Moheeb Zara
f5d670477b
Full-application audit (5 parallel read-only audits). Two agent
"blockers" were false alarms and verified as already-correct. Real
findings fixed:
- Self-escalation (BLOCKER): migration 024 + schema.sql section 16
extend prevent_member_self_role_change to also block a
non-privileged member changing their own tier_id (self tier
upgrade) and onboarding_completed_at (skipping required
code-of-conduct via a raw PostgREST call). finishOnboarding and
skipOnboarding now set onboarding_completed_at through the service
client AFTER their server-side required-steps check, so the
legitimate path is unaffected.
- Cross-tenant write scoping: added .eq('space_id', member.space_id)
to updateForumThread, deleteForumThread, editComment, deleteComment,
deleteChannel, renameChannel (RLS-only -> defence-in-depth).
- generateInviteCode: crypto.getRandomValues, widened to 8 chars
(was Math.random, ~21 bits, enumerable under the join rate limit).
- SafeMarkdown: dropped iframe and the global style attribute
(no unsandboxed embeds / UI-redress); markdown + safe HTML stay.
- /settings: server-side admin redirect before fetching space and
integration config (was client-hidden only).
- app/(app)/layout.tsx: export const dynamic = 'force-dynamic'.
- Bounded queries: loadComments .limit(500), tasks .limit(2000).
Backlog from the audit is tracked in HANDOFF (import Zod schemas,
types/database.ts + docs regen, email lowercasing, unauthorized-
handling consistency, KB-modal ACL hookup).
271/271 tests pass. Build clean. Migrations 023 + 024 idempotent,
apply via deploy.sh on next deploy.
36 lines
1.2 KiB
TypeScript
36 lines
1.2 KiB
TypeScript
import { createClient } from '@/lib/supabase/server'
|
|
import SettingsClient from './settings-client'
|
|
import { redirect } from 'next/navigation'
|
|
|
|
export default async function SettingsPage() {
|
|
const supabase = await createClient()
|
|
const { data: { user } } = await supabase.auth.getUser()
|
|
if (!user) redirect('/login')
|
|
|
|
const { data: member } = await supabase
|
|
.from('space_members').select('space_id, role').eq('user_id', user.id).in('status', ['current', 'unverified', 'late']).single()
|
|
|
|
if (!member) redirect('/login')
|
|
|
|
// Settings is admin-only. Gate on the server BEFORE fetching space config
|
|
// and integration state so non-admins never receive it. Board/treasurer
|
|
// use /customize for the things they can change.
|
|
const isAdmin = member.role === 'admin'
|
|
if (!isAdmin) redirect('/dashboard')
|
|
|
|
const { data: space } = await supabase
|
|
.from('spaces').select('*').eq('id', member.space_id).single()
|
|
|
|
const { data: integrations } = await supabase
|
|
.from('integrations').select('*').eq('space_id', member.space_id)
|
|
|
|
return (
|
|
<SettingsClient
|
|
space={space}
|
|
isAdmin={isAdmin}
|
|
integrations={integrations ?? []}
|
|
currentRole={member.role}
|
|
/>
|
|
)
|
|
}
|