MM-58577 Check remote ownership for posts and reactions (#27317)

* - ensure that posts and reactions can only be added via sync when coming from a remote that the target channel is shared with.
- ensure that posts and reactions are only modified/deleted by the remote that owns them.

* check that reaction belongs to post that belongs to channel that is shared with remote;  check that posts belong to channel shared with remote

* check for correct error type in unit test

* tweak unit test
Этот коммит содержится в:
Doug Lauder
2024-06-11 11:51:00 -04:00
коммит произвёл GitHub
родитель 6f8de3449a
Коммит 594ba6e665
10 изменённых файлов: 276 добавлений и 26 удалений

Просмотреть файл

@@ -740,6 +740,7 @@ type ReactionStore interface {
ExistsOnPost(postId string, emojiName string) (bool, error)
DeleteAllWithEmojiName(emojiName string) error
BulkGetForPosts(postIds []string) ([]*model.Reaction, error)
GetSingle(userID, postID, remoteID, emojiName string) (*model.Reaction, error)
DeleteOrphanedRowsByIds(r *model.RetentionIdsForDeletion) error
PermanentDeleteBatch(endTime int64, limit int64) (int64, error)
PermanentDeleteByUser(userID string) error