throw new Error('coord client method unavailable: ' + String(prop));
+        }
+        return fn.apply(client, args);
+      };
+    },
+  });
+  const p7TailscaleProvider = require('./network/providers/tailscale').createTailscaleProvider({ // eslint-disable-line global-require
+    coordClient: p7CoordProxy,
+  });
   const p7WireGuardProvider = require('./network/providers/wireguard').createWireGuardProvider(); // eslint-disable-line global-require
   apiRouter.use('/network/wizard', networkWizardRoutes({
     registry: { getActiveProvider },

dashcaddy-api/src/security/network-people-store.js

@@ -180,7 +180,17 @@ function createPeopleStore(opts = {}) {
   function upsertPerson(input = {}) {
     return _enqueue(() => {
       const data = _load();
-      const existing = input.id ? data.people[input.id] : null;
+      // Resolve the existing record by id when given, else by providerUserId
+      // (dogfood finding 2026-10-04: the wizard upserts a person AFTER a
+      // provider sync already created one for the same Tailscale user with no
+      // id — without this lookup the same providerUserId was duplicated).
+      const existing = input.id
+        ? data.people[input.id]
+        : (input.providerUserId
+            ? Object.values(data.people).find(
+                (p) => p.providerUserId && p.providerUserId === input.providerUserId
+              ) || null
+            : null);
       const isFirst = Object.keys(data.people).length === 0;
 
       const id = existing ? existing.id : (input.id || crypto.randomUUID());