Users uniquely identified before access

CMMC 2.0 IA.L1-3.5.1 (NIST 800-171r2 3.5.1) requires that users and processes are uniquely identified before system access is granted. Without a uniqueness constraint on user identifiers, two accounts can share the same identity — making it impossible to attribute actions to a specific individual. CMMC accountability requires an audit trail tied to unique principals. CWE-287 (Improper Authentication) and OWASP A07 (Identification and Authentication Failures) flag non-unique identification as a foundational authentication failure. A system that cannot distinguish between two users sharing an email cannot satisfy CMMC's accountability requirements, regardless of how well other controls are implemented.

Enforce unique identification at the database level, not just the application layer. Application-level checks can be bypassed; database constraints cannot:

// prisma/schema.prisma
model User {
  id        String   @id @default(cuid())
  email     String   @unique   // Database-enforced — not nullable, not optional
  role      String   @default("user")
  createdAt DateTime @default(now())
}

For raw SQL migrations:

CREATE TABLE users (
  id         UUID PRIMARY KEY DEFAULT gen_random_uuid(),
  email      TEXT NOT NULL UNIQUE,
  role       TEXT NOT NULL DEFAULT 'user',
  created_at TIMESTAMPTZ NOT NULL DEFAULT NOW()
);
CREATE UNIQUE INDEX idx_users_email ON users(email);

In the registration handler, catch unique-constraint violations and return a client-safe message — do not forward the raw database error, which would expose your schema and table names.