b6d491d563
The séance tells guests "claim a name to keep your codex". It was a lie. register() unconditionally created a brand-new User row with a fresh UUID, so a wanderer's essence, discovered entities, sightings, ritual/judgment history and Ghost Log — every one of them foreign-keyed to the guest's user_id — were silently orphaned the moment they registered. Now that every visitor starts as a guest, that hit essentially everyone who ever signed up. A wanderer hitting /register now renames that same row in place, keeping all relationships intact. The existing AuthSession stays valid (same user_id), so claiming a name doesn't even log you out. Scoped deliberately to wanderers. My first attempt rejected ANY authenticated caller with a 409, which broke registering a second account while logged in — a legitimate flow (shared computer, alt account) that tests/test_device.py::test_device_feed_only_broadcasts_to_the_owning_user caught immediately: its second register 409'd, its login then failed, and "user B's" device got paired to user A, silently defeating a cross-user-isolation assertion. A named caller's cookie is now ignored and the normal create-a-new-row path runs. Adds get_optional_current_user (None instead of 401) for endpoints that behave differently for anonymous vs. authenticated callers but must stay reachable without auth. This was one of eight findings from an adversarial audit whose verifier agents all died on session limits, so nothing was machine-verified — I confirmed this one by reading the code and then proving it end-to-end. The other seven remain unchecked. 331 backend tests pass. Verified live: guest 23846555 -> livehunter1, same id, same session still valid. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
1.9 KiB
1.9 KiB