From 7675e7c1ef9213c3044ff9974231e21bf2106572 Mon Sep 17 00:00:00 2001
From: Rockwell Schrock <rockwell@schrock.me>
Date: Fri, 24 May 2024 09:47:58 -0400
Subject: [PATCH] Only allow update if pid is on current node

---
 lib/phoenix/tracker/shard.ex                    |  3 +++
 test/phoenix/tracker/shard_replication_test.exs | 17 +++++++++++++++++
 2 files changed, 20 insertions(+)

diff --git a/lib/phoenix/tracker/shard.ex b/lib/phoenix/tracker/shard.ex
index b8c20fb5..4cddcde0 100644
--- a/lib/phoenix/tracker/shard.ex
+++ b/lib/phoenix/tracker/shard.ex
@@ -531,6 +531,9 @@ defmodule Phoenix.Tracker.Shard do
     """
   end
 
+  defp handle_update({pid, _topic, _key, _meta_updater}, state) when node(pid) != node(), 
+    do: {:reply, {:error, :not_owner}, state}
+  
   defp handle_update({pid, topic, key, meta_updater}, state) do
     case State.get_by_pid(state.presences, pid, topic, key) do
       nil ->
diff --git a/test/phoenix/tracker/shard_replication_test.exs b/test/phoenix/tracker/shard_replication_test.exs
index 0a6fed5e..cceee740 100644
--- a/test/phoenix/tracker/shard_replication_test.exs
+++ b/test/phoenix/tracker/shard_replication_test.exs
@@ -318,6 +318,23 @@ defmodule Phoenix.Tracker.ShardReplicationTest do
   test "updating with no prior presence", %{shard: shard, topic: topic} do
     assert {:error, :nopresence} = Shard.update(shard, self(), topic, "u1", %{})
   end
+  
+  test "updating a presence on a different node", %{topic: topic, tracker: tracker} do
+    pid = self()
+    subscribe(topic)
+    
+    # Track presence on node1
+    {_node1_pid, {:ok, node1_server}} = start_shard(@node1, name: tracker)
+    track_presence(@node1, node1_server, pid, topic, "u1", %{name: "s1"})
+    
+    # Bring up node2 and wait for replication
+    {_node2_pid, {:ok, node2_server}} = start_shard(@node2, name: tracker)
+    assert_join ^topic, "u1", %{name: "s1"}
+    assert %{@node1 => %Replica{status: :up}} = replicas(node2_server)
+    
+    # Attempt to update presence on node2
+    assert {:error, :not_owner} = Shard.update(node2_server, pid, topic, "u1", %{name: "s2"})
+  end
 
   test "duplicate tracking", %{shard: shard, topic: topic} do
     pid = self()