- Shipped
- August 20, 2026 at 2:43 PM UTC
- Author
- Kamo
- Commit
- 5834b1b
The public token was <memberId>.<iteration>, which was wrong on two counts. It published a real member id in every link anyone shared — on a business card, in an email signature, in someone else's inbox — and it made the whole space walkable: one link told you the member, and counting up from .1 enumerated their other campaigns. A competitor could see how many someone runs, and anyone could forge a plausible code for a member they had never met. CODE now holds a random UUID and the URL parameter is ?discount=. The column, its length and its unique index are unchanged; only what goes in it moved. ITERATION and uq_mtc_org_member_iter are gone with it. Their only job was sequencing that token, and sequencing is what forced max(iteration) + 1 — a read-then-write two tabs can both win, which needed a unique constraint to catch, a retry to recover, and that retry in a BRAND-NEW transaction because a unique_violation aborts the transaction it happened in on YSQL. All of it existed to defend a number nobody needs. A UUID has nothing to collide over; the unique index on CODE stays as the backstop. The token is deliberately still a column rather than the row's primary key, even though both are UUIDs. Keeping them apart is what makes a link reissuable: a token that gets scraped, spammed or printed on the wrong flyer can be replaced in place while the visitors, events and conversions already attached to the row stay where they are — and it keeps the id the authenticated API addresses out of public URLs.