Files
civitai__civitai/docs
Manuel Emilio Urena 6e714a0532 fix(posts): prevent publish-bump via parent-unpublish loophole (#2458)
* fix(posts): prevent publish-bump via parent-unpublish loophole

Posts could be bumped to the top of feeds by unpublishing the parent
model/version, then picking a new publishedAt on the post edit page —
the raw SQL guard accepted the NULL→future transition without consulting
the prevPublishedAt stash.

- updatePost: CASE-restore from prevPublishedAt + strip stash on republish
- publishPrivateModel(publishVersions:true): same CASE pattern for the
  Private→Public post fanout
- getPostDetail: enrich with PostUnpublishContext (wasPublished,
  unpublishedAt, unpublishedBy, parentModelId) via lightweight JOIN,
  gated on !publishedAt so public reads stay JOIN-free
- PostEditSidebar + PostDetail: surface a "Post unpublished" alert to
  owner/mod when wasPublished && !publishedAt; hide Publish/Schedule
  controls on the edit page and link to the parent model
- PostEditSidebar: always show View Post button so owners can preview
  drafts and parent-unpublished posts
- ModelVersionDetails: CTA toggles Publish ↔ Republish; hide Schedule
  control once a model/version has been unpublished (anti-bump guard
  would silently ignore the picked date)
- clamp-publishedat-bumps: gate Op 3 on publishedAt <= NOW() so
  scheduled-future posts aren't surfaced by the clamp; rename STASH keys
  from clamp_868jne3fd_* to clampPrev*

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

* docs: slim down post-publish-bump-prevention spec

Drop iterative planning sections (PR-N implementation sketches, loophole
L1/L2/L3 split, open questions, decisions log) now that the fix is
landed. Keep the invariant, write-site map, selector design, UI matrix,
and hand-fix SQL as the future reference.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

* fix(posts): address copilot review on unpublish-context plumbing

- Thread `getDbWithoutLag` client from `getPostDetail` into
  `getPostUnpublishContext` so the stash JOIN shares primary routing
  during the replication-lag window after an unpublish/republish.
- Clarify the early-return comment to acknowledge the known
  future-scheduled clamp orphans documented in the
  clamp-publishedat-bumps endpoint.
- Drop the now-unused `Prisma` import from clamp-publishedat-bumps.ts.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

---------

Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
2026-06-10 15:18:33 -04:00
..
2025-11-19 13:39:55 -07:00
2026-04-21 17:28:15 -06:00
2025-08-25 12:23:45 -06:00
2026-03-27 11:25:47 -04:00
2026-03-13 17:31:05 -04:00
2026-04-24 15:34:42 -06:00
2025-11-20 15:16:40 -07:00
2026-01-27 14:25:06 -04:00
2026-03-23 19:49:29 -06:00
2026-01-27 14:25:06 -04:00