fix(webapp): a player can't rename an item that isn't identified yet (#912) #913

Merged

claude-bot merged 1 commit from fix/912-unidentified-rename into main

2026-09-28 17:23:09 +00:00

claude-bot commented

2026-09-28 16:54:09 +00:00

Collaborator

Closes #912.

The problem. PATCH /lore/{id} accepted a non-GM's title for an item that isn't identified yet. The player sees the party's name for it (player_title), so a save could overwrite the real title.

The fix. It sits inside the existing non-GM branch, before the split between editing directly and suggesting, so the suggestion path is covered too:

If the sent title equals what the player sees, it's dropped silently. The editor sends it back unchanged.
Any other title gets a 403, "You can't rename this until it's identified."
A GM's rename is unchanged.

Tests (in test_wiki_edit_api.py):

Priya sends back the party's name: the real title is kept, and her body edit applies.
Priya sends a new name: 403, and nothing changes.
Dana renames: it works.

Checks:

tests/wiki/: 518 passed.
ruff: clean.

🤖 Generated with Claude Code

Closes #912. **The problem.** `PATCH /lore/{id}` accepted a non-GM's `title` for an item that isn't identified yet. The player sees the party's name for it (`player_title`), so a save could overwrite the real title. **The fix.** It sits inside the existing non-GM branch, before the split between editing directly and suggesting, so the suggestion path is covered too: - If the sent title equals what the player sees, it's dropped silently. The editor sends it back unchanged. - Any other title gets a 403, "You can't rename this until it's identified." - A GM's rename is unchanged. **Tests** (in `test_wiki_edit_api.py`): - Priya sends back the party's name: the real title is kept, and her body edit applies. - Priya sends a new name: 403, and nothing changes. - Dana renames: it works. **Checks:** - `tests/wiki/`: 518 passed. - ruff: clean. 🤖 Generated with [Claude Code](https://claude.com/claude-code)

claude-bot added 1 commit

2026-09-28 16:54:10 +00:00

fix(webapp): a player's wiki save can't rename an unidentified item (#912 )

CI / Backend lint (ruff) (pull_request) Successful in 48s

Details

CI / Summarisation accuracy eval harness (stub provider) (pull_request) Successful in 59s

Details

CI / Bot/backend version sync (pull_request) Successful in 25s

Details

CI / Feedback site tests (pull_request) Successful in 1m2s

Details

CI / Docker image build (pull_request) Successful in 30s

Details

CI / Does this change touch the recording path? (pull_request) Successful in 16s

Details

CI / Synthetic session harness (no GPU, no LLM) (pull_request) Has been skipped

Details

CI / Bot tests and audit (pull_request) Successful in 2m44s

Details

CI / Backend migration, tests, and audit (pull_request) Successful in 21m14s

Details

CI / Frontend tests, audit, and build (pull_request) Successful in 24m18s

Details

CI / End-to-end journeys (desktop, phone, keyboard-only) (pull_request) Successful in 21m45s

Details

3c73b28f64

The lore PATCH let a non-GM's title through unchecked, even though the
player only ever reads the party's name (player_title) for an item that
isn't identified yet, never its real title. A hand-made request could
overwrite the real title, and a mismatch between the two would reveal
that it existed at all.

Sending back what she was shown is now a silent no-op (the real title is
kept); anything else is refused with a 403. Applies to both the direct
edit and the suggestion path, since the guard runs before they split. A
GM's rename is unaffected.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

claude-bot referenced this pull request

2026-09-28 16:59:55 +00:00

Build lane 8: the wiki (WIKI-1 to WIKI-3, WIKI-5 to WIKI-18) #734

claude-bot merged commit 35ea87a746 into main

2026-09-28 17:23:09 +00:00

claude-bot referenced this pull request from a commit

2026-09-28 17:23:10 +00:00

Merge PR #913: a player can't rename an item that isn't identified yet (#912)