fix(webapp): a pending wiki suggestion can't be read by id (#836) #838

Merged

claude-bot merged 2 commits from fix/proposal-read-leak into main 2026-09-26 15:50:09 +00:00

Conversation 0 Commits 2 Files changed 3 +278 -6

claude-bot commented 2026-09-26 14:21:54 +00:00

Collaborator

Copy link

Closes #836.

The bug: a lore proposal (LoreEntry.proposed_by_bot, cleared on approval) left out of the lists could still be read by any member who knew its id. Every lore read goes through get_lore_entry, which filtered only deleted_at.

The fix: _hide_pending_proposal(entry, is_gm) in routers/campaigns.py, applied to every read path a player can reach by id:

• GET /lore/{id}: a non-GM gets 404 with the same body as a missing entry.
• GET /lore/{id}/versions: the membership lookup moved ahead of the fetch, so a proposal is 404 rather than 403. A 403 would confirm it exists.
• GET /lore/relationships?entry_id=: a hidden proposal gives the same empty list as an unrelated id.
• Unchanged: the embedded fields (sessions, appearances, image) come through the single-entry response, and GM-only writes are already GM-only.

Tests: tests/test_proposal_read_leak.py, 11 tests.

• Five of them failed before the fix: a player got 200 or 403, and the relationships list leaked.
• With the lore modules, 120 pass.
• ruff is clean.

🤖 Generated with Claude Code

Closes #836. **The bug:** a lore proposal (`LoreEntry.proposed_by_bot`, cleared on approval) left out of the lists could still be read by any member who knew its id. Every lore read goes through `get_lore_entry`, which filtered only `deleted_at`. **The fix:** `_hide_pending_proposal(entry, is_gm)` in `routers/campaigns.py`, applied to every read path a player can reach by id: - **`GET /lore/{id}`:** a non-GM gets 404 with the same body as a missing entry. - **`GET /lore/{id}/versions`:** the membership lookup moved ahead of the fetch, so a proposal is 404 rather than 403. A 403 would confirm it exists. - **`GET /lore/relationships?entry_id=`:** a hidden proposal gives the same empty list as an unrelated id. - **Unchanged:** the embedded fields (sessions, appearances, image) come through the single-entry response, and GM-only writes are already GM-only. **Tests:** `tests/test_proposal_read_leak.py`, 11 tests. - Five of them failed before the fix: a player got 200 or 403, and the relationships list leaked. - With the lore modules, 120 pass. - ruff is clean. 🤖 Generated with [Claude Code](https://claude.com/claude-code)

claude-bot added 1 commit 2026-09-26 14:21:54 +00:00

fix(webapp): a pending wiki proposal is not readable before a GM sees it (#836) ... 125ec0a9a4

`get_lore_entry`, the getter almost every lore endpoint funnels through, only
excluded trashed entries — not unaccepted bot proposals. A campaign member who
knew or guessed a proposal's id could read its full body via
GET /api/campaigns/{id}/lore/{entry_id} or its /versions history, and confirm
it exists, before any GM had reviewed it. The proposal lists already filtered
this correctly; the single-entry reads never did.

Add `_hide_pending_proposal`, applied to every id-keyed read that can reach a
lore entry: the single entry endpoint, its version history, and the approved
relationships list when filtered by entry_id. A pending proposal now looks
exactly like a missing id to a non-GM (same 404 body); a GM is unaffected.

Tests in test_proposal_read_leak.py confirmed the leak before the fix (5
failures: player reads returned 200/403 instead of 404, and the leaking
relationship result was non-empty) and pass after it, alongside the existing
lore/wiki suite (120 total).

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

rbrooks added 1 commit 2026-09-26 14:53:34 +00:00

Merge remote-tracking branch 'origin/main' into fix/proposal-read-leak ... f2591b9326

# Conflicts:
#	CHANGELOG.md

claude-bot merged commit 8fd628f685 into main 2026-09-26 15:50:09 +00:00

claude-bot referenced this pull request from a commit 2026-09-26 15:50:12 +00:00

Merge PR #838: a pending wiki suggestion can't be read by id (#836)

claude-bot referenced this pull request 2026-09-26 15:54:37 +00:00

A pending wiki suggestion can be read by id through GET /lore/{id} and its versions #836

rbrooks referenced this pull request from a commit 2026-09-26 19:46:55 +00:00

Merge origin/main into lane 6 (#732); re-chain b8c0d2e4f6a7 onto c4e6a8b0d2f1

Sign in to join this conversation.

Reviewers

No reviewers

Labels

Clear labels   

backend

Issue related to the backend

  

bot

Issue related to the bot

  

bug

Something is not working

  

duplicate

This issue or pull request already exists

  

enhancement

New feature

  

frontend

Issue related to the frontend

  

help wanted

Need some help

  

invalid

Something is wrong

  

question

More information is needed

  

recording

Issue related to the recording system

  

security

Security hardening / vulnerability work

  

wontfix

This won't be fixed

No labels

backend

bot

bug

duplicate

enhancement

frontend

help wanted

invalid

question

recording

security

wontfix

Milestone

Clear milestone

No items

No milestone

Projects

Clear projects

No items

No project

Assignees

Clear assignees

No assignees

2 participants

Notifications

Subscribe

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set

Reference

rbrooks/Quest-Board!838

No description provided.