protofire / safe-client-gateway / 32133341818

89%

staging: 89%

Build Type

push

github

Committed by DenSmolonski

Commit Message

fix: restrict space invites to admins of that space

The authorization check in `inviteUsers` looked up an ACTIVE/ADMIN member
row for the signer without constraining it to the target space, so an
admin of any one space could invite arbitrary members — including with
the ADMIN role — into any other space.

Replace the inline query with a dedicated `assertActiveSpaceAdmin` guard
that verifies admin rights within the given space, mirroring the scoping
already applied by `updateRole`, `removeUser` and the other member
operations. Error semantics are unchanged.

Add an integration test covering the repository layer and an e2e test
asserting the endpoint answers 401 when the signer administers a
different space.

Coverage Stats

2965 of 3775 branches covered (78.54%)

Branch coverage included in aggregate %.

5 of 5 new or added lines in 1 file covered. (100.0%)

2 existing lines in 2 files now uncovered.

14360 of 15668 relevant lines covered (91.65%)

541.63 hits per line