[ixuz]

What and why

The Studio's deck export read a deck's cards and reviews documents with the signed-in user's credentials whenever they were in the user's own storage. That held even for a deck of an instance attached from someone else's pod, and the export then wrote every triple of those documents into the file. Such an instance's catalog may name one of the user's own documents as a deck's, so the file could hold a whole document the user never thought of as part of the deck. Moving or copying cards and copying a deck into a draft already read such a document as no one; export did not.

What changes:

• exportDeckFile now takes the instance and the WebID. It reads each of the deck's two documents as the user only when the document is in the instance's pod (isInInstancePod), and reads it as no one otherwise, as transferCards does.
• The archive exports only the deck's own subjects from those documents: its cards with the distractors they name, the review states of those cards, and the blank nodes they lead to. An import already read nothing else, so a file still round-trips.
• Every caller of the archive now gives it the fetch that reads as no one and says which documents to read that way, so no document is read as the user by default.

The Import & export screen passes the instance and the WebID. docs/data-model.md and docs/studio.md describe the export.

If a deck's document is read as no one and its server refuses access, the export now fails with an error instead of saving a file.

Refs: GHSA-xcjw-3f3x-g9fc