- Shipped
- 20 ஆகஸ்ட், 2026 அன்று 2:43 PM UTC
- Author
- Kamo
- Commit
- f8771d4
The link a member shares is **************** It used to be ?mrt=<memberId>.<iteration>, which put a real member id in every shared URL and let anyone enumerate that member's other campaigns by counting up from .1. The validator changes shape with it — a UUID pattern instead of digits-dot-digits — and keeps doing the job it was added for: validate, never truncate, because slicing by UTF-16 code unit can halve a surrogate pair and encodeURIComponent throws URIError on a lone surrogate inside middleware(), which is a 500 on the page. Hex and hyphens cannot express a surrogate. Cookies follow the vocabulary: kmrt_vid/kmrt_src become kdsc_vid/kdsc_src, the beacon is DiscountBeacon, the collector is /api/discount and the guard is check-discount-cookie. Half-renaming would have left a ?discount= parameter stored in a kmrt_ cookie read by MrtBeacon, which is exactly the drift that costs someone an hour later. The cookies shipped hours ago, so almost none exist in the wild to orphan. Guard fixtures now assert the new shape and, specifically, that the OLD memberId.iteration form is rejected.