fix: enforce channel-level RBAC across WS broadcasts, REST endpoints, and frontend reactivity

Wire the bitwise permission engine end-to-end:

- Add sendToChannel() to ConnectionManager, filtering WS recipients by VIEW_CHANNEL
- Convert 6 channel-scoped events (messages, typing, reactions) from sendToServer to sendToChannel
- Add broadcastOverrideChange() to push channel_updated/channel_deleted per-user on override mutations
- Bridge legacy server_members.role TEXT to member_roles junction table on PATCH
- Add pushReadyPayload() to force re-sync frontend store after role changes
- Filter channels by VIEW_CHANNEL in GET /api/servers/:id to prevent initial load data leak
- Pre-compute viewers before CASCADE delete on channel_deleted
- Fix frontend channel event handlers to upsert/cleanup channelToServerMap and channelPermissions
- Add ChannelSettingsModal with Private Channel toggle and gear icon in ChannelSidebar

This commit is contained in:

Jannis Braun

2026-02-24 06:10:11 +01:00

parent 8030c89c6c

commit 76b8a43be2

10 changed files with 366 additions and 24 deletions

									
										packages/web/src/stores/uiStore.ts
									
		+1
		
												View File
												
				@@ -9,6 +9,7 @@ type ModalType =

				  | 'invite'

				  | 'userSettings'

				  | 'serverSettings'

				  | 'channelSettings'

				  | 'imagePreview'

				  | 'newDm'

				  | 'addDmMember'