glints.public

Parameters

Name	Type	Mode
p_email	text	IN
p_id	uuid	IN
p_password	text	IN

Definition

DECLARE
      sibling_password TEXT;
    BEGIN
      IF p_email IS NULL THEN
        RETURN;
      END IF;

SELECT "password" INTO sibling_password
        FROM "Users"
       WHERE LOWER("email") = LOWER(p_email)
         AND "id" <> p_id
         AND "deletedAt" IS NULL
       LIMIT 1;

IF sibling_password IS NOT NULL
         AND p_password IS NOT NULL
         AND sibling_password IS DISTINCT FROM p_password THEN
        RAISE EXCEPTION
          'Refusing sibling-touching operation for email %: active sibling has divergent auth',
          p_email
        USING HINT =
          'Sibling-sync invariant (MGT-389). An existing active row shares this email '
          'but has a different password. A code path reached this mutation without '
          'first verifying the sibling auth matches. Investigate the originating '
          'request and add the guard there. See migration 20260520083225-mgt389SiblingHardening.ts '
          'and User.ts SIBLING_SYNCED_FIELDS.';
      END IF;
    END;

check_sibling_auth_match(p_email text, p_id uuid, p_password text)

Parameters

Definition