Freegle / iznik-server-go / c3524367-60e2-4d3a-8349-b787855e8a87

73%

master: 89%

Pull #23

circleci

fix: Add message type validation and ownership check to message writes

C2: handleOutcome now validates that Taken is only used on Offer messages
and Received is only used on Wanted messages, matching PHP behavior.

C3: handleAddBy/handleRemoveBy now check that the caller is the message
poster or a moderator/owner of a group the message is on. Previously any
authenticated user could modify any message's "by" entries.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

486 of 567 new or added lines in 4 files covered. (85.71%)

7359 of 10077 relevant lines covered (73.03%)

9.06 hits per line