Security: stash changes github/sec/various sec/various

1 files changed, 31 insertions, 2 deletions

diff --git a/src/api/routes/channels/preload-messages.ts b/src/api/routes/channels/preload-messages.ts

index f14b387b..4d9c1547 100644
--- a/src/api/routes/channels/preload-messages.ts
+++ b/src/api/routes/channels/preload-messages.ts
@@ -17,9 +17,11 @@
 */
 
 import { route } from "@spacebar/api";
-import { Config, Message } from "@spacebar/util";
+import { Channel, Config, Message } from "@spacebar/util";
 import { Request, Response, Router } from "express";
-import { PreloadMessagesRequestSchema, PreloadMessagesResponseSchema } from "@spacebar/schemas";
+import { ChannelType, PreloadMessagesRequestSchema, PreloadMessagesResponseSchema } from "@spacebar/schemas";
+import { In } from "typeorm";
+
 const router = Router({ mergeParams: true });
 
 router.post(
@@ -44,6 +46,33 @@ router.post(
                 message: `Cannot preload more than ${Config.get().limits.message.maxPreloadCount} channels at once.`,
             });
 
+        const channels = await Channel.find({
+            where: { id: In(body.channels!) },
+            select: {
+                id: true,
+                type: true,
+                guild_id: true,
+                owner_id: true,
+                recipients: true,
+                thread_members: true,
+                parent_id: true,
+            },
+            relations: {
+                recipients: true,
+                thread_members: true,
+            },
+        });
+
+        const channelsToRemove: string[] = [];
+        const validChannels = await Promise.all(
+            channels.map(async (channel) => {
+                if (channel.isDm()) return { id: channel.id, valid: channel.recipients?.some((r) => r.user_id == req.user_id && !r.closed) };
+                if (channel.isThread()) {
+
+                }
+            }),
+        );
+
         const messages = (
             await Promise.all(
                 body.channels.map((channelId) =>