public_sharing lives on the user row; merging a sharing-enabled device account into a never-shared site account silently delisted the whole portfolio. The merge now ORs the flag. Regression test added.
- commit
- b605f6b60db88e287e1073dcb058cee7e0fa8777
- parent
- 4c45c65fcbb2fe2e8f2684fad67713f2cd57acff
- author
- Dami <dami.etoile@gmail.com>
| M | worker/ | 8 | ++++++++ |
| M | worker/ | 14 | ++++++++++++++ |
@@ -174,6 +174,14 @@ export async function mergeUsers(db: D1Database, fromId: string, toId: string):
174174 db.prepare(`DELETE FROM hearts WHERE user_id = ?1`).bind(fromId),175175 db.prepare(`UPDATE api_tokens SET user_id = ?2 WHERE user_id = ?1`).bind(fromId, toId),176176 db.prepare(`UPDATE user_identities SET user_id = ?2 WHERE user_id = ?1`).bind(fromId, toId),177+ // Sharing survives the merge: if EITHER account had a public portfolio,178+ // the merged one does — merging must never silently delist.179+ db180+ .prepare(181+ `UPDATE users SET public_sharing = 1 WHERE id = ?2182+ AND EXISTS (SELECT 1 FROM users u WHERE u.id = ?1 AND u.public_sharing = 1)`,183+ )184+ .bind(fromId, toId),177185 // users.external_id is UNIQUE and vestigial post-identities; the from-row goes.178186 db.prepare(`DELETE FROM users WHERE id = ?1`).bind(fromId),179187 ]);@@ -170,3 +170,17 @@ describe('link codes (device pairing)', () => {
170170 expect(await linkByCode(env, caller, second.code)).toBe('linked');171171 });172172 });173+174+describe('merge preserves sharing', () => {175+ it('a public portfolio stays listed when merged into a non-sharing account', async () => {176+ const { env, D } = makeEnv();177+ const key = await makeKey();178+ const device = await keyAuth(env, await proofFor(key), HOST);179+ await db.setUserSharing(D, device!.user.id, true);180+ const site = await db.upsertUser(D, 'shoo:nosharing', null); // public_sharing 0181+ const { code } = await mintLinkCode(env, site.id);182+ await linkByCode(env, { userId: device!.user.id, externalId: device!.user.external_id }, code);183+ const merged = await db.getUserById(D, site.id);184+ expect(merged!.public_sharing).toBe(1);185+ });186+});