devsyncwrld/backspace
1
0
Fork 0
Code Issues Pull Requests Actions 26 Packages Projects Releases Wiki Activity

fix: scope zombie guard by homeInstance to prevent cross-instance false matches

Browse Source 
homeUserId snowflakes aren't globally unique — must also match
homeInstance to avoid blocking stub creation for unrelated users.
This commit is contained in:
Jannis Braun
2026-04-03 02:35:06 +02:00
parent 4da373c970
commit 2c09953864
1 changed files with 2 additions and 4 deletions
Download Patch File Download Diff File Expand all files Collapse all files
packages/server/src/routes/federation.ts
+2 -4
View File
@@ -1404,19 +1404,17 @@ export function resolveOrCreateReplicatedUser(
// Check if this identity was previously deleted — don't resurrect a tombstoned // Check if this identity was previously deleted — don't resurrect a tombstoned
// user by creating a new stub. The isDeleted=0 filter in findFederatedUser // user by creating a new stub. The isDeleted=0 filter in findFederatedUser
// already hides the deleted row, so we must query without that filter here. // already hides the deleted row, so we must query without that filter here.
const domain = extractDomain(homeInstance);
const deletedMatch = db const deletedMatch = db
.select({ id: schema.users.id, isDeleted: schema.users.isDeleted }) .select({ id: schema.users.id, isDeleted: schema.users.isDeleted })
.from(schema.users) .from(schema.users)
.where(eq(schema.users.homeUserId, homeUserId)) .where(and(eq(schema.users.homeUserId, homeUserId), eq(schema.users.homeInstance, domain)))
.get(); .get();
if (deletedMatch?.isDeleted) { if (deletedMatch?.isDeleted) {
console.log(`[federation] Skipping stub creation for deleted identity homeUserId=${homeUserId} (tombstoned)`); console.log(`[federation] Skipping stub creation for deleted identity homeUserId=${homeUserId} (tombstoned)`);
return null; return null;
} }
// Normalize homeInstance to bare domain for consistent storage
const domain = extractDomain(homeInstance);
// Use the snowflake-style homeUserId as the local part; append the // Use the snowflake-style homeUserId as the local part; append the
// domain so the username is globally unique and human-readable. // domain so the username is globally unique and human-readable.
const baseUsername = `${homeUserId}@${domain}`.toLowerCase(); const baseUsername = `${homeUserId}@${domain}`.toLowerCase();