fix(permissions): deny space permissions to non-members (invite-bypass)

computePermissions() returned the space @everyone role's permissions without verifying the caller had joined the space. Because CREATE_INVITE is in DEFAULT_EVERYONE_PERMISSIONS, any authenticated user could mint an invite code for a request-only space — whose id is listed by /api/spaces/explore — and then self-join via /api/spaces/:id/join, bypassing the join-request approval flow. The same gap let non-members read message history and search default channels. Root cause: - computePermissions now returns 0n for non-members (space owner and instance admin still short-circuit first, so they are unaffected). Defense in depth (request-only spaces are approval-gated, never invite-joinable): - both invite-code join endpoints reject visibility='request' (private stays invite-joinable — its only entry path; public too). - POST /api/spaces/:id/invite refuses to hand out a code for request spaces. - POST /api/dm/space-invite refuses to card a local request space, checked by space id against the local table so a spoofed spaceInstanceOrigin can't slip past it. - InviteModal hides the invite affordances for request spaces. Also removes the unused computeCategoryPermissions(), which duplicated the resolution algorithm without the membership gate. Adds unit + route + component tests covering non-member/member/owner/admin resolution and the request/private/public visibility matrix. Reported-by: BadAtCaptchas (#2)
2026-07-07 19:45:51 +02:00
parent 26bb0be7af
commit 85e1975fa5
11 changed files with 470 additions and 65 deletions
@@ -0,0 +1,178 @@
+import { describe, it, expect, beforeEach, vi } from 'vitest';
+import Fastify, { type FastifyInstance } from 'fastify';
+import Database from 'better-sqlite3';
+import { drizzle } from 'drizzle-orm/better-sqlite3';
+import fs from 'node:fs';
+import path from 'node:path';
+import { fileURLToPath } from 'node:url';
+import * as schema from '../db/schema.js';
+import { setWorkerId } from '../utils/snowflake.js';
+
+setWorkerId(1);
+const __dirname = path.dirname(fileURLToPath(import.meta.url));
+
+type TestDb = ReturnType<typeof drizzle<typeof schema>>;
+let sqlite: Database.Database;
+let testDb: TestDb;
+let currentUserId = 'joiner';
+
+vi.mock('../db/index.js', () => ({
+  getDb: () => testDb,
+  getRawDb: () => sqlite,
+  schema,
+}));
+
+vi.mock('../utils/auth.js', () => ({
+  authenticate: async (req: { userId?: string }) => {
+    req.userId = currentUserId;
+  },
+}));
+
+vi.mock('../ws/handler.js', () => ({
+  connectionManager: {
+    addUserSpace: vi.fn(),
+    sendToSpace: vi.fn(),
+  },
+}));
+
+function applyMigrations(db: Database.Database): void {
+  const migrationsDir = path.resolve(__dirname, '../../drizzle');
+  const files = fs.readdirSync(migrationsDir).filter(f => f.endsWith('.sql')).sort();
+  for (const f of files) {
+    const sqlText = fs.readFileSync(path.join(migrationsDir, f), 'utf8');
+    for (const stmt of sqlText.split(/-->\s*statement-breakpoint/)) {
+      const clean = stmt.trim();
+      if (clean) db.exec(clean);
+    }
+  }
+}
+
+const OWNER_ID = 'owner';
+const now = 1_700_000_000_000;
+
+async function buildApp(): Promise<FastifyInstance> {
+  const { spaceRoutes } = await import('./spaces.js');
+  const f = Fastify();
+  await f.register(spaceRoutes);
+  return f;
+}
+
+let app: FastifyInstance;
+
+function makeSpace(id: string, visibility: 'public' | 'request' | 'private', inviteCode: string): void {
+  testDb.insert(schema.spaces).values({
+    id,
+    name: `space-${visibility}`,
+    ownerId: OWNER_ID,
+    inviteCode,
+    visibility,
+    createdAt: now,
+  }).run();
+}
+
+beforeEach(async () => {
+  sqlite = new Database(':memory:');
+  sqlite.pragma('foreign_keys = ON');
+  applyMigrations(sqlite);
+  testDb = drizzle(sqlite, { schema });
+  currentUserId = 'joiner';
+
+  for (const id of [OWNER_ID, 'joiner']) {
+    testDb.insert(schema.users).values({
+      id, username: id, passwordHash: 'x', createdAt: now,
+    }).run();
+  }
+
+  app = await buildApp();
+});
+
+function isMember(spaceId: string, userId: string): boolean {
+  return testDb.select().from(schema.spaceMembers).all()
+    .some(m => m.spaceId === spaceId && m.userId === userId);
+}
+
+describe('POST /api/spaces/:id/join — visibility guard', () => {
+  it('rejects an invite-code join for a request-only space (approval required)', async () => {
+    makeSpace('s-req', 'request', 'code-req');
+    const res = await app.inject({
+      method: 'POST',
+      url: '/api/spaces/s-req/join',
+      payload: { inviteCode: 'code-req' },
+    });
+    expect(res.statusCode).toBe(403);
+    expect(isMember('s-req', 'joiner')).toBe(false);
+  });
+
+  it('allows an invite-code join for a private space (invite is the only entry path)', async () => {
+    makeSpace('s-priv', 'private', 'code-priv');
+    const res = await app.inject({
+      method: 'POST',
+      url: '/api/spaces/s-priv/join',
+      payload: { inviteCode: 'code-priv' },
+    });
+    expect(res.statusCode).toBe(200);
+    expect(isMember('s-priv', 'joiner')).toBe(true);
+  });
+
+  it('allows an invite-code join for a public space', async () => {
+    makeSpace('s-pub', 'public', 'code-pub');
+    const res = await app.inject({
+      method: 'POST',
+      url: '/api/spaces/s-pub/join',
+      payload: { inviteCode: 'code-pub' },
+    });
+    expect(res.statusCode).toBe(200);
+    expect(isMember('s-pub', 'joiner')).toBe(true);
+  });
+});
+
+describe('POST /api/spaces/join (codeless) — visibility guard', () => {
+  it('rejects an invite-code join for a request-only space', async () => {
+    makeSpace('s-req2', 'request', 'code-req2');
+    const res = await app.inject({
+      method: 'POST',
+      url: '/api/spaces/join',
+      payload: { inviteCode: 'code-req2' },
+    });
+    expect(res.statusCode).toBe(403);
+    expect(isMember('s-req2', 'joiner')).toBe(false);
+  });
+
+  it('allows an invite-code join for a private space', async () => {
+    makeSpace('s-priv2', 'private', 'code-priv2');
+    const res = await app.inject({
+      method: 'POST',
+      url: '/api/spaces/join',
+      payload: { inviteCode: 'code-priv2' },
+    });
+    expect(res.statusCode).toBe(200);
+    expect(isMember('s-priv2', 'joiner')).toBe(true);
+  });
+});
+
+describe('POST /api/spaces/:id/invite — visibility guard', () => {
+  // Caller is the owner (a member with CREATE_INVITE) so we exercise the
+  // visibility guard, not the permission/membership gate.
+  it('refuses to mint/return an invite code for a request-only space', async () => {
+    currentUserId = OWNER_ID;
+    makeSpace('s-req-inv', 'request', 'code-req-inv');
+    const res = await app.inject({ method: 'POST', url: '/api/spaces/s-req-inv/invite' });
+    expect(res.statusCode).toBe(403);
+  });
+
+  it('returns an invite code for a private space', async () => {
+    currentUserId = OWNER_ID;
+    makeSpace('s-priv-inv', 'private', 'code-priv-inv');
+    const res = await app.inject({ method: 'POST', url: '/api/spaces/s-priv-inv/invite' });
+    expect(res.statusCode).toBe(200);
+    expect(res.json().inviteCode).toBe('code-priv-inv');
+  });
+
+  it('returns an invite code for a public space', async () => {
+    currentUserId = OWNER_ID;
+    makeSpace('s-pub-inv', 'public', 'code-pub-inv');
+    const res = await app.inject({ method: 'POST', url: '/api/spaces/s-pub-inv/invite' });
+    expect(res.statusCode).toBe(200);
+    expect(res.json().inviteCode).toBe('code-pub-inv');
+  });
+});