fix linking

Author: dillonstreator

src/app/api/auth/link/accept/route.ts

@@ -38,6 +38,31 @@ export async function POST(req: NextRequest) {
   }
 
   const code = parsed.data.code;
+
+  const pending = (await db.execute(sql`
+    SELECT source_local_id AS "sourceLocalId"
+    FROM link_tokens
+    WHERE code = ${code} AND expires_at > now()
+    LIMIT 1;
+  `)) as unknown as { rows: { sourceLocalId: string }[] };
+
+  const pendingRow = pending.rows?.[0];
+  if (!pendingRow) {
+    logApiReject("auth/link/accept", "invalid_code", { codeLen: code.length });
+    return NextResponse.json({ error: "invalid_code" }, { status: 400 });
+  }
+
+  const sourceExists = (await db.execute(sql`
+    SELECT 1 FROM nodes WHERE local_id = ${pendingRow.sourceLocalId} LIMIT 1;
+  `)) as unknown as { rows: unknown[] };
+  if (!sourceExists.rows?.[0]) {
+    logApiReject("auth/link/accept", "source_missing", {
+      sourcePresent: false,
+      targetPresent: true,
+    });
+    return NextResponse.json({ error: "source_missing" }, { status: 400 });
+  }
+
   const consumed = (await db.execute(sql`
     DELETE FROM link_tokens
     WHERE code = ${code} AND expires_at > now()

src/app/api/auth/link/route.ts

@@ -1,4 +1,5 @@
 import { NextRequest, NextResponse } from "next/server";
+import { sql } from "drizzle-orm";
 import { db } from "@/db";
 import { linkTokens } from "@/db/schema";
 import { newLinkCode } from "@/lib/codes";
@@ -24,6 +25,14 @@ export async function POST(req: NextRequest) {
     return NextResponse.json({ error: "rate_limited" }, { status: 429 });
   }
 
+  const registered = (await db.execute(sql`
+    SELECT 1 FROM nodes WHERE local_id = ${localId} LIMIT 1;
+  `)) as unknown as { rows: unknown[] };
+  if (!registered.rows?.[0]) {
+    logApiReject("auth/link", "not_registered", { hasCookie: true });
+    return NextResponse.json({ error: "not_registered" }, { status: 403 });
+  }
+
   const expiresAt = new Date(Date.now() + LINK_TTL_MS);
   let code = newLinkCode();
 

src/app/api/node/route.ts

@@ -5,6 +5,7 @@ import { nodeSignals } from "@/db/schema";
 import {
   createNode,
   resolveNode,
+  relinkNodeLocalId,
   nodeByCode,
   metricsForNode,
   bumpAncestors,
@@ -79,6 +80,9 @@ export async function POST(req: NextRequest) {
   // ── Existing identity? localId → fingerprint fallback. No new node, no re-parent. ──
   const existing = await resolveNode(localId, fpHash);
   if (existing) {
+    if (existing.localId !== localId) {
+      await relinkNodeLocalId(existing.id, localId);
+    }
     const metrics = await metricsForNode(existing.id);
     const res = NextResponse.json({
       code: existing.code,
@@ -124,6 +128,9 @@ export async function POST(req: NextRequest) {
     // unique(local_id) race → treat as existing
     const retry = await resolveNode(localId, fpHash);
     if (retry) {
+      if (retry.localId !== localId) {
+        await relinkNodeLocalId(retry.id, localId);
+      }
       const metrics = await metricsForNode(retry.id);
       const res = NextResponse.json({ code: retry.code, isNew: false, metrics });
       setCookie(res, localId);

src/db/graph.ts

@@ -124,27 +124,46 @@ export async function bumpAncestors(
   `);
 }
 
+type ResolvedNode = { id: number; code: string; referrerId: number | null; localId: string };
+
 /** Resolve an existing node by localId (primary) then fingerprint (fallback). */
 export async function resolveNode(
   localId: string,
   fingerprint: string | null,
-): Promise<{ id: number; code: string; referrerId: number | null } | null> {
+): Promise<ResolvedNode | null> {
   const byLocal = (await db.execute(sql`
-    SELECT id, code, referrer_id AS "referrerId" FROM nodes WHERE local_id = ${localId} LIMIT 1;
-  `)) as unknown as { rows: { id: number; code: string; referrerId: number | null }[] };
+    SELECT id, code, referrer_id AS "referrerId", local_id AS "localId"
+    FROM nodes WHERE local_id = ${localId} LIMIT 1;
+  `)) as unknown as { rows: ResolvedNode[] };
   if (byLocal.rows?.[0]) return byLocal.rows[0];
 
   if (fingerprint) {
     const byFp = (await db.execute(sql`
-      SELECT id, code, referrer_id AS "referrerId" FROM nodes
+      SELECT id, code, referrer_id AS "referrerId", local_id AS "localId"
+      FROM nodes
       WHERE fingerprint = ${fingerprint} AND class = 'human'
       ORDER BY created_at ASC LIMIT 1;
-    `)) as unknown as { rows: { id: number; code: string; referrerId: number | null }[] };
+    `)) as unknown as { rows: ResolvedNode[] };
     if (byFp.rows?.[0]) return byFp.rows[0];
   }
   return null;
 }
 
+/**
+ * Move a node onto a freshly issued client localId (DESIGN §2 fingerprint re-link).
+ * Cookie and DB must agree so auth routes can resolve the node by wh_lid alone.
+ */
+export async function relinkNodeLocalId(nodeId: number, newLocalId: string): Promise<boolean> {
+  const updated = (await db.execute(sql`
+    UPDATE nodes SET local_id = ${newLocalId}
+    WHERE id = ${nodeId}
+      AND local_id <> ${newLocalId}
+      AND NOT EXISTS (SELECT 1 FROM nodes WHERE local_id = ${newLocalId})
+    RETURNING id;
+  `)) as unknown as { rows: { id: number }[] };
+  return !!updated.rows?.[0];
+}
+
 /** Look up a node id by its share code (the ?ref target). */
 export async function nodeByCode(
   code: string,