fix: prevent potential email abuse on invitations endpoint #4569
Conversation
fontanierh
force-pushed
the
fix/prevent-email-abuse-on-invitation-endpoint
branch
from
5dd657f to
3433272
Compare
fontanierh
force-pushed
the
fix/prevent-email-abuse-on-invitation-endpoint
branch
from
3433272 to
28622c7
Compare
| const unconsumedInvitations = await MembershipInvitation.findAll({ | ||
| where: { | ||
| workspaceId: owner.id, | ||
| status: ["pending", "revoked"], |
There was a problem hiding this comment.
Should we account for revoked in there?
There was a problem hiding this comment.
Yeah because otherwise you can just revoke and re-send. Maybe we should discard revoked ones that are too old ? TBH if you have more than a few revoked it's fishy
There was a problem hiding this comment.
But what happens when you have revoked 50 invitations, you can't invite anymore?
There was a problem hiding this comment.
Simplified the whole thing. Now were just looking at invitations from the last 24 hours. IMO it's enough to limit abuse.
| ) | ||
| .map((i) => i.inviteEmail.toLowerCase().trim()) | ||
| ); | ||
| if ( |
There was a problem hiding this comment.
Assuming one email address already has a fresh recent invitation, the entire operation will fail?
There was a problem hiding this comment.
yes, would you prefer that we only filter those out ?
There was a problem hiding this comment.
I mean as long as we have an explicit error message in the UI and the user does not lose its email addresses list, I'm fine.
fontanierh
force-pushed
the
fix/prevent-email-abuse-on-invitation-endpoint
branch
from
d4b0f9f to
e120d41
Compare
| }); | ||
| } | ||
| const emailsWithRecentUnconsumedInvitations = new Set( | ||
| unconsumedInvitations.map((i) => i.inviteEmail.toLowerCase().trim()) |
There was a problem hiding this comment.
Shouldn't we do this when creating those invitations?
There was a problem hiding this comment.
ceinture bretelles
* fix: prevent potential email abuse on invitations endpoint * nit * simplify * nits --------- Co-authored-by: Henry Fontanier <[email protected]>
Description
fixes #4555
Limits the # of email invitations a workspace can send every day (50).
Prevents sending several invitations to the same email for the same workspace within a day
Risk
Deploy Plan