Freegle / Iznik / 9385 / 9385

70%

master: 70%

push

circleci

fix(ban): JoinAndPost was checking the wrong column for bans

handleJoinAndPost looked for memberships.collection='Banned' to detect
banned users, but that value is never written anywhere — V1 and V2 both
ban by deleting the memberships row and inserting into users_banned.
The check was therefore a permanent no-op and banned users could
self-rejoin and post via the Platform's compose-then-submit flow.

13 banned users had bypassed the check in production (cleaned up
separately by deleting the post-ban memberships rows). Test was also
asserting against the bogus state — rewritten to match real ban
representation and to also assert no membership/messages_groups row is
created on a 403.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

9115 of 10512 branches covered (86.71%)

Branch coverage included in aggregate %.

62233 of 98834 relevant lines covered (62.97%)

10.86 hits per line