J3vbandClaude Fable 5 249e35af91 feat(server): unify channel-visibility through permissions.Checker ...

Route the four "must mirror" READ_MESSAGES filters — REST
ListVisibleChannels, ws buildReady, reconnect replay
computeAllowedChannels, and hub RefreshChannelVisibility — through a
single permissions.Checker predicate so a drift can never leak a
private channel (audit A-2026-07-07 / backlog item 3).

- add permissions.Checker.VisibleChannelIDs + ChannelRef (skips dm,
  fails closed, admin bypass via HasChannelPermBatch)
- delegate the three batch sites; RefreshChannelVisibility uses
  HasChannelPerm instead of its inline EffectivePerms copy
- REST/WS agreement test asserting all three sites yield the identical
  non-DM set across admin / member-with-deny / denied-everywhere

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

2026-07-20 11:28:03 +02:00

..

checker_test.go

feat(server): unify channel-visibility through permissions.Checker

2026-07-20 11:28:03 +02:00

checker.go

feat(server): unify channel-visibility through permissions.Checker

2026-07-20 11:28:03 +02:00

main_test.go

feat: add syncutil mutex, test scaffolding, and server hardening

2026-04-01 12:04:15 +02:00

permissions_test.go

chore: remove soundboard feature entirely

2026-04-02 17:00:27 +02:00

permissions.go

feat(server,admin): private channels via per-role permission overrides

2026-07-19 10:50:11 +00:00