This repository was archived by the owner on Aug 6, 2026. It is now read-only.
trunk-merge/pr-3888/6c8243e2-56a3-422b-ae5f-5465879c3f34 - #3907
Closed
trunk-io[bot] wants to merge 6 commits into
Closed
trunk-merge/pr-3888/6c8243e2-56a3-422b-ae5f-5465879c3f34#3907trunk-io[bot] wants to merge 6 commits into
trunk-io[bot] wants to merge 6 commits into
Conversation
Generated-By: PostHog Code Task-Id: d8debcda-8a0a-4287-a5aa-ee0f5f6ce8d9
isOwnedBy now compares the stable authorUuid uniformly for both canvases and tasks, instead of a separate authorUser branch for tasks. authorUser becomes a display-only field; display-name matching stays as a fallback for rows with no creator uuid. Removes the canvas/task ownership asymmetry with no behavior or UI change. Generated-By: PostHog Code Task-Id: e9aaba50-9b88-43d5-8a62-dd7adf4c76f1
Deciding ownership of the private #me space by display-name equality could leak canvases between two users who share a name. Ownership now requires a stable creator uuid match; items without one fail closed. authorName stays for display only. Adds a regression test that a name match alone never grants ownership. Generated-By: PostHog Code Task-Id: e9aaba50-9b88-43d5-8a62-dd7adf4c76f1
The personal-channel hook test relied on name-based ownership, which no longer grants membership; give the viewer's canvas a matching creator uuid. Generated-By: PostHog Code Task-Id: e9aaba50-9b88-43d5-8a62-dd7adf4c76f1
Addresses review feedback on uuid-only ownership: - filterChannelItems: an item with no creator uuid (the backend sends created_by: null once a creator is deleted) is unknown, not "someone else", so exclude it from both the "me" and "others" buckets. - Drop the now-unused ChannelItemOwner.name; isOwnedBy was its only reader, so nothing can rewire name matching by accident. - Gate #me on meUuid alone, since a display name never established identity. No behavior change, but the condition no longer encodes the premise this PR removed. - Cover the created_by: null mapping at the service level, which is the fail-closed path. Generated-By: PostHog Code Task-Id: e9aaba50-9b88-43d5-8a62-dd7adf4c76f1
|
React Doctor found no issues in the changed files. 🎉 Reviewed by React Doctor for commit |
trunk-io
Bot
deleted the
trunk-merge/pr-3888/6c8243e2-56a3-422b-ae5f-5465879c3f34
branch
July 29, 2026 05:35
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to subscribe to this conversation on GitHub.
Already have an account?
Sign in.
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
This pull request was created and is being managed by Trunk Merge.
This pull request is based on the main branch at SHA 1b12f3c98478d58ce4237611ca675b0d9f902994.
See more details here.
When CI completes, this pull request will be closed automatically.
Pull Requests Being Tested
This pull request is testing the changes from pull request 3888.