zooqueenandHanzo Dev 44c7574c28 A person seated under a name is re-keyed to their IAM subject ...

The guard once asserted a name where it now asserts the IAM subject, so a row
seated then is keyed by uuid5 of the name. The subject misses that row, the
create collides on the email, and ensureUser answered the collision with
success, leaving GET /users/me and every row keyed to the person on an id no
session asserts.

On that collision ensureUser now calls user.Setter.RekeyUser: in one
transaction it finds the org's row by email and moves it, its user_role rows and
every other row that references users.id onto the subject. SQLite checks the
foreign keys at COMMIT (defer_foreign_keys), so a reference left behind refuses
the whole move. The role grants follow the rows once they commit.

Co-authored-by: Hanzo Dev <[email protected]>

2026-09-24 05:58:43 -07:00

..

impluser

A person seated under a name is re-keyed to their IAM subject

2026-09-24 05:58:43 -07:00

config.go

Let Hanzo IAM answer who the caller is

2026-09-08 23:24:35 -07:00

option.go

Let Hanzo IAM answer who the caller is

2026-09-08 23:24:35 -07:00

service.go

merge: upstream/main (sync, brand preserved)

2026-06-02 10:54:25 -07:00

user.go

A person seated under a name is re-keyed to their IAM subject

2026-09-24 05:58:43 -07:00