deepspace 0.9.1 → 0.9.2

package/dist/server.js

@@ -1863,9 +1863,12 @@ function lintSchema(schema) {
   }
   if (schema.ownerField) {
     const col = schema.columns.find((c) => c.name === schema.ownerField);
-    if (col && !col.userBound) {
+    const spoofableRoles = Object.entries(schema.permissions).filter(
+      ([role, permissions]) => role !== "owner" && role !== "admin" && permissions.create === true
+    ).map(([role]) => role);
+    if (col && !col.userBound && spoofableRoles.length > 0) {
       warnings.push(
-        `[${schema.name}] ownerField is '${schema.ownerField}' but that column is not marked userBound: true. A client can create a row with someone else's id in this field, bypassing 'own' permission checks. Add userBound: true (and ideally immutable: true) to the column.`
+        `[${schema.name}] ownerField is '${schema.ownerField}' but that column is not marked userBound: true. Client role(s) ${spoofableRoles.join(", ")} can create a row with someone else's id in this field, bypassing 'own' permission checks. Add userBound: true (and ideally immutable: true) to the column.`
       );
     }
   }
@@ -6314,8 +6317,18 @@ var CHANNELS_SCHEMA = {
   columns: [
     { name: "name", storage: "text", interpretation: "plain" },
     { name: "description", storage: "text", interpretation: "plain" },
-    { name: "type", storage: "text", interpretation: { kind: "select", options: ["public", "private", "dm"] } },
-    { name: "createdBy", storage: "text", interpretation: "plain" },
+    {
+      name: "type",
+      storage: "text",
+      interpretation: { kind: "select", options: ["public", "private", "dm"] }
+    },
+    {
+      name: "createdBy",
+      storage: "text",
+      interpretation: "plain",
+      userBound: true,
+      immutable: true
+    },
     { name: "archived", storage: "number", interpretation: { kind: "boolean" } }
   ],
   ownerField: "createdBy",
@@ -6330,7 +6343,13 @@ var MESSAGES_SCHEMA = {
   columns: [
     { name: "channelId", storage: "text", interpretation: "plain" },
     { name: "content", storage: "text", interpretation: "plain" },
-    { name: "authorId", storage: "text", interpretation: "plain" },
+    {
+      name: "authorId",
+      storage: "text",
+      interpretation: "plain",
+      userBound: true,
+      immutable: true
+    },
     { name: "parentMessageId", storage: "text", interpretation: "plain" },
     { name: "edited", storage: "number", interpretation: { kind: "boolean" } },
     { name: "editedAt", storage: "text", interpretation: { kind: "datetime" } },
@@ -6352,7 +6371,7 @@ var REACTIONS_SCHEMA = {
     { name: "messageId", storage: "text", interpretation: "plain" },
     { name: "channelId", storage: "text", interpretation: "plain" },
     { name: "emoji", storage: "text", interpretation: "plain" },
-    { name: "userId", storage: "text", interpretation: "plain" }
+    { name: "userId", storage: "text", interpretation: "plain", userBound: true, immutable: true }
   ],
   ownerField: "userId",
   uniqueOn: ["messageId", "emoji", "userId"],
@@ -6366,7 +6385,7 @@ var CHANNEL_MEMBERS_SCHEMA = {
   name: "channel-members",
   columns: [
     { name: "channelId", storage: "text", interpretation: "plain" },
-    { name: "userId", storage: "text", interpretation: "plain" },
+    { name: "userId", storage: "text", interpretation: "plain", userBound: true, immutable: true },
     { name: "joinedAt", storage: "text", interpretation: { kind: "datetime" } }
   ],
   ownerField: "userId",
@@ -6380,10 +6399,33 @@ var CHANNEL_MEMBERS_SCHEMA = {
 var CHANNEL_INVITATIONS_SCHEMA = {
   name: "channel-invitations",
   columns: [
-    { name: "channelId", storage: "text", interpretation: "plain", required: true, immutable: true },
-    { name: "invitedUserId", storage: "text", interpretation: "plain", required: true, immutable: true },
-    { name: "invitedBy", storage: "text", interpretation: "plain", userBound: true, immutable: true },
-    { name: "status", storage: "text", interpretation: { kind: "select", options: ["pending", "accepted", "declined"] }, required: true }
+    {
+      name: "channelId",
+      storage: "text",
+      interpretation: "plain",
+      required: true,
+      immutable: true
+    },
+    {
+      name: "invitedUserId",
+      storage: "text",
+      interpretation: "plain",
+      required: true,
+      immutable: true
+    },
+    {
+      name: "invitedBy",
+      storage: "text",
+      interpretation: "plain",
+      userBound: true,
+      immutable: true
+    },
+    {
+      name: "status",
+      storage: "text",
+      interpretation: { kind: "select", options: ["pending", "accepted", "declined"] },
+      required: true
+    }
   ],
   uniqueOn: ["channelId", "invitedUserId"],
   permissions: {
@@ -6396,7 +6438,7 @@ var READ_RECEIPTS_SCHEMA = {
   name: "read-receipts",
   columns: [
     { name: "channelId", storage: "text", interpretation: "plain" },
-    { name: "userId", storage: "text", interpretation: "plain" },
+    { name: "userId", storage: "text", interpretation: "plain", userBound: true, immutable: true },
     { name: "lastReadAt", storage: "text", interpretation: { kind: "datetime" } }
   ],
   ownerField: "userId",