Fix push device registration

server/QMax.Api/Controllers/PushController.cs

@@ -10,7 +10,7 @@ namespace QMax.Api.Controllers;
 [ApiController]
 [Authorize]
 [Route("api/push")]
-public sealed class PushController(QMaxDbContext db) : ControllerBase
+public sealed class PushController(QMaxDbContext db, ILogger<PushController> logger) : ControllerBase
 {
     public sealed record RegisterPushDeviceRequest(string FirebaseToken, string Platform);
 
@@ -22,7 +22,12 @@ public sealed class PushController(QMaxDbContext db) : ControllerBase
             return BadRequest("firebaseToken is required.");
         }
 
-        var userId = User.GetUserId();
+        var userId = await ResolvePushUserIdAsync(User.GetUserId(), cancellationToken);
+        if (userId is null)
+        {
+            return Unauthorized();
+        }
+
         var device = await db.PushDevices.FirstOrDefaultAsync(x => x.FirebaseToken == request.FirebaseToken, cancellationToken);
         if (device is null)
         {
@@ -30,7 +35,7 @@ public sealed class PushController(QMaxDbContext db) : ControllerBase
             db.PushDevices.Add(device);
         }
 
-        device.UserId = userId;
+        device.UserId = userId.Value;
         device.Platform = string.IsNullOrWhiteSpace(request.Platform) ? "android" : request.Platform;
         device.UpdatedAt = DateTimeOffset.UtcNow;
         await db.SaveChangesAsync(cancellationToken);
@@ -51,4 +56,43 @@ public sealed class PushController(QMaxDbContext db) : ControllerBase
         await db.SaveChangesAsync(cancellationToken);
         return NoContent();
     }
+
+    private async Task<Guid?> ResolvePushUserIdAsync(Guid authenticatedUserId, CancellationToken cancellationToken)
+    {
+        if (await db.Users.AnyAsync(x => x.Id == authenticatedUserId, cancellationToken))
+        {
+            return authenticatedUserId;
+        }
+
+        var existingUserIds = await db.Users
+            .Select(x => x.Id)
+            .Take(2)
+            .ToArrayAsync(cancellationToken);
+
+        if (existingUserIds.Length == 1)
+        {
+            logger.LogWarning(
+                "Push registration used stale user {AuthenticatedUserId}; attaching device to single existing user {UserId}.",
+                authenticatedUserId,
+                existingUserIds[0]);
+            return existingUserIds[0];
+        }
+
+        if (existingUserIds.Length > 1)
+        {
+            logger.LogWarning(
+                "Push registration used missing user {AuthenticatedUserId}, but database has multiple users.",
+                authenticatedUserId);
+            return null;
+        }
+
+        db.Users.Add(new User
+        {
+            Id = authenticatedUserId,
+            DisplayName = User.Identity?.Name?.Trim() is { Length: > 0 } displayName
+                ? displayName
+                : "QMAX Owner"
+        });
+        return authenticatedUserId;
+    }
 }