dim-api
dim-api copied to clipboard
DestinyItemManager
Do not store data under Bungie.net membership ID
It turns out that users can relink their Destiny profiles to different Bungie.net accounts, and in fact they may do this without knowing (perhaps by choosing different login options? IDK). Unfortunately all data in DIM Sync is stored under (bungie membership id, profile membership id) keys, so this makes their data inaccessible after the change.
To fix this, we could switch to storing only by profile membership ID. Then, we'd need to change the auth token to include a list of all profile membership IDs accessible from the logged in account, and use that to validate access to each bit of data. This has one glaring downside, which is that if the user links a different profile to the same Bungie.net account, they won't see it. Remember that users can still have multiple profiles if cross-save is off! However, this may be worth it, vs "my loadouts suddenly disappeared" as a logout/login will fix it.
All tokens have been regenerated with the list of profile IDs included in the JWT - we can now safely start relying on that info.
As we migrate to StatelyDB, user data is now primarily stored under the profile ID instead of the membership ID: https://github.com/DestinyItemManager/dim-api/blob/master/api/stately/schema/README.md (with the exception of Settings). This is both more efficient to query, and will eventually solve this problem entirely once the migration is complete.