ContactIdentifyAction merges an incoming contact into an existing one that
matches by identifier, email, or phone_number. merge_contacts? returned true
whenever the request supplied no identifier, short-circuiting before the guard
that prevents merging contacts with mismatched identifiers. As a result a
request with no identifier could merge into (and overwrite) a contact that is
already identified, purely by matching its email or phone_number.
Drop the blank-identifier short-circuit so the identifier-mismatch guard runs in
that case too: a contact that owns an identifier is only merged into when the
request supplies the same identifier. Merges into non-identified contacts
(anonymous dedup) are unchanged.
Vishnu Narayanan
7d6b62d2a1