fix(backend): check the account limit only when add_account creates an account

[yhabib]

Motivation

add_account checked the account limit before it looked up the caller. At the limit, the call trapped for every caller, even one that already had an account. A trap rolls back state, so the one-off backfill that sets principal on a legacy account never ran. A legacy user then lost access to stored data, because get_account kept returning None until the backfill ran, and the frontend retried add_account on every sign-in and failed every time.

Two callers reach add_account: the add_account update endpoint (the only production caller), and a toy-data helper used only under test or toy_data_gen. The fix affects only the production endpoint.

Mainnet held 308,885 accounts against a limit of 330,000 on 2026-09-04, so the trap is not theoretical.

Changes

• Moved the account-limit check into the branch that creates a new account, so an existing account or a legacy backfill never traps.
• Added add_account_with_limit, a private function that takes the limit as a parameter, so add_account can still trap a new caller at ACCOUNT_LIMIT.
• Fixed the panic message from "Pre migration account limit exceeded" to "Account limit exceeded".

Tests

Added four tests in rs/backend/src/accounts_store/tests.rs, each against a small store with a passed-in limit:

• A new principal still traps at the limit, with the fixed message.
• An existing principal returns false at the limit and does not trap.
• A legacy account with principal: None gets the backfill at the limit and does not trap.
• A new principal below the limit creates the account and returns true.

Ran ./scripts/lint-rs, cargo test, and cargo spellcheck -- --code 1. All pass.

Todos

• Accessibility (a11y) – no impact, this is a backend-only change.
• Changelog – not needed, ACCOUNT_LIMIT and the Candid interface are unchanged, and mainnet has not hit the limit yet.

[zeropath-ai]

✅ No security or compliance issues detected. Reviewed everything up to 165bb42.

Security Overview

• 🔎 Scanned files: 2 changed file(s)
• 🔗 Scan Link: https://zeropath.com/app/repositories/c216d0ec-7005-4385-92fb-ac6c6dd345b7?scanId=3c6e4bfe-8b05-4f73-bccd-29cc58616fb3&codeScanTypes=PrScan&tab=issues

Detected Code Changes

Change Type

Relevant files

Enhancement

► rs/backend/src/accounts_store.rs     Add account limit handling with add_account_with_limit and parameterized limit ► rs/backend/src/accounts_store.rs     Adjust assert_account_limit to accept limit and reflect new behavior ► rs/backend/src/accounts_store/tests.rs     Add tests for limit behavior: add_account_at_limit_traps_for_new_account, add_account_at_limit_returns_false_for_existing_account, add_account_at_limit_backfills_legacy_principal, add_account_below_limit_creates_account

[Copilot]

🟢 Approved

The change is small, directly addresses the stated failure mode, and is covered by targeted new tests exercising both limit and legacy-backfill scenarios.

Pull request overview

This PR adjusts AccountsStore::add_account so the account-limit check only runs when a new account would be created, preventing traps for existing accounts (including legacy accounts that need principal backfill) when the store is at its limit.

Changes:

• Refactored add_account to delegate to a new add_account_with_limit helper and moved the limit assertion into the “create new account” branch.
• Updated the account-limit panic message to “Account limit exceeded …”.
• Added focused unit tests covering: trap-at-limit for new accounts, non-trap behavior for existing accounts, legacy principal backfill at limit, and successful create below limit.

File summaries

File	Description
rs/backend/src/accounts_store.rs	Moves the limit check to only apply when inserting a new account; introduces add_account_with_limit for testability; updates panic message.
rs/backend/src/accounts_store/tests.rs	Adds unit tests validating limit behavior for new/existing/legacy accounts and below-limit creation.

Review details

• Files reviewed: 2/2 changed files
• Comments generated: 0
• Review effort level: Lite

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.