coder
diff --git a/‎coderd/database/dump.sql
+3 b/‎coderd/database/dump.sql
+3
diff --git a/‎coderd/database/migrations/000055_template_acl.up.sql
+2-1 b/‎coderd/database/migrations/000055_template_acl.up.sql
+2-1
diff --git a/‎coderd/database/unique_constraint.go
+1 b/‎coderd/database/unique_constraint.go
+1
diff --git a/‎coderd/groups.go
+7 b/‎coderd/groups.go
+7
diff --git a/‎coderd/groups_test.go
+23 b/‎coderd/groups_test.go
+23
@@ -21,7 +21,8 @@ CREATE TABLE group_members (
 	user_id uuid NOT NULL,
 	group_id uuid NOT NULL,
 	FOREIGN KEY(user_id) REFERENCES users(id) ON DELETE CASCADE,
-	FOREIGN KEY(group_id) REFERENCES groups(id) ON DELETE CASCADE
+	FOREIGN KEY(group_id) REFERENCES groups(id) ON DELETE CASCADE,
+	UNIQUE(user_id, group_id)
 );
 
 COMMIT;
@@ -135,6 +135,13 @@ func (api *API) patchGroup(rw http.ResponseWriter, r *http.Request) {
 		}
 		return nil
 	})
+	if database.IsUniqueViolation(err) {
+		httpapi.Write(ctx, rw, http.StatusPreconditionFailed, codersdk.Response{
+			Message: "Cannot add the same user to a group twice!",
+			Detail:  err.Error(),
+		})
+		return
+	}
 	if xerrors.Is(err, sql.ErrNoRows) {
 		httpapi.Write(ctx, rw, http.StatusPreconditionFailed, codersdk.Response{
 			Message: "Failed to add or remove non-existent group member",
 
@@ -171,6 +171,29 @@ func TestPatchGroup(t *testing.T) {
 		require.True(t, ok)
 		require.Equal(t, http.StatusBadRequest, cerr.StatusCode())
 	})
+
+	t.Run("AddDuplicateUser", func(t *testing.T) {
+		t.Parallel()
+
+		client := coderdtest.New(t, nil)
+		user := coderdtest.CreateFirstUser(t, client)
+
+		_, user2 := coderdtest.CreateAnotherUserWithUser(t, client, user.OrganizationID)
+
+		ctx, _ := testutil.Context(t)
+		group, err := client.CreateGroup(ctx, user.OrganizationID, codersdk.CreateGroupRequest{
+			Name: "hi",
+		})
+		require.NoError(t, err)
+
+		group, err = client.PatchGroup(ctx, group.ID, codersdk.PatchGroupRequest{
+			AddUsers: []string{user2.ID.String(), user2.ID.String()},
+		})
+		require.Error(t, err)
+		cerr, ok := codersdk.AsError(err)
+		require.True(t, ok)
+		require.Equal(t, http.StatusPreconditionFailed, cerr.StatusCode())
+	})
 }
 
 // TODO: test auth.