Moheeb Zara
f5d670477b
Full-application audit (5 parallel read-only audits). Two agent
"blockers" were false alarms and verified as already-correct. Real
findings fixed:
- Self-escalation (BLOCKER): migration 024 + schema.sql section 16
extend prevent_member_self_role_change to also block a
non-privileged member changing their own tier_id (self tier
upgrade) and onboarding_completed_at (skipping required
code-of-conduct via a raw PostgREST call). finishOnboarding and
skipOnboarding now set onboarding_completed_at through the service
client AFTER their server-side required-steps check, so the
legitimate path is unaffected.
- Cross-tenant write scoping: added .eq('space_id', member.space_id)
to updateForumThread, deleteForumThread, editComment, deleteComment,
deleteChannel, renameChannel (RLS-only -> defence-in-depth).
- generateInviteCode: crypto.getRandomValues, widened to 8 chars
(was Math.random, ~21 bits, enumerable under the join rate limit).
- SafeMarkdown: dropped iframe and the global style attribute
(no unsandboxed embeds / UI-redress); markdown + safe HTML stay.
- /settings: server-side admin redirect before fetching space and
integration config (was client-hidden only).
- app/(app)/layout.tsx: export const dynamic = 'force-dynamic'.
- Bounded queries: loadComments .limit(500), tasks .limit(2000).
Backlog from the audit is tracked in HANDOFF (import Zod schemas,
types/database.ts + docs regen, email lowercasing, unauthorized-
handling consistency, KB-modal ACL hookup).
271/271 tests pass. Build clean. Migrations 023 + 024 idempotent,
apply via deploy.sh on next deploy.
41 lines
1.4 KiB
TypeScript
41 lines
1.4 KiB
TypeScript
import type { SupabaseClient } from '@supabase/supabase-js'
|
|
import type { CommentEntityType, CommentRow } from './comment-thread'
|
|
|
|
// Server-side fetch helper. Used from server components that render a
|
|
// CommentThread for any of the four supported entity types.
|
|
export async function loadComments(
|
|
supabase: SupabaseClient,
|
|
entityType: CommentEntityType,
|
|
entityId: string,
|
|
): Promise<CommentRow[]> {
|
|
const { data } = await supabase
|
|
.from('comments')
|
|
.select('id, body, created_at, edited_at, author_id')
|
|
.eq('entity_type', entityType)
|
|
.eq('entity_id', entityId)
|
|
.order('created_at', { ascending: true })
|
|
// Bound the payload: a thread with thousands of comments must not be able
|
|
// to hang the page. Newest 500 is plenty for the current UI.
|
|
.limit(500)
|
|
|
|
const rows = data ?? []
|
|
const authorIds = Array.from(new Set(rows.map(r => r.author_id).filter(Boolean) as string[]))
|
|
const authorMap: Record<string, string> = {}
|
|
if (authorIds.length > 0) {
|
|
const { data: authors } = await supabase
|
|
.from('space_members')
|
|
.select('id, display_name')
|
|
.in('id', authorIds)
|
|
for (const a of authors ?? []) authorMap[a.id] = a.display_name ?? 'Member'
|
|
}
|
|
|
|
return rows.map(r => ({
|
|
id: r.id,
|
|
body: r.body,
|
|
created_at: r.created_at,
|
|
edited_at: r.edited_at,
|
|
author_id: r.author_id,
|
|
author_name: r.author_id ? (authorMap[r.author_id] ?? 'Member') : null,
|
|
}))
|
|
}
|