From 812499316e2d4afedf19980b3784bf381afea1a5 Mon Sep 17 00:00:00 2001
From: Neeraj Sathish Kumar <neerajcodz@gmail.com>
Date: Tue, 30 Jun 2026 14:51:54 +0530
Subject: [PATCH] fix: guard postgres memory upserts by owner

---
 src/adapters/postgres.rs | 11 ++++++++---
 1 file changed, 8 insertions(+), 3 deletions(-)

diff --git a/src/adapters/postgres.rs b/src/adapters/postgres.rs
index 4214685..1fa6995 100644
--- a/src/adapters/postgres.rs
+++ b/src/adapters/postgres.rs
@@ -73,7 +73,7 @@ impl PostgresPort for PostgresAdapter {
         let last_accessed_at =
             optional_epoch_seconds(record.last_accessed_at.as_deref(), "last_accessed_at")?;
 
-        client
+        let affected_rows = client
             .execute(
                 r#"
                 INSERT INTO nextral_memories (
@@ -89,8 +89,6 @@ impl PostgresPort for PostgresAdapter {
                     $22, $23, $24
                 )
                 ON CONFLICT (id) DO UPDATE SET
-                    tenant_id = EXCLUDED.tenant_id,
-                    user_id = EXCLUDED.user_id,
                     session_id = EXCLUDED.session_id,
                     content = EXCLUDED.content,
                     content_type = EXCLUDED.content_type,
@@ -111,6 +109,8 @@ impl PostgresPort for PostgresAdapter {
                     access_count = EXCLUDED.access_count,
                     status = EXCLUDED.status,
                     schema_version = EXCLUDED.schema_version
+                WHERE nextral_memories.tenant_id = EXCLUDED.tenant_id
+                    AND nextral_memories.user_id = EXCLUDED.user_id
                 "#,
                 &[
                     &record.id,
@@ -140,6 +140,11 @@ impl PostgresPort for PostgresAdapter {
                 ],
             )
             .map_err(|error| CoreError::Io(error.to_string()))?;
+        if affected_rows == 0 {
+            return Err(CoreError::Conflict(
+                "memory id already exists for a different tenant or user".to_string(),
+            ));
+        }
         Ok(())
     }