hzhang e45ad91340 fix(security): close Critical IDOR/authz gaps (C-1/C-2) ...

C-1: messaging endpoints now enforce channel participation (public
     channels open; private require channel_members). authorUserId is
     forced to the authenticated user (no more author spoofing); edit/
     delete require message-author ownership; history read gated too.
C-2: PUT /commands body strictly validated + size-capped via
     SyncCommandsDto (kills catalog poisoning / DoS). Optional
     FABRIC_BACKEND_GUILD_COMMANDS_SYNC_KEY restricts the write to the
     plugin when set; never weaker than before when unset.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

2026-05-16 17:47:08 +01:00

..

commands.controller.ts

fix(security): close Critical IDOR/authz gaps (C-1/C-2)

2026-05-16 17:47:08 +01:00

commands.module.ts

feat(guild): slash-command registry (sync + list API)

2026-05-16 16:02:49 +01:00

commands.service.ts

feat(guild): slash-command registry (sync + list API)

2026-05-16 16:02:49 +01:00

dto.sync-commands.dto.ts

fix(security): close Critical IDOR/authz gaps (C-1/C-2)

2026-05-16 17:47:08 +01:00