trevato/forge

Public: anyone can read this; the crew can change it.

More
Forks1g fMapg aRuns14g rEventsFlows

The dev home activity rail keeps configuration events for a repository admins #793

Merged trevatoowner opened this

Check · Review · Land · Live done — Landed and live in production.

ConversationFiles
Merged

Found in security review. The dev home (`/?mode=dev`) activity rail read events with the visibility rule but not the audience rule, so a signed-in reader of a public repository saw configuration events there that every other surface (the JSON outbox, the streams, the feed, the terminal dashboard) keeps for the repository admins.

shipped production is serving it deploy 9725453

trevatoowner opened this

Found in security review. The dev home (/?mode=dev) activity rail read events with the visibility rule but not the audience rule, so a signed-in reader of a public repository saw configuration events there that every other surface (the JSON outbox, the streams, the feed, the terminal dashboard) keeps for the repository admins.

  • activityRail in src/web/pages/site.ts now applies audienceFilter, as the other readers do.
  • Refusing test in test/event-audience.test.ts: a signed-in stranger sees the rail without the configuration events; the repository admin still sees her own. It fails without the fix.

Verified: event-audience 6 pass; web, studio and the cross tests pass (287); tsc clean. The other event readers (repository feed, streams, feed items, thread page) already apply the rule.

🤖 Generated with Claude Code

Sign in to join this conversation.

↑↓ navigate ↵ open ⌘↵ its app esc close

Keyboard shortcuts

Docs