From e50a5ced65a1f03ebdbe5b0d3b09a57b11b7edbe Mon Sep 17 00:00:00 2001
From: tv <tv@krebsco.de>
Date: Sat, 7 Nov 2026 01:40:44 +0100
Subject: refuse misplaced authors

---
 src/remake/kind.rs | 9 +++++++++
 1 file changed, 9 insertions(+)

(limited to 'src/remake')

diff --git a/src/remake/kind.rs b/src/remake/kind.rs
index 03f2ef7..a8d80d8 100644
--- a/src/remake/kind.rs
+++ b/src/remake/kind.rs
@@ -374,6 +374,9 @@ fn load_encoded(encoded: &str) -> Result<Document, String> {
     let bytes = BASE64
         .decode(encoded.trim())
         .map_err(|error| format!("the document is not valid base64: {error}"))?;
+    if let Some(misplaced) = crate::document::changes::misplaced_author(&bytes) {
+        return Err(format!("the document can't be loaded: {misplaced}"));
+    }
     Document::load(&bytes)
         .map_err(|error| format!("the document is not an Automerge document: {error}"))
 }
@@ -410,6 +413,12 @@ impl RemakeKind for Import {
         target: &mut Transaction<'_>,
     ) -> Result<(), StoreError> {
         let content = content.ok_or_else(|| anyhow::anyhow!("import without content"))?;
+        // From the coordinator: looked at before Automerge loads it (`misplaced_author`).
+        if let Some(misplaced) = crate::document::changes::misplaced_author(content) {
+            return Err(
+                anyhow::anyhow!("the imported document can't be loaded: {misplaced}").into(),
+            );
+        }
         let imported = Document::load(content)?;
         // Deterministic: the same bytes give the same view, copied in a fixed order.
         store::materialize_into(&imported, target, &meta::is_protocol)
-- 
cgit v1.3.1