fix: check if config contains duplicate resources in API-driven standalone mode

apisix/admin/standalone.lua

@@ -34,6 +34,22 @@ local EVENT_UPDATE = "standalone-api-configuration-update"
 
 local _M = {}
 
+local function check_duplicate(item, key, id_set)
+    local identifier, identifier_type
+    if key == "consumers" then
+        identifier = item.id or item.username
+        identifier_type = item.id and "credential id" or "username"
+    else
+        identifier = item.id
+        identifier_type = "id"
+    end
+
+    if id_set[identifier] then
+        return true, "found duplicate " .. identifier_type .. " " .. identifier .. " in " .. key
+    end
+    id_set[identifier] = true
+    return false
+end
 
 local function get_config()
     local config = shared_dict:get("config")
@@ -142,6 +158,7 @@ local function update(ctx)
             apisix_yaml[key] = table_new(#items, 0)
             local item_schema = obj.item_schema
             local item_checker = obj.checker
+            local id_set = {}
 
             for index, item in ipairs(items) do
                 local item_temp = tbl_deepcopy(item)
@@ -167,6 +184,14 @@ local function update(ctx)
                         core.response.exit(400, {error_msg = err_prefix .. err})
                     end
                 end
+                -- prevent updating resource with the same ID
+                -- (e.g., service ID or other resource IDs) in a single request
+                local duplicated, err = check_duplicate(item, key, id_set)
+                if duplicated then
+                    core.log.error(err)
+                    core.response.exit(400, { error_msg = err })
+                end
+
                 table_insert(apisix_yaml[key], item)
             end
         end

t/admin/standalone.t

@@ -208,3 +208,51 @@ x-apisix-conf-version-routes: 100
 --- error_code: 400
 --- response_body
 {"error_msg":"routes_conf_version must be greater than or equal to (1062)"}
+
+
+
+=== TEST 11: duplicate route id found
+--- config
+    location /t11 {}
+--- request
+PUT /apisix/admin/configs
+{"routes_conf_version":1063,"routes":[{"id":"r1","uri":"/r2","upstream_id":"u1","plugins":{"proxy-rewrite":{"uri":"/hello"}}},
+{"id":"r1","uri":"/r2","upstream_id":"u1","plugins":{"proxy-rewrite":{"uri":"/hello"}}}]}
+--- more_headers
+X-API-KEY: edd1c9f034335f136f87ad84b625c8f1
+--- error_code: 400
+--- response_body
+{"error_msg":"found duplicate id r1 in routes"}
+
+
+
+=== TEST 12: duplicate consumer username found
+--- config
+    location /t12 {}
+--- request
+PUT /apisix/admin/configs
+{"consumers_conf_version":1064,"consumers":[{"username":"consumer1","plugins":{"key-auth":{"key":"consumer1"}}},
+{"username":"consumer1","plugins":{"key-auth":{"key":"consumer1"}}}]}
+--- more_headers
+X-API-KEY: edd1c9f034335f136f87ad84b625c8f1
+--- error_code: 400
+--- response_body
+{"error_msg":"found duplicate username consumer1 in consumers"}
+
+
+
+=== TEST 13: duplicate consumer credential id found
+--- config
+    location /t13 {}
+--- request
+PUT /apisix/admin/configs
+{"consumers_conf_version":1065,"consumers":[
+    {"username": "john_1"},
+    {"id":"john_1/credentials/john-a","plugins":{"key-auth":{"key":"auth-a"}}},
+    {"id":"john_1/credentials/john-a","plugins":{"key-auth":{"key":"auth-a"}}}
+]}
+--- more_headers
+X-API-KEY: edd1c9f034335f136f87ad84b625c8f1
+--- error_code: 400
+--- response_body
+{"error_msg":"found duplicate credential id john_1/credentials/john-a in consumers"}