chahine/rebreak-monorepo
1
0
Fork 0
Code Issues Pull Requests Actions 2 Packages Projects Releases Wiki Activity

fix(backend): username (Login-Identifikator) aus öffentlichen Payloads entfernt

Browse Source 
community/posts.get.ts + social/profile/[userId].get.ts lieferten neben
nickname auch username an fremde Clients — username ist der Login-
Identifikator ({username}@rebreak.internal) und verletzt die Nickname-
Anonymitäts-Invariante (REQ-COMM-005 / R-DATA-07) + exponiert das halbe
Login-Credential-Paar. Frontend rendert das Feld nirgends (verifiziert);
totes Typ-Feld in stores/community.ts entfernt.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
This commit is contained in:
chahinebrini 2026-06-11 06:36:16 +02:00
parent 63fae25531
commit 2c33ba55a4
3 changed files with 3 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

1
apps/rebreak-native/stores/community.ts
View File

@ -4,7 +4,6 @@ export type CommunityCategory = 'all' | 'games' | 'domain_vote' | 'lyra' | 'rebr
export interface CommunityPostAuthor { export interface CommunityPostAuthor {
id: string | null; id: string | null;
username: string;
nickname: string; nickname: string;
avatar: string | null; avatar: string | null;
plan: string; plan: string;

3
backend/server/api/community/posts.get.ts
View File

@ -115,7 +115,8 @@ export default defineEventHandler(async (event) => {
: null, : null,
author: { author: {
id: p.userId ?? null, id: p.userId ?? null,
username: a?.username ?? "Nutzer", // username ist der Login-Identifikator (→ {username}@rebreak.internal)
// und darf NIE an fremde Clients gehen — Anonymitäts-Invariante (nickname-only).
nickname: a?.nickname ?? a?.username ?? "Nutzer", nickname: a?.nickname ?? a?.username ?? "Nutzer",
avatar: a?.avatar ?? null, avatar: a?.avatar ?? null,
plan: (a as any)?.plan ?? "free", plan: (a as any)?.plan ?? "free",

2
backend/server/api/social/profile/[userId].get.ts
View File

@ -56,7 +56,7 @@ export default defineEventHandler(async (event) => {
return { return {
id: profile.id, id: profile.id,
username: profile.username, // username (Login-Identifikator) bewusst NICHT exponiert — nickname-only.
nickname: meta.nickname ?? profile.username, nickname: meta.nickname ?? profile.username,
avatar: meta.avatar, avatar: meta.avatar,
bio: (profile as any).bio ?? null, bio: (profile as any).bio ?? null,