safe-global / safe-client-gateway / 27542166327

90%

Build Type

push

github

Committed by web-flow

Commit Message

fix(spaces): require ACTIVE membership to access space contents (#3156)

* fix(spaces): deny space data to pending invitees

A pending (INVITED) member is not a member. Previously they could read a
space's address book (shared and private), safes, counterfactual safes,
address-book requests, the member roster and safe count before accepting
the invite. Per product decision, a pending user may only see the
invitation itself: the space name, who invited them, and accept/decline.

- assertMember and getSpaceAs now require ACTIVE membership.
- findSpaces (GET /spaces) returns only the caller's own invitation row
  and safeCount 0 for spaces they are merely invited to.
- GET /spaces/:id/members returns only the caller's own membership row
  for pending callers (the wallet derives its invite banner from this
  endpoint), and the full roster for active members.
- updateAlias now requires ACTIVE membership (was unchecked).
- GET /spaces/:id/membership intentionally stays available to pending
  callers: it returns only their own invitation.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

* test(spaces): address review feedback on member test naming

- rename invite*Member helpers to createPendingMember/createActiveMember
- use ACTIVE members in member-role authorization tests
- use 'pending member' wording consistently in test names
- clarify pending-member behavior in GET /members API description

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

* fix(spaces): return 403 when a pending member updates their alias

A membership that exists but is not ACTIVE is now rejected with
ForbiddenException, consistent with the other active-only guards.
A missing membership still returns 404.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

* fix(spaces): apply assertMember collapse missed in merge commit

The merge commit staged the auto-merged space-assert.utils.ts (which
still had assertActiveMember and a missing Member import); th... (continued)

Coverage Stats

4599 of 5471 branches covered (84.06%)

Branch coverage included in aggregate %.

15 of 16 new or added lines in 5 files covered. (93.75%)

3 existing lines in 3 files now uncovered.

17009 of 18470 relevant lines covered (92.09%)

603.75 hits per line