Merge pull request #121 from wevm/sync-upstream-7

Sync rocicorp/mono main (836f22e)

Author: tmm

.changeset/swift-fast-reconnect.md

@@ -0,0 +1,5 @@
+---
+'zero-swift': patch
+---
+
+The client reconnects sooner when its connection drops or the server stops answering, as JS's client now does: the first retry comes within half a second, and each further failure in a row doubles the wait, up to the usual 5 seconds. A connection that stays up for 5 seconds starts the schedule over. Errors the server sends keep the full interval and any backoff they ask for.

SECURITY.md

@@ -0,0 +1,37 @@
+# Security policy
+
+## Reporting a vulnerability
+
+Please report vulnerabilities privately. Do not open a public issue.
+
+- Preferred: [open a private security advisory](https://github.com/rocicorp/mono/security/advisories/new).
+- By email: arv@roci.dev.
+
+Useful things to include: the affected package and version, what an attacker
+can do, and the smallest set of steps, patch or test that shows the problem.
+If a reproduction needs a running `zero-cache`, say how it is configured.
+
+We will acknowledge your report, tell you whether we consider it a
+vulnerability, and keep you posted while we work on a fix. We will credit you
+in the advisory and the release notes unless you would rather we did not.
+
+## Supported versions
+
+Security fixes land in the latest stable `@rocicorp/zero` minor release line
+and in canary. Earlier minors are not patched; please upgrade.
+
+## Scope
+
+`zero-cache` is run by each app on its own infrastructure and accepts
+WebSocket connections from untrusted browser clients, so everything a client
+sends is attacker-controlled. Reports we are most interested in:
+
+- authentication or authorization bypass, including permission rules that are
+  not applied
+- one user or client group reading or writing another's data
+- SQL injection, or remote code execution anywhere
+- reaching the admin endpoints without `ZERO_ADMIN_PASSWORD`
+
+Out of scope: anything that needs control of the operator's configuration,
+environment, Postgres database or API server; missing rate limiting on its
+own; and expensive queries an app has explicitly allowed.

apps/zbugs-swift/Sources/ZBugs/Queries.swift

@@ -321,26 +321,31 @@ public enum Queries {
   /// A page of an issue's comments, ordered by (created, id); a backward
   /// page flips the order. `start` is the cursor row.
   public static let commentsPage = defineQuery("commentsPage") {
-    (args: CommentsPageArgs, _: AuthData?) in
+    (args: CommentsPageArgs, auth: AuthData?) in
     let dir: AST.Direction = args.dir == .forward ? .asc : .desc
-    var q = zql.comment
-      .related(\.creator)
-      .related(\.emoji) { $0.related(\.creator) }
-      .where(\.issueID, args.issueID)
-      .orderBy(\.created, dir)
-      .orderBy(\.id, dir)
+    var q = applyCommentPermissions(
+      zql.comment
+        .related(\.creator)
+        .related(\.emoji) { $0.related(\.creator) }
+        .where(\.issueID, args.issueID),
+      auth?.role
+    )
+    .orderBy(\.created, dir)
+    .orderBy(\.id, dir)
     if let start = args.start {
       q = q.start([\.id: start.id, \.created: start.created], inclusive: args.inclusive)
     }
     return q.limit(args.limit)
   }
 
-  public static let comment = defineQuery("comment") { (id: String, _: AuthData?) in
-    zql.comment
-      .related(\.creator)
-      .related(\.emoji) { $0.related(\.creator) }
-      .where(\.id, id)
-      .one()
+  public static let comment = defineQuery("comment") { (id: String, auth: AuthData?) in
+    applyCommentPermissions(
+      zql.comment
+        .related(\.creator)
+        .related(\.emoji) { $0.related(\.creator) }
+        .where(\.id, id),
+      auth?.role
+    ).one()
   }
 
   public static let issueDetail = defineQuery("issueDetail") {
@@ -396,10 +401,19 @@ public enum Queries {
       .one()
   }
 
-  public static let emojiChange = defineQuery("emojiChange") { (subjectID: String, _: AuthData?) in
-    zql.emoji
-      .where(\.subjectID, subjectID)
-      .related(\.creator) { $0.one() }
+  public static let emojiChange = defineQuery("emojiChange") {
+    (subjectID: String, auth: AuthData?) in
+    let role = auth?.role
+    var q = zql.emoji.where(\.subjectID, subjectID)
+    if role != .crew {
+      // The subject is an issue or a comment.
+      q = q.where { emoji in
+        emoji.or(
+          emoji.exists(\.issue) { applyIssuePermissions($0, role) },
+          emoji.exists(\.comment) { applyCommentPermissions($0, role) })
+      }
+    }
+    return q.related(\.creator) { $0.one() }
   }
 
   /// Deprecated in zbugs.
@@ -454,6 +468,17 @@ where Result.Row == Issue {
   role == .crew ? q : q.where(\.visibility, .public)
 }
 
+/// Narrows a comment query to comments whose issue `role` may see. Comments
+/// and emoji are fetched by id, so each of those queries applies the issue's
+/// visibility itself.
+func applyCommentPermissions<Result: QueryResult>(
+  _ q: Query<Comment, Result>, _ role: Role?
+)
+  -> Query<Comment, Result>
+where Result.Row == Comment {
+  role == .crew ? q : q.whereExists(\.issue) { applyIssuePermissions($0, role) }
+}
+
 func labelsQuery(_ projectName: String, _ orderBy: AST.Direction?) -> Query<Label, [Label]> {
   var q = zql.label.whereExists(\.project, scalar: true) {
     $0.where(\.lowerCaseName, projectName.lowercased())