rick/rosterchirp
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

v0.11.9 fixed tenant isolation bug

Browse Source
This commit is contained in:
Ricky Stretch
2026-03-21 12:53:00 -04:00
parent e0e800012c
commit c5a8d728d2
8 changed files with 85 additions and 60 deletions
Download Patch File Download Diff File Expand all files Collapse all files

10
backend/src/routes/messages.js
View File

@@ -10,6 +10,8 @@ function deleteImageFile(imageUrl) {
catch (e) { console.warn('[Messages] Could not delete image:', e.message); }
}
const R = (schema, type, id) => `${schema}:${type}:${id}`;
module.exports = function(io) {
const router = express.Router();
const { authMiddleware } = require('../middleware/auth');
@@ -98,7 +100,7 @@ module.exports = function(io) {
WHERE m.id=$1
`, [r.rows[0].id]);
message.reactions = [];
io.to(`group:${req.params.groupId}`).emit('message:new', message);
io.to(R(req.schema,'group',req.params.groupId)).emit('message:new', message);
res.json({ message });
} catch (e) { res.status(500).json({ error: e.message }); }
});
@@ -121,7 +123,7 @@ module.exports = function(io) {
[r.rows[0].id]
);
message.reactions = [];
io.to(`group:${req.params.groupId}`).emit('message:new', message);
io.to(R(req.schema,'group',req.params.groupId)).emit('message:new', message);
res.json({ message });
} catch (e) { res.status(500).json({ error: e.message }); }
});
@@ -140,7 +142,7 @@ module.exports = function(io) {
const imageUrl = message.image_url;
await exec(req.schema, 'UPDATE messages SET is_deleted=TRUE, content=NULL, image_url=NULL WHERE id=$1', [message.id]);
deleteImageFile(imageUrl);
io.to(`group:${message.group_id}`).emit('message:deleted', { messageId: message.id, groupId: message.group_id });
io.to(R(req.schema,'group',message.group_id)).emit('message:deleted', { messageId: message.id, groupId: message.group_id });
res.json({ success: true, messageId: message.id });
} catch (e) { res.status(500).json({ error: e.message }); }
});
@@ -164,7 +166,7 @@ module.exports = function(io) {
'SELECT r.emoji, r.user_id, u.name AS user_name FROM reactions r JOIN users u ON r.user_id=u.id WHERE r.message_id=$1',
[message.id]
);
io.to(`group:${message.group_id}`).emit('reaction:updated', { messageId: message.id, reactions });
io.to(R(req.schema,'group',message.group_id)).emit('reaction:updated', { messageId: message.id, reactions });
res.json({ reactions });
} catch (e) { res.status(500).json({ error: e.message }); }
});