Cards inadvertently moved from Public Read Only to Private space

Uhh, I was browsing through some spaces. One was the Pop Up Shop space. At some point, I noticed some of the cards from there were in my Private space, even after reload!

Even more concerning is that they are missing from Pop Up Shop:


Oh damn, do you know if there’s any actions that I can use to repro?

Or do you have the console log?

now when i load up the pop up space i see the cards in the correct place

, looking through the server logs now

Weird. I did not notice any errors in the log and have no distinct steps right now.

I also don’t see the pop up cards in my space anymore. I don’t have the original machine where I reproduced handy. I’ll check later.

  • in the database the cards are assigned to the correct space
  • but i do see in the server logs that an operation was made to update the cards to your space id
  • no server errors were reported
  • I doubled checked the server authentication code but I don’t see any holes

I’ve add more logging around authentication so i’ll know where a specific operation request got through auth in case this happens again. And I’m adding some potential fixes/refactors for the authentication system rn

if you still see the issue can you try signing out and signing back in and lmk if you still see the issue?

1 Like

just released that server authentication update, which hopefully prevents this from happening again. I’ll mark this resolved, but feel free to reopen

1 Like

Note, when I loaded my private space this morning (first time using it after I reported that bug), I saw the cards from the Pop Up Shop flash, and then disappear. I guess that tells me they were in localStorage, but once the app synced to the server, they were removed. I didn’t see any console errors.

update: I also loaded the same private space in a different browser, and I saw the same flashing of cards from Pop Up Shop. So that means they weren’t in localStorage? I dunno, I should stop speculating :slight_smile: but this feels really weird to see it in both browsers. And I’m 99% sure I didn’t use the second browser (Safari) at all yesterday when I saw the bug.

The title card is missing. It’s still in my space :expressionless:

1 Like

does signing in and out change anything?

1 Like

ok i can see the change on db, investigating…

No. I signed out and signed back in. I still see the errant card in my space. (And the card missing from the shop space).

1 Like

i manually fixed the card , but i’ll need to wait an hour for the logs to be recorded before i can track this down further

1 Like

arg, i set the logger to silent in prod. Fixed now, let me know when/if you see this again and i’ll be able to better diagnose

did you possibly change spaces while the pop up space was loading? (e.g. immediately open another space after opening the pop up space)

1 Like

For a certain definition of “immediately” :slight_smile: I don’t think I stayed very long, but it wasn’t as fast as possible.

and I’ve been trying repro by doing just that: rapidly switching between spaces. haven’t reproed so far.

1 Like

possiblyyy this happened on the previous version of the server (before today’s updates were finished deploying), but I’ll keep this open to be sure

1 Like

Just added a couple of fixes for this:

  • client-side: additional checks to make sure the correct space id is being used in updates
  • client-side: move/copy cards uses POST new instead of PATCH existing item
  • server-side: item update routes/operations now disallow PATCHing item with new spaceIds (added info to api help docs)

item = card, connection, connection type

I’m much more confident about this now, let me know if you see this occur again