932a4080f7
Release-cycle red-team found getShareForPage joins only the shares table, so it does not exclude restricted descendants. The public share VIEW (getSharedPage) compensates with hasRestrictedAncestor, but the assistant's getSharePage tool and the controller funnel did not — so an anonymous caller could read a restricted descendant's content (tool) or surface its title into the system prompt (funnel) within an includeSubPages share. - getSharePage: after the share-membership check and before returning content, reject with the generic 'not part of this published share' message when hasRestrictedAncestor(page.id) is true (page.id is the resolved UUID, so slugId inputs work). Inject PagePermissionRepo. - funnel: resolve the OPENED page to its UUID and treat a restricted opened page as not-in-share (same uniform 404, fail closed if unresolvable) so its title never reaches buildShareSystemPrompt. search/list already exclude restricted subtrees (getPageAndDescendantsExcludingRestricted), so these were the only two bypasses. Generic messages keep restricted indistinguishable from not-in-share. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
A progressive Node.js framework for building efficient and scalable server-side applications.
Description
Nest framework TypeScript starter repository.
Installation
$ npm install
Running the app
# development
$ npm run start
# watch mode
$ npm run start:dev
# production mode
$ npm run start:prod
Migrations
# This creates a new empty migration file named 'init'
$ npm run migration:create --name=init
# Generates 'init' migration file from existing entities to update the database schema
$ npm run migration:generate --name=init
# Runs all pending migrations to update the database schema
$ npm run migration:run
# Reverts the last executed migration
$ npm run migration:revert
# Reverts all migrations
$ npm run migration:revert
# Shows the list of executed and pending migrations
$ npm run migration:show
## Test
```bash
# unit tests
$ npm run test
# e2e tests
$ npm run test:e2e
# test coverage
$ npm run test:cov
Support
Nest is an MIT-licensed open source project. It can grow thanks to the sponsors and support by the amazing backers. If you'd like to join them, please read more here.
Stay in touch
- Author - Kamil Myśliwiec
- Website - https://nestjs.com
- Twitter - @nestframework
License
Nest is MIT licensed.