From 6ee8663e9e2d8083661688f8747990e079423506 Mon Sep 17 00:00:00 2001
From: Jannis Braun <151788261+TheZwiss@users.noreply.github.com>
Date: Sun, 26 Apr 2026 21:23:55 +0200
Subject: [PATCH] fix(federation): narrow trust-guard query to inbound rows
 only
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The pre-existing trust-guard's query filtered peer_approval_requests by
origin only. After Task 3 added outbound rows to the same table, the
guard started matching the user's own queued outbound row on retry,
returning 'rejected' with a misleading 'admin must resolve pending
approval' copy instead of the intended 'admin_required'. The variable
name (pendingInbound) and comment block already described the intent
as inbound-only — the query just didn't match. Adding direction='inbound'
to the where clause restores the intended behavior.
---
 packages/server/src/utils/federationPeering.ts | 12 +++++++++++-
 1 file changed, 11 insertions(+), 1 deletion(-)

diff --git a/packages/server/src/utils/federationPeering.ts b/packages/server/src/utils/federationPeering.ts
index b2ff562a..4fdc8527 100644
--- a/packages/server/src/utils/federationPeering.ts
+++ b/packages/server/src/utils/federationPeering.ts
@@ -198,10 +198,20 @@ export async function ensurePeered(
   // The legitimate approval flow (routes/federation.ts /approval-requests/:id/
   // approve) does NOT call ensurePeered — it deletes the approval-request first
   // and does its own fetch — so this guard does not block legitimate approvals.
+  //
+  // direction='inbound' filter: the table is bidirectional as of the outbound
+  // peering gate (Task 3); outbound rows live in the same table and must NOT
+  // trigger this guard. The outbound gate below (`if (!existing)` block) is
+  // responsible for outbound row state.
   const pendingInbound = db
     .select({ id: schema.peerApprovalRequests.id })
     .from(schema.peerApprovalRequests)
-    .where(eq(schema.peerApprovalRequests.origin, normalized))
+    .where(
+      and(
+        eq(schema.peerApprovalRequests.origin, normalized),
+        eq(schema.peerApprovalRequests.direction, 'inbound'),
+      ),
+    )
     .get();
 
   if (pendingInbound) {