mirror of
https://github.com/mauriceboe/TREK.git
synced 2026-10-19 13:36:48 +00:00
Maurice
0337ebbbd2
setParticipants took the ids on trust. The caller is proven to be on the trip and the assignment is proven to sit on it, but nothing said the same about the ids in the body, and the read-back joins users — so a stranger's name and avatar came back to the writer and went out over the assignment:participants broadcast to everyone else in the room. Takes the tripId both callers already hold and filters against the roster. Same drop-rather-than-reject rule as bag members and reservation travellers: the participants box posts the whole list on every edit, so a trip whose membership changed underneath it would otherwise be stuck. ASG-SVC-028 covered a foreign key error rolling the replace back. The filter takes an unknown id out before the insert can reach it, so that path is gone and the case now pins what happens instead: a list of nothing but strangers clears, like the empty list ASG-SVC-018 already pins.