PostgreSQL reports a key violation, but that is not possible - postgresql

Question

I have wrote a stored-procedure in PostgreSQL as an API to create contract and user in a same time (by postgrest).
CREATE OR REPLACE FUNCTION
auth.create_contracts(
username text,
password text,
services json,
province text,
region text,
type user_group,
telephone text,
mobile text,
email text,
start_date text,
end_date text,
organization_name text,
contract_number text,
name text,
economy_code INTEGER,
t_name text,
t_phone text,
t_ip text,
t_email text,
t_telephone text,
t_prefer_contract text,
area_state text,
area_city text,
area_county text
) RETURNS json
LANGUAGE plpgsql
AS $$
DECLARE
_user_id INTEGER;
_res json;
_now DOUBLE PRECISION;
_app_token text;
_username text;
BEGIN
SELECT random_string(64) INTO _app_token;
INSERT INTO auth.users(
username,
password,
role,
services,
app_token,
province,
region,
type,
phone,
organization_name,
mobile,
email
)
VALUES (
username,
password,
username,
services,
_app_token,
province,
region,
type,
telephone,
organization_name,
mobile,
email
);
SELECT username INTO _username;
SELECT id FROM auth.users WHERE users.username=_username
INTO _user_id;
INSERT INTO auth.contracts(
user_id,
start_date,
end_date,
organization_name,
contract_number,
economy_code,
t_name,
t_phone,
t_ip,
t_email,
t_telephone,
t_prefer_contract,
name,
area_state,
area_city,
area_county
)
VALUES(
_user_id,
start_date::TIMESTAMP,
end_date::TIMESTAMP,
organization_name,
contract_number,
economy_code,
t_name,
t_phone,
t_ip,
t_email,
t_telephone,
t_prefer_contract,
name,
area_state,
area_city,
area_county
);
SET TIME ZONE 'UTC-3:32';
PERFORM (
SELECT auth.contract_redis_function(end_date::TIMESTAMP, now()::TIMESTAMP,
_app_token, username, 100000)
);
SELECT json_build_object(
'status', 'ok',
'app_token', _app_token
)
INTO _res;
RETURN _res;
END;
$$;
users definition:
create table auth.users
(
id serial not null
constraint users_pkey
primary key,
username text,
password text,
role text,
services json,
app_token text,
province text,
region text,
type user_group,
contract_id integer,
phone text,
picture text,
is_first_login boolean default true,
is_locked boolean default false,
is_active boolean default true,
organization_name text,
mobile text,
email text,
prefer_contact text
)
;
create unique index users_username_uindex
on users (username);
contracts definition:
create table auth.contracts
(
user_id integer
constraint unique_contract
unique
constraint contract_user_01
references auth.users,
start_date timestamp,
end_date timestamp,
organization_name text,
contract_number text,
economy_code integer,
t_name text,
t_phone text,
t_ip text,
t_email text,
t_telephone text,
t_prefer_contract text,
area_state text,
area_city text,
area_county text,
name text,
id serial not null,
is_active boolean default true
);
I have a unique constraint on a key of users relation (id that is auto incremented)
sometimes when call the end-point raise an exception that key exists, but doesn't, and create record.
I don't know why!?
I have a similar problem when creating policy in a stored-procedure.

Answer 1

username is not unique in auth.users, so there is no guarantee that this query gets the correct id:
SELECT id FROM auth.users WHERE users.username=_username
INTO _user_id;
You will get the id of one of the rows with that username.
If there are several such rows, you could get the wrong one, and the UNIQUE constraint on contracts will be violated when you insert the same number a second time.
The solution is to always get the correct id like this:
INSERT INTO auth.users (...) VALUES (...)
RETURNING id INTO _user_id;
Then you will always get the id of the record you just inserted.