fix: show post and comment actions only to the verified author

tests/page-organization.test.js

@@ -42,3 +42,24 @@ test('own-post filtering follows canonical identity even after company and depar
   assert.equal(page.isPostOwner({ requesterId: 'fixture-owner', company: '이전 회사' }, user), true);
   assert.equal(page.isPostOwner({ requesterId: 'another-owner', author: '동명이인', company: user.company }, user), false);
 });
+
+test('a matching display name, login or email never grants post ownership without an author ID', () => {
+  const user = { requesterId: 'fixture-owner', name: '동명이인', loginId: 'same@example.test', email: 'same@example.test' };
+  for (const author of [user.name, user.loginId, user.email]) {
+    assert.equal(page.isPostOwner({ author }, user), false);
+  }
+  assert.equal(page.isPostOwner({ requesterId: 'fixture-owner' }, null), false);
+});
+
+test('the signed primary identity takes precedence over stale alternate browser IDs', () => {
+  const user = { requesterId: 'current-owner', ssoSubject: 'old-owner', userUuid: 'old-owner' };
+  assert.equal(page.isPostOwner({ requesterId: 'old-owner' }, user), false);
+  assert.equal(page.isPostOwner({ requesterId: 'current-owner' }, user), true);
+});
+
+test('server requester and user UUID fields remain the author identity when normalizing a session', () => {
+  const user = page.normalizeAuthUser({ requesterId: 'current-owner', userUuid: 'current-owner', email: 'fixture@example.test' }, {});
+  assert.equal(user.requesterId, 'current-owner');
+  assert.equal(user.ssoSubject, 'current-owner');
+  assert.equal(user.userUuid, 'current-owner');
+});