diff options
| author | Christophe Besson <cbesson@gmail.com> | 2026-09-01 17:49:19 +0200 |
|---|---|---|
| committer | Christophe Besson <cbesson@gmail.com> | 2026-09-01 17:49:19 +0200 |
| commit | 6b38704d459dec1271c7ca883de3eb14190218f7 (patch) | |
| tree | 2fd1bd5c344092e4a115f3ab94e901517b3b6a03 /packages/meshbay-node/src/meshbay_node | |
| parent | 7d8c774e250b134222374f45726d5426714475de (diff) | |
| download | meshbay-6b38704d459dec1271c7ca883de3eb14190218f7.tar.gz | |
fix(hub): require user scope to add group members
Every mutating group endpoint depends on require_user_scope except
POST /v1/groups/{group_id}/members/{username}, which depended on
get_current_user — so a node-scoped daemon token (or a stolen one)
whose subject owns the group could add any existing user to it,
contradicting NS7 ("operator manages groups from the browser only").
test_node_auth.py::test_node_scope_blocks_add_member already existed
and was red on main; it passes now.
Third security review, finding M6.
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_011pG75yGK3NthNfyjH74omG
Diffstat (limited to 'packages/meshbay-node/src/meshbay_node')
0 files changed, 0 insertions, 0 deletions