Security: is_read_only enforced on only one endpoint #77

New issue

Closed

opened 2026-07-08 02:40:29 +00:00 by icub3d · 0 comments

icub3d commented

2026-07-08 02:40:29 +00:00

Owner

Severity: High — found in code review 2026-07-07.

Problem

The is_read_only session flag (used for unapproved/revoked bots) is enforced on exactly one endpoint: server/src/messages/handlers.rs:142. A grep confirms no other handler checks it.

A read-only session can still: add/remove reactions, upload attachments (attachments/handlers.rs:101), edit/delete its own messages, update its profile, and create invites. The read-only guarantee is effectively cosmetic.

Fix

Enforce is_read_only centrally — reject read-only sessions for all mutating routes in the MemberUser/permission extractor, rather than per-handler.

Acceptance

Read-only session is rejected on reactions, attachments, message update/delete, profile update, invite create
Tests cover at least reactions + attachments + profile

**Severity: High** — found in code review 2026-07-07. ## Problem The `is_read_only` session flag (used for unapproved/revoked bots) is enforced on exactly one endpoint: `server/src/messages/handlers.rs:142`. A grep confirms no other handler checks it. A read-only session can still: add/remove reactions, upload attachments (`attachments/handlers.rs:101`), edit/delete its own messages, update its profile, and create invites. The read-only guarantee is effectively cosmetic. ## Fix Enforce `is_read_only` centrally — reject read-only sessions for all mutating routes in the `MemberUser`/permission extractor, rather than per-handler. ## Acceptance - [ ] Read-only session is rejected on reactions, attachments, message update/delete, profile update, invite create - [ ] Tests cover at least reactions + attachments + profile

icub3d added the

area:api

status:planned

type:bug

labels

2026-07-08 02:40:29 +00:00

icub3d referenced this issue from a commit

2026-07-08 03:17:27 +00:00

fix(auth): enforce read-only sessions on all write routes

icub3d referenced this issue from a pull request that will close it,

2026-07-08 03:17:40 +00:00

fix(auth): enforce read-only sessions on all write routes #94