Moheeb Zara
f5d670477b
Full-application audit (5 parallel read-only audits). Two agent
"blockers" were false alarms and verified as already-correct. Real
findings fixed:
- Self-escalation (BLOCKER): migration 024 + schema.sql section 16
extend prevent_member_self_role_change to also block a
non-privileged member changing their own tier_id (self tier
upgrade) and onboarding_completed_at (skipping required
code-of-conduct via a raw PostgREST call). finishOnboarding and
skipOnboarding now set onboarding_completed_at through the service
client AFTER their server-side required-steps check, so the
legitimate path is unaffected.
- Cross-tenant write scoping: added .eq('space_id', member.space_id)
to updateForumThread, deleteForumThread, editComment, deleteComment,
deleteChannel, renameChannel (RLS-only -> defence-in-depth).
- generateInviteCode: crypto.getRandomValues, widened to 8 chars
(was Math.random, ~21 bits, enumerable under the join rate limit).
- SafeMarkdown: dropped iframe and the global style attribute
(no unsandboxed embeds / UI-redress); markdown + safe HTML stay.
- /settings: server-side admin redirect before fetching space and
integration config (was client-hidden only).
- app/(app)/layout.tsx: export const dynamic = 'force-dynamic'.
- Bounded queries: loadComments .limit(500), tasks .limit(2000).
Backlog from the audit is tracked in HANDOFF (import Zod schemas,
types/database.ts + docs regen, email lowercasing, unauthorized-
handling consistency, KB-modal ACL hookup).
271/271 tests pass. Build clean. Migrations 023 + 024 idempotent,
apply via deploy.sh on next deploy.
43 lines
1.3 KiB
TypeScript
43 lines
1.3 KiB
TypeScript
import { createClient } from '@/lib/supabase/server'
|
|
import { TasksClient } from './tasks-client'
|
|
|
|
export default async function TasksPage() {
|
|
const supabase = await createClient()
|
|
const { data: { user } } = await supabase.auth.getUser()
|
|
if (!user) return null
|
|
|
|
const { data: member } = await supabase
|
|
.from('space_members')
|
|
.select('space_id, user_id, display_name, role')
|
|
.eq('user_id', user.id)
|
|
.in('status', ['current', 'unverified', 'late'])
|
|
.single()
|
|
|
|
const spaceId = member?.space_id
|
|
if (!spaceId) return null
|
|
|
|
const [{ data: tasks }, { data: members }, { data: areasRaw }] = await Promise.all([
|
|
supabase.from('tasks').select('*').eq('space_id', spaceId).order('created_at', { ascending: false }).limit(2000),
|
|
supabase.from('space_members').select('id, display_name, user_id').eq('space_id', spaceId).in('status', ['current', 'late']),
|
|
supabase
|
|
.from('space_areas')
|
|
.select('name')
|
|
.eq('space_id', spaceId)
|
|
.eq('is_archived', false)
|
|
.order('sort_order', { ascending: true })
|
|
.order('name', { ascending: true }),
|
|
])
|
|
|
|
const areas = (areasRaw ?? []).map((a: { name: string }) => a.name)
|
|
|
|
return (
|
|
<TasksClient
|
|
tasks={tasks ?? []}
|
|
members={members ?? []}
|
|
currentUserId={user.id}
|
|
spaceId={spaceId}
|
|
areas={areas}
|
|
/>
|
|
)
|
|
}
|