bug

internal/extsvc/manager.go

@@ -2,6 +2,7 @@ package extsvc
 
 import (
 	"context"
+	"fmt"
 	"math/rand"
 	"net/http"
 	"strings"
@@ -9,6 +10,29 @@ import (
 	"time"
 )
 
+// baseCall extracts the operator's base callsign from a possibly-affixed call:
+// for slashed forms (F4BPO/P, FW/F4BPO, 9A/F4BPO/P) it returns the longest
+// token, which is the real call; otherwise the call itself. Upper-cased.
+func baseCall(s string) string {
+	s = strings.ToUpper(strings.TrimSpace(s))
+	if !strings.Contains(s, "/") {
+		return s
+	}
+	best := ""
+	for _, part := range strings.Split(s, "/") {
+		if len(part) > len(best) {
+			best = part
+		}
+	}
+	return best
+}
+
+// sameBaseCall reports whether two callsigns belong to the same operator,
+// ignoring portable prefixes/suffixes (F4BPO/P == F4BPO, FW/F4BPO == F4BPO).
+func sameBaseCall(a, b string) bool {
+	return baseCall(a) == baseCall(b)
+}
+
 // Deps are the host-app callbacks the Manager needs. Keeping them as
 // function fields decouples extsvc from the qso/adif/settings packages and
 // keeps the upload-scheduling logic testable.
@@ -33,6 +57,11 @@ type Deps struct {
 	// Upload flag ("N" or "R"), à la Log4OM. Returning false skips the QSO.
 	ShouldUpload func(svc Service, id int64) bool
 
+	// StationCallOf returns the QSO's STATION_CALLSIGN. Used to guard against
+	// uploading a QSO into a logbook for a different callsign (the force-call
+	// option would otherwise silently relabel it). "" → no station call known.
+	StationCallOf func(id int64) string
+
 	// Logf is an optional diagnostic logger.
 	Logf func(format string, args ...any)
 }
@@ -236,6 +265,33 @@ func (m *Manager) upload(svc Service, id int64, cfg ServiceConfig) bool {
 		return false
 	}
 
+	// Station-callsign guard. Each logbook belongs to one callsign:
+	//   QRZ/LoTW → the ForceStationCallsign (the call this logbook signs as)
+	//   Club Log → the logbook Callsign param
+	// If the QSO's own STATION_CALLSIGN is a DIFFERENT operator, uploading
+	// would push it into the wrong logbook (and the force-call option would
+	// silently relabel it). Block it with a clear error. Portable variants of
+	// the SAME call (F4BPO/P, FW/F4BPO…) are allowed.
+	owner := ""
+	switch svc {
+	case ServiceQRZ, ServiceLoTW:
+		owner = cfg.ForceStationCallsign
+	case ServiceClublog:
+		owner = cfg.Callsign
+	}
+	if owner != "" && m.deps.StationCallOf != nil {
+		qcall := m.deps.StationCallOf(id)
+		if qcall != "" && !sameBaseCall(qcall, owner) {
+			err := fmt.Errorf("station callsign %s does not match %s logbook %s — not uploaded",
+				strings.ToUpper(qcall), svc, strings.ToUpper(owner))
+			m.logf("extsvc: %s upload of QSO %d BLOCKED: %v", svc, id, err)
+			if m.deps.NotifyError != nil {
+				m.deps.NotifyError(svc, id, err)
+			}
+			return false
+		}
+	}
+
 	ctx, cancel := context.WithTimeout(context.Background(), 30*time.Second)
 	defer cancel()