Moheeb Zara
f5d670477b
Full-application audit (5 parallel read-only audits). Two agent
"blockers" were false alarms and verified as already-correct. Real
findings fixed:
- Self-escalation (BLOCKER): migration 024 + schema.sql section 16
extend prevent_member_self_role_change to also block a
non-privileged member changing their own tier_id (self tier
upgrade) and onboarding_completed_at (skipping required
code-of-conduct via a raw PostgREST call). finishOnboarding and
skipOnboarding now set onboarding_completed_at through the service
client AFTER their server-side required-steps check, so the
legitimate path is unaffected.
- Cross-tenant write scoping: added .eq('space_id', member.space_id)
to updateForumThread, deleteForumThread, editComment, deleteComment,
deleteChannel, renameChannel (RLS-only -> defence-in-depth).
- generateInviteCode: crypto.getRandomValues, widened to 8 chars
(was Math.random, ~21 bits, enumerable under the join rate limit).
- SafeMarkdown: dropped iframe and the global style attribute
(no unsandboxed embeds / UI-redress); markdown + safe HTML stay.
- /settings: server-side admin redirect before fetching space and
integration config (was client-hidden only).
- app/(app)/layout.tsx: export const dynamic = 'force-dynamic'.
- Bounded queries: loadComments .limit(500), tasks .limit(2000).
Backlog from the audit is tracked in HANDOFF (import Zod schemas,
types/database.ts + docs regen, email lowercasing, unauthorized-
handling consistency, KB-modal ACL hookup).
271/271 tests pass. Build clean. Migrations 023 + 024 idempotent,
apply via deploy.sh on next deploy.
82 lines
3.0 KiB
TypeScript
82 lines
3.0 KiB
TypeScript
import { createClient } from '@/lib/supabase/server'
|
|
import { redirect } from 'next/navigation'
|
|
import { AppSidebar } from '@/components/app-sidebar'
|
|
import { getRoleLabelMap } from '@/lib/role-labels'
|
|
|
|
// This layout is the auth/onboarding gate for the whole app. It must never be
|
|
// statically cached: every request re-checks the session and member state.
|
|
export const dynamic = 'force-dynamic'
|
|
|
|
export default async function AppLayout({ children }: { children: React.ReactNode }) {
|
|
const supabase = await createClient()
|
|
const { data: { user } } = await supabase.auth.getUser()
|
|
if (!user) redirect('/login')
|
|
|
|
const { data: member } = await supabase
|
|
.from('space_members')
|
|
.select('*, spaces(*)')
|
|
.eq('user_id', user.id)
|
|
.in('status', ['current', 'unverified', 'late'])
|
|
.order('joined_at', { ascending: true })
|
|
.limit(1)
|
|
.maybeSingle()
|
|
|
|
if (!member || !member.spaces) {
|
|
// No space found - redirect to signup to create/join one
|
|
const { data: { user: currentUser } } = await supabase.auth.getUser()
|
|
if (currentUser) {
|
|
redirect(`/signup?email=${encodeURIComponent(currentUser.email || '')}`)
|
|
}
|
|
redirect('/login')
|
|
}
|
|
|
|
// New members walk through the space's configured onboarding before they
|
|
// reach the app. Founders (createSpace) and pre-existing members (migration
|
|
// 022 backfill) have onboarding_completed_at set, so this only gates
|
|
// genuinely-new joiners. /onboarding is outside this layout group, so there
|
|
// is no redirect loop.
|
|
if (!(member as { onboarding_completed_at?: string | null }).onboarding_completed_at) {
|
|
redirect('/onboarding')
|
|
}
|
|
|
|
// Count badges
|
|
const { count: taskCount } = await supabase
|
|
.from('tasks')
|
|
.select('*', { count: 'exact', head: true })
|
|
.eq('space_id', member.space_id)
|
|
.in('status', ['open', 'claimed'])
|
|
|
|
const { count: paymentCount } = await supabase
|
|
.from('payments')
|
|
.select('*', { count: 'exact', head: true })
|
|
.eq('space_id', member.space_id)
|
|
.eq('link_status', 'unlinked')
|
|
|
|
const roleMap = await getRoleLabelMap(supabase, member.space_id)
|
|
const roleName = roleMap[member.role]?.name ?? member.role
|
|
|
|
return (
|
|
<div className="flex h-screen bg-background overflow-hidden">
|
|
<AppSidebar
|
|
member={member}
|
|
roleName={roleName}
|
|
taskBadge={taskCount ?? 0}
|
|
paymentBadge={paymentCount ?? 0}
|
|
/>
|
|
<main className="flex-1 overflow-y-auto pt-[52px] md:pt-0 flex flex-col">
|
|
<div className="flex-1">{children}</div>
|
|
{member.spaces && (member.spaces as { mission_statement?: string | null }).mission_statement && (
|
|
<footer className="border-t border-border bg-card px-4 md:px-6 py-3">
|
|
<p className="font-mono text-[10px] tracking-widest text-muted-foreground uppercase mb-1">
|
|
{member.spaces.name}
|
|
</p>
|
|
<p className="font-sans text-xs text-muted-foreground italic">
|
|
{(member.spaces as { mission_statement: string }).mission_statement}
|
|
</p>
|
|
</footer>
|
|
)}
|
|
</main>
|
|
</div>
|
|
)
|
|
}
|