From 943f809d01005a410bbc2f316520f4becffb99db Mon Sep 17 00:00:00 2001
From: User <user@example.com>
Date: Fri, 21 Aug 2026 01:52:02 +0200
Subject: [PATCH] fix: reject duplicate legacy DWH records

---
 tools/dwh-auth/internal/registry/store.go      |  2 +-
 tools/dwh-auth/internal/registry/store_test.go | 16 ++++++++++++++++
 2 files changed, 17 insertions(+), 1 deletion(-)

diff --git a/tools/dwh-auth/internal/registry/store.go b/tools/dwh-auth/internal/registry/store.go
index a9c42a41..832c9fb8 100644
--- a/tools/dwh-auth/internal/registry/store.go
+++ b/tools/dwh-auth/internal/registry/store.go
@@ -516,7 +516,7 @@ func validateLegacyMultiplicity(active, revoked []storedRecord) error {
 			revokedCount++
 		}
 	}
-	if activeCount > 1 || revokedCount > 1 || activeCount+revokedCount > 2 {
+	if activeCount > 1 || revokedCount > 1 || activeCount+revokedCount > 1 {
 		return integrity(errors.New("multiple legacy records"))
 	}
 	return nil
diff --git a/tools/dwh-auth/internal/registry/store_test.go b/tools/dwh-auth/internal/registry/store_test.go
index 3027e0d2..058cd8bd 100644
--- a/tools/dwh-auth/internal/registry/store_test.go
+++ b/tools/dwh-auth/internal/registry/store_test.go
@@ -289,6 +289,22 @@ func TestFindLegacyAllowsOneAndRejectsMultipleRecords(t *testing.T) {
 			t.Fatal("FindLegacy() error = nil, want multiple-legacy integrity refusal")
 		}
 	})
+	t.Run("active and revoked legacy records", func(t *testing.T) {
+		root := t.TempDir()
+		store := openStore(t, root)
+		legacy := syntheticLegacyRecord()
+		if err := store.Add(legacy); err != nil {
+			t.Fatalf("Add() error = %v", err)
+		}
+		revokedAt := legacy.CreatedAt.Add(time.Hour)
+		writeRecord(t, root, StateRevoked, legacy.KeyID+".json", marshalRecord(t, revokedRecord(legacy, revokedAt, "synthetic")), 0o640)
+		if _, err := store.FindLegacy(); !errors.Is(err, ErrIntegrity) {
+			t.Fatalf("FindLegacy() error = %v, want ErrIntegrity", err)
+		}
+		if err := store.Check(); !errors.Is(err, ErrIntegrity) {
+			t.Fatalf("Check() error = %v, want ErrIntegrity", err)
+		}
+	})
 }
 
 func TestConcurrentAddDoesNotOverwriteAndFindNeverReadsPartialRecord(t *testing.T) {