summary refs log tree commit diff
path: root/src/api
diff options
context:
space:
mode:
authorRory& <root@rory.gay>2026-05-06 21:52:07 +0200
committerRory& <root@rory.gay>2026-05-06 21:52:07 +0200
commit826a61eab62240737ee8caeb0e1a55f7b69938a4 (patch)
tree852af77706e4d34108b051cd50b63e71198d9b54 /src/api
parentSecurity: Dont allow other users to manage application commands (diff)
downloadserver-ts-sec/various.tar.xz
Security: stash changes github/sec/various sec/various
Diffstat (limited to 'src/api')
-rw-r--r--src/api/routes/channels/preload-messages.ts33
1 files changed, 31 insertions, 2 deletions
diff --git a/src/api/routes/channels/preload-messages.ts b/src/api/routes/channels/preload-messages.ts

index f14b387b..4d9c1547 100644 --- a/src/api/routes/channels/preload-messages.ts +++ b/src/api/routes/channels/preload-messages.ts
@@ -17,9 +17,11 @@ */ import { route } from "@spacebar/api"; -import { Config, Message } from "@spacebar/util"; +import { Channel, Config, Message } from "@spacebar/util"; import { Request, Response, Router } from "express"; -import { PreloadMessagesRequestSchema, PreloadMessagesResponseSchema } from "@spacebar/schemas"; +import { ChannelType, PreloadMessagesRequestSchema, PreloadMessagesResponseSchema } from "@spacebar/schemas"; +import { In } from "typeorm"; + const router = Router({ mergeParams: true }); router.post( @@ -44,6 +46,33 @@ router.post( message: `Cannot preload more than ${Config.get().limits.message.maxPreloadCount} channels at once.`, }); + const channels = await Channel.find({ + where: { id: In(body.channels!) }, + select: { + id: true, + type: true, + guild_id: true, + owner_id: true, + recipients: true, + thread_members: true, + parent_id: true, + }, + relations: { + recipients: true, + thread_members: true, + }, + }); + + const channelsToRemove: string[] = []; + const validChannels = await Promise.all( + channels.map(async (channel) => { + if (channel.isDm()) return { id: channel.id, valid: channel.recipients?.some((r) => r.user_id == req.user_id && !r.closed) }; + if (channel.isThread()) { + + } + }), + ); + const messages = ( await Promise.all( body.channels.map((channelId) =>