mirror of
https://github.com/Studio-Saelix/sencho.git
synced 2026-07-26 11:49:16 +00:00
c31458a11d
Two hardenings to the suppression-rule fleet sync path found during review: the /replica endpoint trusted the payload's node_id instead of forcing it to null server-side, so a direct proxy-authenticated caller could persist a scoped replica; and upsertNotificationSuppressionRuleReplica overwrote unconditionally with no ordering check, so a delayed older POST arriving after a newer one could downgrade the stored rule. Force node_id to null on every replica write, and skip (with a warning log) any incoming write whose updated_at is not newer than what's stored.