b53a97d26633a1f174a7031559a69d37e393379f
chmalee
  Fri May 1 14:19:19 2026 -0700
Allow myVariants tracks to be shared similar to google docs, read only and read+edit access by username or for all. Last write wins. Currently no history of changes, leaving that for the next version of the feature

diff --git src/hg/lib/cart.c src/hg/lib/cart.c
index 1e5349566d3..7c17f2d96d7 100644
--- src/hg/lib/cart.c
+++ src/hg/lib/cart.c
@@ -28,30 +28,31 @@
 #include "hui.h"
 #include "geoMirror.h"
 #include "hubConnect.h"
 #include "trackHub.h"
 #include "cgiApoptosis.h"
 #include "customComposite.h"
 #include "regexHelper.h"
 #include "windowsToAscii.h"
 #include "jsonWrite.h"
 #include "verbose.h"
 #include "genark.h"
 #include "quickLift.h"
 #include "botDelay.h"
 #include "curlWrap.h"
 #include "hubSpaceKeys.h"
+#include "myVariantsShare.h"
 
 static char *sessionVar = "hgsid";	/* Name of cgi variable session is stored in. */
 static char *positionCgiName = "position";
 
 DbConnector cartDefaultConnector = hConnectCart;
 DbDisconnect cartDefaultDisconnector = hDisconnectCart;
 static boolean cartDidContentType = FALSE;
 
 struct slPair *httpHeaders = NULL; // A list of headers to output before the content-type
 
 static void hashUpdateDynamicVal(struct hash *hash, char *name, void *val)
 /* Val is a dynamically allocated (freeMem-able) entity to put
  * in hash.  Override existing hash item with that name if any.
  * Otherwise make new hash item. */
 {
@@ -699,30 +700,40 @@
         else
             cartParseOverHashExt(cart, row[1], TRUE);
         cartSetString(cart, sessionVar, hgsid);
         if (sessionTableString != NULL)
             cartSetString(cart, hgSessionTableState, sessionTableString);
         if (pubSessionsTableString != NULL)
             cartSetString(cart, hgPublicSessionsTableState, pubSessionsTableString);
         if (oldVars)
             hashEmpty(oldVars);
         /* Overload settings explicitly passed in via CGI (except for the
          * command that sent us here): */
         loadCgiOverHash(cart, oldVars);
         if (isNotEmpty(actionVar))
             cartRemove(cart, actionVar);
         hDisconnectCentral(&conn2);
+
+        /* When loading another user's session, strip accepted-share cart vars
+         * so we don't carry shares from the session owner into the current user's
+         * cart. Shares are per-user; they should be re-accepted via share link. */
+        char *userName = wikiLinkUserName();
+        if (cfgOptionBooleanDefault("doMyVariants", FALSE)
+            && (userName == NULL || !sameString(sessionOwner, userName)))
+            {
+            cartRemoveLike(cart, MYVAR_SHARED_CART_PREFIX "*");
+            }
         }
     else
 	errAbort("Sharing has not been enabled for user %s's session %s.",
 		 sessionOwner, sessionName);
     }
 else
     errAbort("Could not find session %s for user %s.",
 	     sessionName, sessionOwner);
 sqlFreeResult(&sr);
 freeMem(encSessionName);
 }
 
 void cartLoadUserSession(struct sqlConnection *conn, char *sessionOwner,
 			 char *sessionName, struct cart *cart,
 			 struct hash *oldVars, char *actionVar)