devsyncwrld/backspace
1
0
Fork 0
Code Issues Pull Requests Actions 26 Packages Projects Releases Wiki Activity

fix(permissions): deny space permissions to non-members (invite-bypass)

Browse Source 
computePermissions() returned the space @everyone role's permissions without
verifying the caller had joined the space. Because CREATE_INVITE is in
DEFAULT_EVERYONE_PERMISSIONS, any authenticated user could mint an invite code
for a request-only space — whose id is listed by /api/spaces/explore — and then
self-join via /api/spaces/:id/join, bypassing the join-request approval flow.
The same gap let non-members read message history and search default channels.

Root cause:
- computePermissions now returns 0n for non-members (space owner and instance
  admin still short-circuit first, so they are unaffected).

Defense in depth (request-only spaces are approval-gated, never invite-joinable):
- both invite-code join endpoints reject visibility='request' (private stays
  invite-joinable — its only entry path; public too).
- POST /api/spaces/:id/invite refuses to hand out a code for request spaces.
- POST /api/dm/space-invite refuses to card a local request space, checked by
  space id against the local table so a spoofed spaceInstanceOrigin can't slip
  past it.
- InviteModal hides the invite affordances for request spaces.

Also removes the unused computeCategoryPermissions(), which duplicated the
resolution algorithm without the membership gate.

Adds unit + route + component tests covering non-member/member/owner/admin
resolution and the request/private/public visibility matrix.

Reported-by: BadAtCaptchas (#2)
This commit is contained in:
Jannis Braun
2026-07-07 19:45:51 +02:00
committed by TheZwiss
parent 26bb0be7af
commit 85e1975fa5
11 changed files with 470 additions and 65 deletions
Download Patch File Download Diff File Expand all files Collapse all files
packages/server/src/utils/permissions.ts
+7 -61
View File
@@ -36,6 +36,13 @@ export function computePermissions(userId: string, spaceId: string, channelId?:
const userRow = db.select().from(schema.users).where(eq(schema.users.id, userId)).get();
if (userRow?.isAdmin === 1) return ALL_PERMISSIONS;
// 1c. Membership gate — a user who has not joined the space has NO permissions
// in it. Without this, the @everyone role below leaks default member rights
// (VIEW_CHANNEL, READ_MESSAGE_HISTORY, CREATE_INVITE, …) to any authenticated
// non-member, which allowed reading channels and minting invite codes for
// spaces the caller never joined. Owner and instance admin are handled above.
if (!getMember(spaceId, userId)) return 0n;
// 2. Base permissions from @everyone role (id === spaceId)
const everyoneRole = db.select().from(schema.roles)
.where(and(eq(schema.roles.id, spaceId), eq(schema.roles.spaceId, spaceId)))
@@ -146,67 +153,6 @@ export function computePermissions(userId: string, spaceId: string, channelId?:
return base;
}
/**
* Compute permissions at the category level (no channel step).
* Used for determining if a category is "private" for a user.
*/
export function computeCategoryPermissions(userId: string, spaceId: string, categoryId: string): bigint {
const db = getDb();
const space = db.select().from(schema.spaces).where(eq(schema.spaces.id, spaceId)).get();
if (!space) return 0n;
if (space.ownerId === userId) return ALL_PERMISSIONS;
const userRow = db.select().from(schema.users).where(eq(schema.users.id, userId)).get();
if (userRow?.isAdmin === 1) return ALL_PERMISSIONS;
const everyoneRole = db.select().from(schema.roles)
.where(and(eq(schema.roles.id, spaceId), eq(schema.roles.spaceId, spaceId)))
.get();
let base = everyoneRole ? stringToPermissions(everyoneRole.permissions) : 0n;
const memberRoleRows = db.select().from(schema.memberRoles)
.where(and(eq(schema.memberRoles.spaceId, spaceId), eq(schema.memberRoles.userId, userId)))
.all();
const assignedRoleIds = memberRoleRows.map(mr => mr.roleId);
for (const roleId of assignedRoleIds) {
const role = db.select().from(schema.roles).where(eq(schema.roles.id, roleId)).get();
if (role) base |= stringToPermissions(role.permissions);
}
if ((base & PermissionBits.ADMINISTRATOR) !== 0n) return ALL_PERMISSIONS;
const catOverrides = db.select().from(schema.categoryOverrides)
.where(eq(schema.categoryOverrides.categoryId, categoryId))
.all();
if (catOverrides.length === 0) return base;
const everyoneOverride = catOverrides.find(o => o.targetType === 'role' && o.targetId === spaceId);
if (everyoneOverride) {
base = (base & ~stringToPermissions(everyoneOverride.deny)) | stringToPermissions(everyoneOverride.allow);
}
let combinedAllow = 0n;
let combinedDeny = 0n;
for (const roleId of assignedRoleIds) {
const roleOverride = catOverrides.find(o => o.targetType === 'role' && o.targetId === roleId);
if (roleOverride) {
combinedAllow |= stringToPermissions(roleOverride.allow);
combinedDeny |= stringToPermissions(roleOverride.deny);
}
}
base = (base & ~combinedDeny) | combinedAllow;
const memberOverride = catOverrides.find(o => o.targetType === 'member' && o.targetId === userId);
if (memberOverride) {
base = (base & ~stringToPermissions(memberOverride.deny)) | stringToPermissions(memberOverride.allow);
}
return base;
}
/**
* Check if a user has a specific permission in a space/channel.
*/