devsyncwrld/backspace
1
0
Fork 0
Code Issues Pull Requests Actions 26 Packages Projects Releases Wiki Activity

fix: broadcast channel_created with per-user permission filtering

Browse Source 
Compute permissions per-user before broadcasting so users without
VIEW_CHANNEL never receive the channel_created event.
This commit is contained in:
Jannis Braun
2026-03-10 00:27:02 +01:00
parent ea1f2d8adc
commit d0dca8b0a5
1 changed files with 14 additions and 6 deletions
Download Patch File Download Diff File Expand all files Collapse all files
packages/server/src/routes/channels.ts
+11 -3
View File
@@ -148,12 +148,20 @@ export async function channelRoutes(app: FastifyInstance): Promise<void> {
const channelData = rowToChannel(channel);
// Broadcast channel_created to all space members
connectionManager.sendToSpace(id, {
// Broadcast channel_created with per-user permissions
// (same pattern as broadcastOverrideChange — permissions are per-user
// so we must compute individually rather than broadcast uniformly)
for (const [userId, spaceIds] of connectionManager.getUserSpaceEntries()) {
if (!spaceIds.has(id)) continue;
const perms = computePermissions(userId, id, channelId);
if ((perms & PermissionBits.VIEW_CHANNEL) !== 0n) {
connectionManager.sendToUser(userId, {
type: 'channel_created',
channel: channelData,
channel: { ...channelData, myPermissions: permissionsToString(perms) },
spaceId: id,
});
}
}
return reply.code(201).send(channelData);
});