diff options
| -rw-r--r-- | packages/meshbay-hub/src/meshbay_hub/api/groups.py | 7 |
1 files changed, 6 insertions, 1 deletions
diff --git a/packages/meshbay-hub/src/meshbay_hub/api/groups.py b/packages/meshbay-hub/src/meshbay_hub/api/groups.py index fdb0444..15c7a5d 100644 --- a/packages/meshbay-hub/src/meshbay_hub/api/groups.py +++ b/packages/meshbay-hub/src/meshbay_hub/api/groups.py @@ -586,9 +586,14 @@ async def update_group( async def add_group_member( group_id: str, username: str, - current_user: User = Depends(get_current_user), + current_user: User = Depends(require_user_scope), db: AsyncSession = Depends(get_db), ): + # `require_user_scope`, like every other mutating group endpoint: a + # node-scoped daemon token must not manage membership (NS7 — the operator + # manages groups from the browser). This was the one membership endpoint + # still on `get_current_user`, so a node token could add members to its + # operator's own groups. group = await db.get(Group, group_id) if not group: raise HTTPException(status_code=404, detail="Group not found") |