mirror of
https://github.com/HeyPuter/puter.git
synced 2026-11-07 14:33:57 +00:00
Juan Castro
94d798ccce
All three block routes set only `subdomain`, `requireVerified` and a rate limit, and the controller's actor check accepts anything carrying a user, so an app-under-user token passed. Unlike `share` and `revoke`, nothing else bounded them: an app the user authorized once could read exactly whom they had blocked, then clear the list — blanket switch and per-username — and reopen the channel. A block list is a personal safety control, not something an app can otherwise reach, so it falls outside the "an app can share what it can already reach" carve-out the other share routes rely on. `requireUserActor` on all three, and deliberately without `allowFullAccessToken`: this is security management, which stays closed to every access token, personal ones included. The only caller is the desktop's Blocked Senders window, which sends the user's own session token. Tests fail without the gate: an app token minted through /auth/get-user-app-token is refused on all three routes while the user's own session still succeeds, and a metadata check pins the gate on every block route so a fourth cannot quietly ship without it.