fix token login member

proxy/src/index.ts

@@ -341,21 +341,26 @@ app.post("/api/members/verify-token", async (c) => {
     const { deviceToken, famSlug } = await c.req.json();
     if (!deviceToken || !famSlug)
       return c.json({ error: "deviceToken, famSlug required" }, 400);
-    const fams = await pb.getList("fams", `slug = '${famSlug}'`);
-    const fam = fams.items?.[0];
-    if (!fam) return c.json({ error: "Fam not found" }, 404);
     const hashHex = crypto
       .createHash("sha256")
       .update(deviceToken)
       .digest("hex");
+    // Look the member up by its (unique) device token hash, then confirm the
+    // requested slug belongs to that member's own fam. Looking up by slug first
+    // is unsafe because slug isn't unique — duplicate fams (e.g. after dev↔prod
+    // store drift) would resolve to the wrong family and reject valid tokens.
     const members = await pb.getList(
       "members",
-      `famId = '${fam.id}' && deviceToken = '${hashHex}'`,
+      `deviceToken = '${hashHex}'`,
     );
     const member = members.items?.[0];
     if (!member) return c.json({ error: "Invalid device token" }, 401);
+    const fams = await pb.getList("fams", `id = '${member.famId}'`);
+    const fam = fams.items?.[0];
+    if (!fam || fam.slug !== famSlug)
+      return c.json({ error: "Invalid device token" }, 401);
     return c.json({
-      famId: fam.id,
+      famId: member.famId,
       memberId: member.id,
       name: member.name,
       color: member.color,