fix: keep user ids server owned#2035

Open

Ceyvion wants to merge 1 commit into

SecureBananaLabs:mainfrom

Ceyvion:fix/user-server-owned-id-2032

Ceyvion commented May 30, 2026

Closes #2032
/claim #743

Summary

ensure user creation applies caller payload before the server-generated id
prevent request bodies from overriding the generated usr_... identifier
add endpoint regression coverage for caller-supplied id values

Verification

node --test apps/api/src/tests/user.test.js
node --test apps/api/src/tests/health.test.js apps/api/src/tests/user.test.js
git diff --check


          fix: keep user ids server owned

9a2019e

algora-pbc Bot added the 🙋 Bounty claim label

github-actions Bot added a commit that referenced this pull request


          chore: update leaderboard for PR #2035

07d63c8

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

🙋 Bounty claim