Reference accounts instead of contacts in following records #310

Merged

erik merged 1 commit from feat/task-444f16f0-following-accounts into main

2026-10-27 11:55:25 -05:00

erik commented

2026-10-27 11:05:25 -05:00

Owner

Summary

Task: task-444f16f0. Prerequisite for task-96dcee85 and task-7e947966.

Replace following.contactId/contact_id with accountId/account_id, linked to a contact-owned Account. Reuse existing accounts independently of the contact's primary URL; multiple accounts of one contact can be followed independently. Ambiguous matches return 409.
Add transactional migration 027_following_accounts: retain following IDs, statuses, timestamps and snapshots; reuse exact owner/actor-URL matches; reconstruct missing accounts from stored data; abort/rollback ambiguous mappings without guessing or network requests.
Prevent deletion or URL mutation of referenced accounts, including inactive following records, and preserve the owning contact's deletion protection. Allow metadata edits.
Update shared OpenAPI/template metadata to breaking contract 2.0.0, CLI response typing/JSON coverage, and adoption/migration guidance. Route prefixes/authentication are unchanged.
User-approved workflow correction: implementation PRs update contract versions/digests, not npm versions/pins. Development builds retain identity, semantic-version, recorded-version immutability and artifact checks. Release preparation and both API publication paths enforce the additional package-version gate. No package/lockfile versions changed.

Verification

./scripts/pre-pr.sh passed: build, generated CSS, formatting, lint, types and all 1,359 tests (including local federation integration tests).
Isolated migration tests cover all six following states, preserved fields, existing/missing account mapping, ambiguous matches, rollback of newly created accounts, repeat migration and foreign-key protection.
Isolated account/following tests cover two accounts under one contact, independent unfollow/refollow, ambiguity, existing defaults, attribution and authenticated 409 responses.
Policy tests distinguish development versus release validation and retain recorded-version immutability. Publication test rejects the missing package bump before packing/registry access.
node scripts/check-api-contract.mjs passes; --release intentionally rejects the unchanged npm package version until authorized release preparation.

Gates and availability

No publication, release dispatch, production deployment, production data mutation or legacy production migration execution is authorized/performed. Public contract publication remains task-dbb55f82. Existing sites must adopt the reviewed code and run migrations only with operator authorization; package installation alone is insufficient. Wait for CI, independent review and explicit human merge approval. Integration/visual tests remain local-only; no CI test policy/workflow changes.

## Summary Task: task-444f16f0. Prerequisite for task-96dcee85 and task-7e947966. - Replace following.contactId/contact_id with accountId/account_id, linked to a contact-owned Account. Reuse existing accounts independently of the contact's primary URL; multiple accounts of one contact can be followed independently. Ambiguous matches return 409. - Add transactional migration 027_following_accounts: retain following IDs, statuses, timestamps and snapshots; reuse exact owner/actor-URL matches; reconstruct missing accounts from stored data; abort/rollback ambiguous mappings without guessing or network requests. - Prevent deletion or URL mutation of referenced accounts, including inactive following records, and preserve the owning contact's deletion protection. Allow metadata edits. - Update shared OpenAPI/template metadata to breaking contract 2.0.0, CLI response typing/JSON coverage, and adoption/migration guidance. Route prefixes/authentication are unchanged. - User-approved workflow correction: implementation PRs update contract versions/digests, not npm versions/pins. Development builds retain identity, semantic-version, recorded-version immutability and artifact checks. Release preparation and both API publication paths enforce the additional package-version gate. No package/lockfile versions changed. ## Verification - ./scripts/pre-pr.sh passed: build, generated CSS, formatting, lint, types and all 1,359 tests (including local federation integration tests). - Isolated migration tests cover all six following states, preserved fields, existing/missing account mapping, ambiguous matches, rollback of newly created accounts, repeat migration and foreign-key protection. - Isolated account/following tests cover two accounts under one contact, independent unfollow/refollow, ambiguity, existing defaults, attribution and authenticated 409 responses. - Policy tests distinguish development versus release validation and retain recorded-version immutability. Publication test rejects the missing package bump before packing/registry access. - node scripts/check-api-contract.mjs passes; --release intentionally rejects the unchanged npm package version until authorized release preparation. ## Gates and availability No publication, release dispatch, production deployment, production data mutation or legacy production migration execution is authorized/performed. Public contract publication remains task-dbb55f82. Existing sites must adopt the reviewed code and run migrations only with operator authorization; package installation alone is insufficient. Wait for CI, independent review and explicit human merge approval. Integration/visual tests remain local-only; no CI test policy/workflow changes.

Rows
Columns