Add privacy-safe cuber discovery - #197
Closed
coder13 wants to merge 7 commits into
Closed
Conversation
Add server-authorized friendship and blocking transitions, privacy-safe REST and realtime contracts, and non-blocking PostgreSQL mirrors. Document the state machine and cover concurrency, replay, blocking, privacy, metrics, and disabled-Postgres behavior.
Gate social routes and realtime delivery behind the disabled-by-default rollout flag. Keep relationship and block tombstones revisioned for fail-closed unblock and reordered PostgreSQL mirrors, and reserve pending-request quota atomically with rollback and stale reconciliation.
Keep in-flight quota reservations counted until their relationship write resolves, and make quota cleanup asynchronous after durable social transitions so mirrors and invalidations are never suppressed by maintenance failures.
Use an atomic, expiring Redis limiter for per-user and per-pair friend request creation so crashes cannot leak durable quota reservations or suppress relationship side effects.
Expose authenticated, capped discovery and public profiles behind the disabled-by-default social feature gate. Preserve normalized usernames and email privacy while linking safe profile entry points and friendship actions.
Use discoverable profile keys, suppress query logging, and sequence profile requests so discovery cannot expose or race private state.
Avoid changing friend-list projections for users without a valid discovery identifier.
Owner
Author
|
Superseded by the current-master discovery work. This stacked draft has unresolved privacy and pagination/client-race gaps; a focused current-master follow-up is in progress. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
agent/issue-185-normalized-usernames, retaining the Stop requesting, storing, and mirroring WCA email addresses #191 no-email and Normalize usernames for safe indexed lookup #194 normalized-username contracts;/users/:idclient route with safe relationship actions and profile links.Privacy and rollout
Checks
yarn workspace letscube-server test --runInBand api.test.js username.test.js usernameBackfill.test.js usernamePostgresBackfill.test.js privacy/userEmailPurge.test.js api/friends.test.js social/relationshipService.test.js social/requestRateLimiter.test.js social/discoveryService.test.jsyarn workspace letscube-server test --runInBand social/discoveryService.test.js models/user.test.jsyarn workspace letscube-client test --watchAll=false --runInBand components/App.test.jsx components/Navigation.test.jsxyarn workspace letscube-server lintyarn workspace letscube-client lint