Found in a post-merge review of #203 and confirmed by reading master 34f672c6.
cmd/server/node_not_found.go looks up the observer for a missing node with WHERE lower(id) = ? ORDER BY last_seen DESC LIMIT 1 (code). Observer ids arrive raw from the MQTT topic, so the same pubkey can exist as several rows that differ only in letter case. Only the newest row's name is passed to identityHidden. If an older case-variant carries the hidden name, the check misses it, and the 404 body can expose that observer's name, role and timestamps. The shared privacy check is correct; the gap is that this caller does not give it every name.
Expected
- Collect all names for the pubkey (every case-variant observer row, plus the inactive node) and hide the identity if any of them is hidden.
- Use the same rule when choosing which observer row to return.
Tests
Found in a post-merge review of #203 and confirmed by reading master
34f672c6.cmd/server/node_not_found.golooks up the observer for a missing node withWHERE lower(id) = ? ORDER BY last_seen DESC LIMIT 1(code). Observer ids arrive raw from the MQTT topic, so the same pubkey can exist as several rows that differ only in letter case. Only the newest row's name is passed toidentityHidden. If an older case-variant carries the hidden name, the check misses it, and the 404 body can expose that observer's name, role and timestamps. The shared privacy check is correct; the gap is that this caller does not give it every name.Expected
Tests