Changeset dede82e in Klonkt for src/views/pages/paid-result.ejs

Timestamp:

07/21/2026 03:17:16 AM (7 weeks ago)

Author:

Robin <roboburr@…>

Branches:

main

Children:

072a242

Parents:

ec288dc

git-author:

Robin <roboburr@…> (07/21/2026 03:17:13 AM)

git-committer:

Robin <roboburr@…> (07/21/2026 03:17:16 AM)

Message:

Fix: derive the owner's campaign id from the creator token (strict match)

The tester's diagnose line was the smoking gun: config campaign=29148518,
but his 12 memberships (Patreon /identity returns ALL memberships across
every creator, not just this one) contained no 29148518. His real, active
pledges were to 1373144 and 16300989. So the admin campaign_id was simply
wrong, and a wrong id locks out real patrons.

Two corrections:

• Drop the sole-membership fallback added earlier. It was based on the wrong assumption that /identity is creator-scoped; with global memberships it would grant access to someone backing a DIFFERENT creator. pickCampaign- Membership is strict again: exact campaign match or nothing.
• Auto-derive the authoritative campaign id from the creator token (GET /campaigns returns the owner's own campaign), prefer it over the typed value, and self-heal the stored config when they differ. The owner no longer has to find/enter the campaign id by hand.

The diagnose line now shows owner=<from token> config=<typed> so a mismatch
is obvious.

Changed files:
src/services/PaidPatreonService.js

• pickCampaignMembership strict; fetchOwnerCampaignId (creator token); verifyPatron derives + self-heals the campaign id, richer diag

test/paid-patron.test.js

• strict match tests; fetchOwnerCampaignId with mock fetch

-robo
Co-Authored-By: Claude Opus 4.8 <noreply@…>

(No files)