mirror of
https://github.com/MBombeck/HealthLog.git
synced 2026-11-08 12:32:43 +00:00
Marc-André Bombeck
e33700c7a9
The switcher and the banner named a shared record's owner by their greeting name — the value they typed at onboarding for "how should HealthLog address you". When an owner has set a full name, that is what a delegate should see: entering somebody's record, you read whose it is by who they are. - the account-access resolver publishes the owner's `fullName` alongside the greeting name and the username - `accountLabel` prefers fullName, then displayName, then username. Optional on the argument so the grant-view and actor shapes that never carried it keep the old two-field behaviour untouched - the closed presentation schema carries `fullName` and its parity matcher compares it, so the two published views of the active record cannot name the same owner differently - the OpenAPI contract regenerates with the additive field This deliberately discloses the owner's full name to every delegate, read-only included — it was patient-identity data behind a MANAGE-gated export until now. That is the intended behaviour, documented at `accountLabel` so it is not mistaken for a leak and tightened back. The resolver, the schema parity, the label fallback and a read-only delegate's banner are each pinned by a test.