From d0dca8b0a584e5eb7293e9b341eb75c3ef6e6eec Mon Sep 17 00:00:00 2001
From: Jannis Braun <151788261+TheZwiss@users.noreply.github.com>
Date: Tue, 10 Mar 2026 00:27:02 +0100
Subject: [PATCH] fix: broadcast channel_created with per-user permission
 filtering

Compute permissions per-user before broadcasting so users without
VIEW_CHANNEL never receive the channel_created event.
---
 packages/server/src/routes/channels.ts | 20 ++++++++++++++------
 1 file changed, 14 insertions(+), 6 deletions(-)

diff --git a/packages/server/src/routes/channels.ts b/packages/server/src/routes/channels.ts
index feb1dec6..218208f6 100644
--- a/packages/server/src/routes/channels.ts
+++ b/packages/server/src/routes/channels.ts
@@ -148,12 +148,20 @@ export async function channelRoutes(app: FastifyInstance): Promise<void> {
 
     const channelData = rowToChannel(channel);
 
-    // Broadcast channel_created to all space members
-    connectionManager.sendToSpace(id, {
-      type: 'channel_created',
-      channel: channelData,
-      spaceId: id,
-    });
+    // Broadcast channel_created with per-user permissions
+    // (same pattern as broadcastOverrideChange — permissions are per-user
+    // so we must compute individually rather than broadcast uniformly)
+    for (const [userId, spaceIds] of connectionManager.getUserSpaceEntries()) {
+      if (!spaceIds.has(id)) continue;
+      const perms = computePermissions(userId, id, channelId);
+      if ((perms & PermissionBits.VIEW_CHANNEL) !== 0n) {
+        connectionManager.sendToUser(userId, {
+          type: 'channel_created',
+          channel: { ...channelData, myPermissions: permissionsToString(perms) },
+          spaceId: id,
+        });
+      }
+    }
 
     return reply.code(201).send(channelData);
   });