fix: allow only space admins to list members - #84
Open
jesseplusplus wants to merge 1 commit into
Open
Conversation
|
@jesseplusplus is attempting to deploy a commit to the Birbhouse Games Team on Vercel. A member of the Team first needs to authorize it. |
Signed-off-by: Jesse Karmani <jessekarmani@gmail.com>
jesseplusplus
force-pushed
the
list-members-owner-only
branch
from
August 10, 2026 20:23
14e4375 to
d5d56e8
Compare
|
The latest updates on your projects. Learn more about Vercel for GitHub.
|
Author
|
Ah, looks like this is changing with https://github.com/bluesky-social/proposals/pull/100/changes#diff-247981d05685c888c2fe4d546ca7f762bbe36201976d6fade2f5f699e73f6c3fR623, so it would instead need to be based on mint-policy. It looks like writes and reads to happyview hosted spaces don't work with app-managed mint-policy, though, so there might need to be a bigger change to fully support the non-member-list mint-policy case. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
A non-owner member can currently call
com.atproto.simplespace.listMemberson HappyView and get the full member list. Proposal 0016 says accounts that may read a space are never enumerated at the protocol level;listMemberslives in the simplespace management layer, not the credential/sync surface, so it should not be callable by non-owner members.As part of this fix, I removed the public member list check since that's not supported by simplespace lexicons. If that's something HappyView still wants to support, that may need to be added back at a higher layer.