From d9ae3018180e12c8b79361ef58c9e9e7114d80aa Mon Sep 17 00:00:00 2001 From: Kyren223 Date: Tue, 4 Feb 2025 19:08:22 +0200 Subject: Reverted back the removal of the logic in get notifications to check if the user has access to the frequency, because it is needed for the is_admin ping type but also to prevent the case where someone was an admin, got demoted and can now monitor when new messages are sent there --- internal/server/api/helpers.go | 13 ++++++++++++- 1 file changed, 12 insertions(+), 1 deletion(-) (limited to 'internal/server/api') diff --git a/internal/server/api/helpers.go b/internal/server/api/helpers.go index c4deb6c..27c6f55 100644 --- a/internal/server/api/helpers.go +++ b/internal/server/api/helpers.go @@ -132,10 +132,20 @@ func UserPropagate( } const getNotificationsQuery = `-- name: GetNotifications :many -WITH entries AS ( +WITH +entries AS ( SELECT source_id, last_read FROM last_read_messages WHERE user_id = ? +), +permitted_frequencies AS ( + SELECT f.id, m.is_admin + FROM frequencies f + JOIN entries e ON f.id = e.source_id + LEFT JOIN members m + ON m.user_id = ? + AND m.network_id = f.network_id + WHERE m.is_member = true AND (f.perms != 0 OR m.is_admin = true) ) SELECT e.source_id, @@ -149,6 +159,7 @@ LEFT JOIN messages m ON m.id > e.last_read AND (m.frequency_id = e.source_id OR (m.receiver_id = e.source_id AND m.sender_id = ?) OR (m.sender_id = e.source_id AND m.receiver_id = ?)) +JOIN permitted_frequencies pf ON e.source_id = pf.id GROUP BY e.source_id, e.last_read; ` -- cgit v1.3.1