mirror of
https://github.com/Kpa-clawbot/meshcore-analyzer.git
synced 2026-11-11 15:18:16 +00:00
n30nex
b9593f7174
Pending-account re-registration previously changed the password and display name in separate unconditional writes. A failed name update could leave only the password changed, and a stale pending lookup could authorize changes after activation. Update both fields in one statement constrained to `status = 'pending'`. If the account changed before the write, keep the generic registration response and issue no new activation message. Failed updates preserve the original credentials and activation link. Validation: reproduced the partial-write bug through the HTTP handler before the fix; 22 authentication tests and all 109 account-store tests pass on native SQLite. The four pending-registration store tests passed ten race-detector repetitions, covering competing registrations, a held activation writer, and active/disabled/deleted accounts. The complete server suite and full account-store race suite also pass. Local Chromium passed all 28 account journeys. No schema, configuration, UI, or dependency changes. Closes #2228.