thinkpool-pair 0.7.165 → 0.7.166

package/bridge.mjs

@@ -612,8 +612,14 @@ const isRoomParticipant = async (jwt) => {
     const { data } = await supabase.auth.getUser(jwt)
     if (!data?.user) return false
     const uid = data.user.id
-    const r = await fetch(`${SUPABASE_URL}/rest/v1/code_sessions?code=eq.${encodeURIComponent(room)}&participants=cs.${uid}`, { headers: { apikey: SUPABASE_ANON, Authorization: `Bearer ${codeAuthToken}` } })
-    return r.ok
+    // Query with the CALLER's jwt (not the bridge host's codeAuthToken) so RLS scopes
+    // the read to what THIS user may see, and require an actual matching row — `r.ok`
+    // alone is true for an empty [] result, which let ANY authenticated user pass.
+    // participants is a uuid[]; PostgREST array-contains is cs.{uid} (braces required).
+    const r = await fetch(`${SUPABASE_URL}/rest/v1/code_sessions?code=eq.${encodeURIComponent(room)}&participants=cs.%7B${encodeURIComponent(uid)}%7D&select=code`, { headers: { apikey: SUPABASE_ANON, Authorization: `Bearer ${jwt}` } })
+    if (!r.ok) return false
+    const rows = await r.json().catch(() => [])
+    return Array.isArray(rows) && rows.length > 0
   } catch { return false }
 }
 // ── Room-serve owner consent (Contract C-CODE-3) ──────────────────────────────

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "thinkpool-pair",
-  "version": "0.7.165",
-  "description": "Share a local coding-agent CLI (Claude Code, Codex, Gemini, Aider, …) into a ThinkPool Code room, live.",
+  "version": "0.7.166",
+  "description": "Share a local coding-agent CLI (Claude Code, Codex, Gemini, Aider, \u2026) into a ThinkPool Code room, live.",
   "type": "module",
   "bin": {
     "thinkpool-pair": "bridge.mjs"