From 838e5bb2d0eba1b5208c97222f1758bcfa9de8ff Mon Sep 17 00:00:00 2001
From: martbost <martybostick@gmail.com>
Date: Fri, 18 Sep 2026 15:49:44 -0500
Subject: [PATCH] Only the position's owner sees the placement switch

Marty asked where to find the setting, which surfaced the problem: /my/<id>
is a public page and the switch was rendering on it for every visitor. The
POST is wallet-gated so nobody could actually change someone else's
placement, but offering a stranger a control over another member's team is
wrong on its face.

It now stays hidden until /api/public/msg-me confirms the viewer has proved
with their wallet that the position is theirs.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
---
 public/my.js | 9 ++++++++-
 1 file changed, 8 insertions(+), 1 deletion(-)

diff --git a/public/my.js b/public/my.js
index 21f668f..1eab8c2 100644
--- a/public/my.js
+++ b/public/my.js
@@ -826,7 +826,7 @@
         <div style="display:flex;gap:8px;flex-wrap:wrap;align-items:center"><button id="copyDirect" class="btn btn-secondary btn-sm">Copy Direct link</button><span class="micro" style="word-break:break-all;color:var(--muted)">${esc(directUrl)}</span></div>
         <p class="micro" style="margin:8px 0 0">${dd?'Either way you keep the entry reward on anyone you personally bring.':'<strong style="color:var(--text)">Team link</strong> helps your team qualify. <strong style="color:var(--text)">Direct link</strong> places every join under you (own spillover). Either way you keep the entry reward on anyone you personally bring.'}</p>
       </div>
-      <div style="margin-top:16px;padding-top:14px;border-top:1px solid var(--line)">
+      <div id="plBox" hidden style="margin-top:16px;padding-top:14px;border-top:1px solid var(--line)">
         <div style="font-weight:800;font-size:14px;margin-bottom:4px">\u2699\ufe0f How your link places people</div>
         <p class="micro" style="margin:0 0 10px">This is your choice, and you can change it any time. It only affects where NEW joins are registered \u2014 nobody already placed ever moves.</p>
         <div style="display:flex;gap:8px;flex-wrap:wrap">
@@ -850,6 +850,13 @@
       const bt=document.getElementById('plTeam'), bd=document.getElementById('plDirect');
       if(bt)bt.addEventListener('click',()=>setMode('team'));
       if(bd)bd.addEventListener('click',()=>setMode('direct'));
+      // This is a control, not information: only show it to someone who has proved with their
+      // wallet that this position is theirs. /my/<id> is a public page, so a visitor must never
+      // be offered a switch that changes somebody else's placement.
+      fetch('/api/public/msg-me').then(r=>r.ok?r.json():null).then(me=>{
+        const box=document.getElementById('plBox');
+        if(box&&me&&String(me.id)===String(d.id))box.hidden=false;
+      }).catch(()=>{});
     }
     const qr=document.getElementById('dQr');if(qr)qr.innerHTML=qrSvg(dashUrl);
     const qb=document.getElementById('dQrBtn');