fix(scratchnode): require verified host for FAQ-promote + wiki-publish (scratchnode/002)#500
Merged
Merged
Conversation
…h (scratchnode/002)
snPromoteFaq + snPublishWiki were the last host-only PUBLIC-write actions still using the weak _snReadHostOwnerKey() (falls back to a bare sessionId). Backend requireHost already rejected a bare sessionId so this was never an exploit, but the frontend would attempt the mutation and show a confusing raw-error toast to a non-host. Both now use _snRequireVerifiedHostOwnerKey('sn-manage-event-output') + early-return with a clear 'Host verification required' toast.
CI-locked by 3 honesty tests (guest-cannot-write, SN-LIVE-007/008 private-stays-private, public-send control). The existing publish-wiki recap test now establishes the realistic verified-host precondition. e2e: output-contract green; honesty 27/27.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
|
The latest updates on your projects. Learn more about Vercel for GitHub. 1 Skipped Deployment
|
✅ Dogfood Visual QA Gate: PASSED
ArtifactsDownload the Generated by Dogfood QA Gate |
HomenShum
added a commit
that referenced
this pull request
Jun 3, 2026
…ipping (#501) Operational lesson from today's loop run: reviewable PRs left open against hot files (home-v5.html, events.ts, honesty spec) go DIRTY as the daily loop squash-merges past them. #469 had to be rebuilt fresh as #500. Rule: land or rebase hot-file PRs within one working day; serialize >=2 PRs on the same hot file (strict:true makes the 'behind main' ping-pong explicit). Co-authored-by: hshum <hshum@users.noreply.github.com> Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
|
Demo: walkthrough of the surfaces this PR changed is available as a workflow artifact ( |
This was referenced Jun 3, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What
snPromoteFaqandsnPublishWikiwere the last two host-only PUBLIC-write actions inhome-v5.htmlstill reading the host key via the weak_snReadHostOwnerKey()(which falls back through localStorage to a baresessionId). Every other host action already used the strict_snRequireVerifiedHostOwnerKey().Why it matters (P1, not P0)
The backend
requireHostinconvex/events.tsalways rejected a bare sessionId (nohk1:token / noliveEventHostsrow), so this was never an exploit. But the frontend would still attempt the mutation and surface a confusing raw-backend-error toast to a non-host. This is a frontend permission-consistency / UX-honesty fix.The fix
Both actions now call
_snRequireVerifiedHostOwnerKey('sn-manage-event-output')and early-return with a clearHost verification requiredtoast when the session is not a verified host — the failure mode is made impossible, not hidden.CI-locked by tests
3 new honesty tests in
scratchnode-live-route-honesty.spec.ts:promoteFaq/publishWiki(mutations never called + correct toast)The existing publish-wiki recap test now establishes the realistic verified-host precondition (it was implicitly relying on the weak fallback).
Verification
home-v5-output-contract: green (17 invariants)scratchnode-live-route-honesty: 27/27 greenSupersedes the DIRTY #469 (rebuilt fresh on current main; original branch went stale while the loop shipped). Goal Card:
goals/scratchnode/002-host-public-write-verification.md.🤖 Generated with Claude Code