GHSA-m53j-2766-6jqw. A websocket subscription checks read permission
once, at subscribe time, then relays every message published to the
topic for the rest of the connection's life. A member whose access is
revoked keeps receiving live file content as long as the tab stays
open, because nothing re-checks the permission.
These tests reproduce the leak against the real message bus, so the
failure is observed end to end rather than assumed:
- revoked-member-stops-receiving-file-changes: after delete-team-member
the socket still receives the :file-change diff.
- revoked-member-stops-receiving-library-changes: leave-team keeps the
team subscription alive, leaking :library-change diffs.
- role-downgrade-keeps-revocation-irrelevant: a downgrade to :viewer
keeps read access, so the subscription must survive it. Guards
against a fix that closes subscriptions too eagerly.
The two revocation tests fail on the current code; the role test
passes and pins the behavior a fix must not break.
Closes#12155
AI-assisted-by: space-bunny-free
606d68e2b4