Fixed a bug where messages from no-access channels will propagate to

online users even if they didn't have access

2 files changed, 19 insertions, 3 deletions

diff --git a/internal/server/api/api.go b/internal/server/api/api.go
index a19e4dc..4a3c24a 100644
--- a/internal/server/api/api.go
+++ b/internal/server/api/api.go
@@ -82,9 +82,15 @@ func SendMessage(ctx context.Context, sess *session.Session, request *packet.Sen
 			return &ErrInternalError
 		}
 
-		return NetworkPropagate(ctx, sess, frequency.NetworkID, &packet.MessagesInfo{
+		return NetworkPropagateWithFilter(ctx, sess, frequency.NetworkID, &packet.MessagesInfo{
 			Messages:        []data.Message{message},
 			RemovedMessages: nil,
+		}, func(userId snowflake.ID) (pass bool) {
+			if frequency.Perms != packet.PermNoAccess {
+				return true
+			}
+			isAdmin, _ := IsNetworkAdmin(ctx, queries, userId, frequency.NetworkID)
+			return isAdmin
 		})
 	}
 
diff --git a/internal/server/api/helpers.go b/internal/server/api/helpers.go
index f98e2ad..03f45f1 100644
--- a/internal/server/api/helpers.go
+++ b/internal/server/api/helpers.go
@@ -45,15 +45,16 @@ func IsNetworkAdmin(ctx context.Context, queries *data.Queries, userId, networkI
 	return isAdmin, nil
 }
 
-func NetworkPropagate(
+func NetworkPropagateWithFilter(
 	ctx context.Context, sess *session.Session,
 	network snowflake.ID, payload packet.Payload,
+	filter func(userId snowflake.ID) (pass bool),
 ) packet.Payload {
 	var sessions []snowflake.ID
 	sess.Manager().UseSessions(func(s map[snowflake.ID]*session.Session) {
 		sessions = make([]snowflake.ID, 0, len(s)-1)
 		for key := range s {
-			if key != sess.ID() {
+			if key != sess.ID() && filter(key) {
 				sessions = append(sessions, key)
 			}
 		}
@@ -88,6 +89,15 @@ func NetworkPropagate(
 	return payload
 }
 
+func NetworkPropagate(
+	ctx context.Context, sess *session.Session,
+	network snowflake.ID, payload packet.Payload,
+) packet.Payload {
+	return NetworkPropagateWithFilter(ctx, sess, network, payload, func(userId snowflake.ID) bool {
+		return true
+	})
+}
+
 func SplitMembersAndUsers(membersAndUsers []data.GetNetworkMembersRow) ([]data.Member, []data.User) {
 	members := make([]data.Member, 0, len(membersAndUsers))
 	users := make([]data.User, 0, len(membersAndUsers))