Files
wekan/server/lib/attachmentActivityActor.js
Lauri OjansivuandClaude Opus 4.8 2ba8882d88 Fix #5504: deleted-attachment notification credits the deleter
The deleteAttachment activity used fileObj.userId (the uploader) instead of the
user who deleted the attachment, so notifications/history named the wrong person.
Record the acting user (Meteor.userId()) for the delete activity, falling back to
the uploader for server/system removals. Upload activity is unchanged.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
2026-06-20 17:45:43 +03:00

17 lines
803 B
JavaScript

/**
* Pure helper to determine which user should be credited for an attachment
* activity (specifically the 'deleteAttachment' activity).
*
* Bug #5504: when an attachment is deleted, the activity must record the user
* who actually performed the removal (the acting user), not the original
* uploader. When no acting user is available (e.g. a server/system removal),
* fall back to the uploader so the activity still has a sensible userId.
*
* @param {string|null|undefined} actingUserId the user performing the removal
* @param {string|null|undefined} uploaderUserId the original uploader
* @returns {string|null|undefined} actingUserId if present, otherwise uploaderUserId
*/
export function deleteActivityUserId(actingUserId, uploaderUserId) {
return actingUserId || uploaderUserId;
}