diff --git a/DB_SCHEMA_MAP.md b/DB_SCHEMA_MAP.md index 1944568..ace7522 100644 --- a/DB_SCHEMA_MAP.md +++ b/DB_SCHEMA_MAP.md @@ -409,6 +409,7 @@ Default channels created by trigger on space INSERT: `general`, `announcements`, | 041 | Notifications P2: `notifications` outbox (type, recipient, subject, body_html/text, status, attempts, dedupe_key). UNIQUE(space_id,dedupe_key) = idempotent webhook enqueue; partial idx (created_at) WHERE status='pending'. SELECT admin/board/treasurer, service-client-only writes (webhook enqueue + dispatcher cron); member self-view via validated action | | 042 | Equipment double-booking P0 fix: `btree_gist` extension + `equipment_reservations_no_overlap` GiST EXCLUDE (equipment_id =, tstzrange(starts_at,ends_at,'[)') &&) WHERE status='reserved'. DB is the concurrency arbiter; reserveEquipment maps 23P01 to a friendly message. No new table/column | | 043 | `members_update` RLS gains a WITH CHECK mirroring its USING (defense-in-depth: a privileged caller can't mutate a member row into a space they don't administer). No new table/column | +| 044 | `prevent_member_self_role_change` also blocks self-change of payment_status, payment_note, dues_paid_until, last_paid_at, last_payment_at, stripe_customer_id, joined_at (member could otherwise forge a dues-good signal via PostgREST). Service-client/privileged writes still bypass. No new table/column | --- diff --git a/docs/DATABASE_SCHEMA.md b/docs/DATABASE_SCHEMA.md index 495f470..3ef7073 100644 --- a/docs/DATABASE_SCHEMA.md +++ b/docs/DATABASE_SCHEMA.md @@ -724,6 +724,7 @@ migration is mirrored as a section in it. Tables/columns added: | 041 | Transactional notifications P2. `notifications` outbox (space_id, member_id, type, recipient, subject, body_html/text, status pending/sent/failed, attempts, dedupe_key). `UNIQUE (space_id, dedupe_key)` makes the Stripe-webhook enqueue idempotent (event replay -> no-op). SELECT = admin/board/treasurer, NO client write policy (webhook enqueue + dispatcher cron, service-client only); member self-view via a validated action. Partial index on `(created_at) WHERE status='pending'` for the dispatcher drain. No new permission code | | 042 | Equipment double-booking P0 fix. `CREATE EXTENSION btree_gist` + `equipment_reservations_no_overlap` `EXCLUDE USING gist (equipment_id WITH =, tstzrange(starts_at,ends_at,'[)') WITH &&) WHERE status='reserved'`. Makes the DB the concurrency arbiter (the app-side check-then-insert was a TOCTOU); `reserveEquipment` maps the 23P01 exclusion violation to the friendly overlap message. No new table/column/policy/permission | | 043 | `members_update` RLS policy gains a `WITH CHECK` mirroring its `USING` (`user_id = auth.uid()` OR admin/board/treasurer in `space_id`). Defense-in-depth: the post-image is re-validated so a privileged caller cannot move a member row into a space they do not administer. No new table/column | +| 044 | `prevent_member_self_role_change` extended to also block a non-privileged member changing their own `payment_status`, `payment_note`, `dues_paid_until`, `last_paid_at`, `last_payment_at`, `stripe_customer_id`, `joined_at` (RLS lets a member UPDATE their own row, so these were self-settable to forge a dues-good signal). Service-client (`auth.uid()` NULL) and privileged-on-another-member writes still bypass. No new table/column | New enum: `comment_entity_type` = `forum_thread | proposal | incident | policy`. diff --git a/scripts/044_self_change_financial_columns.sql b/scripts/044_self_change_financial_columns.sql new file mode 100644 index 0000000..b365365 --- /dev/null +++ b/scripts/044_self_change_financial_columns.sql @@ -0,0 +1,52 @@ +-- ============================================================================= +-- 044: Block member self-change of financial columns +-- ============================================================================= +-- prevent_member_self_role_change protected role/tier/status/approved/ +-- card-access/onboarding/space but NOT the financial columns. RLS +-- members_update lets a member UPDATE their own row, so a member could +-- self-set payment_status / dues_paid_until / last_paid_at / etc. via +-- PostgREST and forge a "dues good" signal. Add them to the blocked set. +-- Legitimate writers are the Stripe webhook / treasurer actions via the +-- service client (auth.uid() IS NULL -> early return, unaffected) or a +-- privileged user editing ANOTHER member (NEW.user_id <> auth.uid()). +-- +-- Idempotent: CREATE OR REPLACE FUNCTION. +-- ============================================================================= + +CREATE OR REPLACE FUNCTION public.prevent_member_self_role_change() + RETURNS trigger LANGUAGE plpgsql SECURITY DEFINER SET search_path = public +AS $$ +DECLARE + v_is_privileged boolean; +BEGIN + IF auth.uid() IS NULL THEN RETURN NEW; END IF; + IF NEW.user_id IS DISTINCT FROM auth.uid() THEN RETURN NEW; END IF; + SELECT public.user_has_role_in_space(auth.uid(), NEW.space_id, ARRAY['admin','board','treasurer']) + INTO v_is_privileged; + IF v_is_privileged THEN RETURN NEW; END IF; + IF NEW.role IS DISTINCT FROM OLD.role + OR NEW.tier IS DISTINCT FROM OLD.tier + OR NEW.tier_id IS DISTINCT FROM OLD.tier_id + OR NEW.status IS DISTINCT FROM OLD.status + OR NEW.approved IS DISTINCT FROM OLD.approved + OR NEW.has_card_access IS DISTINCT FROM OLD.has_card_access + OR NEW.onboarding_completed_at IS DISTINCT FROM OLD.onboarding_completed_at + OR NEW.space_id IS DISTINCT FROM OLD.space_id + OR NEW.payment_status IS DISTINCT FROM OLD.payment_status + OR NEW.payment_note IS DISTINCT FROM OLD.payment_note + OR NEW.dues_paid_until IS DISTINCT FROM OLD.dues_paid_until + OR NEW.last_paid_at IS DISTINCT FROM OLD.last_paid_at + OR NEW.last_payment_at IS DISTINCT FROM OLD.last_payment_at + OR NEW.stripe_customer_id IS DISTINCT FROM OLD.stripe_customer_id + OR NEW.joined_at IS DISTINCT FROM OLD.joined_at THEN + RAISE EXCEPTION 'Members cannot change their own role, tier, status, approval, card access, onboarding completion, space, or payment/dues fields.' + USING ERRCODE = '42501'; + END IF; + RETURN NEW; +END; +$$; + +DROP TRIGGER IF EXISTS trg_prevent_member_self_role_change ON public.space_members; +CREATE TRIGGER trg_prevent_member_self_role_change + BEFORE UPDATE ON public.space_members + FOR EACH ROW EXECUTE FUNCTION public.prevent_member_self_role_change(); diff --git a/scripts/schema.sql b/scripts/schema.sql index fd0cd0a..2c15693 100644 --- a/scripts/schema.sql +++ b/scripts/schema.sql @@ -1856,9 +1856,13 @@ CREATE TRIGGER trg_seed_default_role_permissions -- ============================================================================= --- 16. Self-change hardening (equivalent to scripts/024_self_change_hardening.sql). --- Adds tier_id and onboarding_completed_at to the columns a non-privileged --- member cannot change on their own space_members row. +-- 16. Self-change hardening (equivalent to scripts/024 + scripts/044). +-- Columns a non-privileged member cannot change on their own +-- space_members row: role, tier(_id), status, approved, has_card_access, +-- onboarding_completed_at, space_id, and the payment/dues fields +-- (payment_status, payment_note, dues_paid_until, last_paid_at, +-- last_payment_at, stripe_customer_id, joined_at). Service-client and +-- privileged-on-another-member writes bypass (auth.uid() guards). -- ============================================================================= CREATE OR REPLACE FUNCTION public.prevent_member_self_role_change() @@ -1879,8 +1883,15 @@ BEGIN OR NEW.approved IS DISTINCT FROM OLD.approved OR NEW.has_card_access IS DISTINCT FROM OLD.has_card_access OR NEW.onboarding_completed_at IS DISTINCT FROM OLD.onboarding_completed_at - OR NEW.space_id IS DISTINCT FROM OLD.space_id THEN - RAISE EXCEPTION 'Members cannot change their own role, tier, status, approval, card access, onboarding completion, or space.' + OR NEW.space_id IS DISTINCT FROM OLD.space_id + OR NEW.payment_status IS DISTINCT FROM OLD.payment_status + OR NEW.payment_note IS DISTINCT FROM OLD.payment_note + OR NEW.dues_paid_until IS DISTINCT FROM OLD.dues_paid_until + OR NEW.last_paid_at IS DISTINCT FROM OLD.last_paid_at + OR NEW.last_payment_at IS DISTINCT FROM OLD.last_payment_at + OR NEW.stripe_customer_id IS DISTINCT FROM OLD.stripe_customer_id + OR NEW.joined_at IS DISTINCT FROM OLD.joined_at THEN + RAISE EXCEPTION 'Members cannot change their own role, tier, status, approval, card access, onboarding completion, space, or payment/dues fields.' USING ERRCODE = '42501'; END IF; RETURN NEW;