mirror of
https://github.com/penpot/penpot.git
synced 2026-10-29 14:00:37 +00:00
1f96cd2e4c
Follow-up to the GHSA-m53j-2766-6jqw fix on issue-12155, addressing the reviewCode findings F1-F23. The revalidation task is now cancelled when the relay ends (F1): the closed channel is what ends it, because every way a subscription can end closes it. Before, each ended subscription left a task polling the database every 5 minutes for the life of the process while retaining the closed connection. The permission query now filters soft-deleted files, projects and teams (F2), matching its sibling queries. The websocket re-check therefore sees what the subscribe handler sees, and `delete-file`, `delete-project` and the newly announced `delete-team` actually close file subscriptions. Team-wide changes publish one event per team instead of one per member (F4): the watcher resolves the members itself, so a large team cannot overflow the bounded publish buffers. Both publishers defer through the existing `db/after-commit` (F3), so the watcher never checks pre-commit state. The interval is now genuinely tested (F6): revoking access through a direct row delete, the way an external change would, plus a negative control proving the tests fail with the scheduler removed. The `captured-events` helper forwards keyword args correctly instead of republishing to a garbage topic (F5), and the registry fixture runs per test so no relay leaks between tests (F8). The fail-open policy is pinned in both directions with the interrupt rethrown (F7), the internal topic is a fixed uuid like every other topic (F21), the watcher stops on shutdown (F22), the config key sits with the other HTTP knobs (F19), and the memory no longer claims a Promesa defect that the repo itself contradicts (F10). Closes #12155 AI-assisted-by: space-bunny-free