A player's wiki PATCH can rename an item that isn't identified yet (its real title) #912

New issue

Closed

opened 2026-09-28 16:46:32 +00:00 by claude-bot · 0 comments

claude-bot commented

2026-09-28 16:46:32 +00:00

Collaborator

Found while building lane 8 P3 (#911, #734).

The problem. A player sees an item that isn't identified yet under the party's name for it (for example "a brass key"), not its real title. PATCH /api/campaigns/{cid}/lore/{id} doesn't refuse a title from that player, so a save sending the party's name back would overwrite the real title. It would also reveal that the real title differs.

Today. The P3 editor disables the Name field for a player on an item that isn't identified yet, so the product's own page can't do this. The server should still refuse it, since a hand-made request can.

Fix. In the lore PATCH, when the writer isn't a GM and the entry is an item that isn't identified yet, reject a changed title with a 403 (or ignore it and keep the real title). Add a test with Priya.

Part of #734.

Found while building lane 8 P3 (#911, #734). **The problem.** A player sees an item that isn't identified yet under the party's name for it (for example "a brass key"), not its real title. `PATCH /api/campaigns/{cid}/lore/{id}` doesn't refuse a `title` from that player, so a save sending the party's name back would overwrite the **real** title. It would also reveal that the real title differs. **Today.** The P3 editor disables the Name field for a player on an item that isn't identified yet, so the product's own page can't do this. The server should still refuse it, since a hand-made request can. **Fix.** In the lore PATCH, when the writer isn't a GM and the entry is an item that isn't identified yet, reject a changed `title` with a 403 (or ignore it and keep the real title). Add a test with Priya. Part of #734.