screentinker/server
ScreenTinker a93f65b20a Only store a device fingerprint against a device that still exists
A player that reconnects after its row was deleted sends the id it still has
cached. device_fingerprints.device_id has a foreign key to devices(id), so
writing that id back fails the constraint. The throw was caught, which is why
this looked harmless, but the catch abandons the whole fingerprint block:
last_seen is not updated, the reinstall link is not made, and the settings
restore never runs. That restore exists specifically for the post-delete
re-pair, so the failure landed exactly where the feature was meant to help and
a re-paired panel came back with its orientation, name and playlist reset.

Production shows 37 of these, timestamped identically to the "sending unpaired"
log lines — the same event seen from the other side.

The incoming id is preferred, then whatever is already stored, and only an id
that still resolves is written; otherwise NULL, which the column allows and
which ON DELETE SET NULL already leaves behind. The INSERT path a few lines
below had this guard; the UPDATE was missed, and it is the one that fires.

Tests cover the deleted-id reconnect, that last_seen still advances, and that
live ids are unaffected. One asserts the raw unguarded statement really does
raise FOREIGN KEY constraint failed, and another asserts the guard is present
in the handler itself, since the others exercise a mirror of that statement.

Also ignores *.sqlite / *.sqlite3, which the existing *.db rules missed.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01Uaeo9MvzKoyXuN6ZsbhtkL
2026-07-28 13:54:40 -05:00
..
config fix(logging): gate CF-Connecting-IP on a Cloudflare peer, not any trusted proxy 2026-07-26 10:23:04 -05:00
db Alert once per outage instead of once per dedup window 2026-07-28 12:50:14 -05:00
lib Store a schedule in the timezone its screen runs in 2026-07-28 09:43:46 -05:00
middleware Merge branch 'fix/recovery-grants' into release/auth-campaign 2026-07-26 16:22:59 -05:00
player Recover an unpaired player without needing a keyboard 2026-07-28 13:17:22 -05:00
routes Show every screen's schedule on one calendar 2026-07-28 12:16:19 -05:00
scripts fix(content+android): rotation-aware media — portrait upright on dashboard AND player (#170) (#172) 2026-07-12 22:05:11 -05:00
services Alert once per outage instead of once per dedup window 2026-07-28 12:50:14 -05:00
test Only store a device fingerprint against a device that still exists 2026-07-28 13:54:40 -05:00
ws Only store a device fingerprint against a device that still exists 2026-07-28 13:54:40 -05:00
.gitignore feat(email): Microsoft Graph send + alert spam protection + preferences UI 2026-05-12 18:16:40 -05:00
config.js feat(email): SMTP transport as an alternative to Microsoft Graph [#173] (#179) 2026-07-13 15:56:22 -05:00
package-lock.json chore(release): v1.9.20 2026-07-28 13:18:21 -05:00
package.json chore(release): v1.9.20 2026-07-28 13:18:21 -05:00
server.js Merge branch 'feat/self-service-password-reset' 2026-07-27 11:21:36 -05:00
version.js chore(version): single-source VERSION, env-configurable data paths, bump tooling 2026-06-10 12:56:03 -05:00