fix: accepting a share link failed — the insert helper adds RETURNING id and the shares table has no id

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01Dv6sqaY6Vq3ChZHMem3cnU

src/routes/myResources.js

@@ -681,7 +681,8 @@ router.post('/my-resources/share-link/:token/accept', async function (req, res)
     var link = await liveShareLink(req.params.token);
     if (!link) return res.status(404).json({ error: 'That link is not valid any more' });
     if (link.owner_id !== req.user.id) {
-      await db.run('INSERT INTO user_resource_shares (resource_id, user_id, shared_by) VALUES (?, ?, ?) ON CONFLICT DO NOTHING',
+      // db.run appends RETURNING id to an INSERT, and this table's key is (resource_id, user_id): no id column.
+      await db.query('INSERT INTO user_resource_shares (resource_id, user_id, shared_by) VALUES (?, ?, ?) ON CONFLICT DO NOTHING',
         [link.resource_id, req.user.id, link.owner_id]);
       await db.run('UPDATE user_resource_share_links SET accepted_count = accepted_count + 1 WHERE id = ?', [link.id]);
       logger.audit(req.user.id, 'resource_share_accept', 'Accepted a share of resource ' + link.resource_id, req, { category: 'clinical' });

test/backend-hardening.test.js

@@ -264,3 +264,9 @@ test('lockdown covers the sign-in provider too, and the exemption list names not
   assert.match(read('docs/authentication.md'), /## Lockdown: the admin panel as view-only/);
   assert.match(read('.env.example'), /# ADMIN_LOCKDOWN=false/);
 });
+
+test('a share row is inserted through query, since run() appends RETURNING id and the table has no id', () => {
+  const src = read('src/routes/myResources.js');
+  assert.doesNotMatch(src, /db\.run\(\s*'INSERT INTO user_resource_shares/);
+  assert.match(src, /db\.query\('INSERT INTO user_resource_shares/);
+});