This repository was archived by the owner on May 29, 2026. It is now read-only.
fix(security): scope MCP tool results to caller's meetings, fix AgendaController chair check#327
Merged
Conversation
…aController chair check - AgendaController::requireChairOrAdmin: check nextcloudUserId field (PR #323) for chair/secretary role match, with fallback to legacy owner field - DecideskToolProvider::listOpenActionItems (scope=all): post-filter to action items linked to meetings the caller participates in; admins unfiltered - DecideskToolProvider::listRecentMeetings: post-filter to meetings the caller participates in via getCallerMeetingUuids helper; admins unfiltered Fixes #306, #307
rubenvdlinde
requested review from
WilcoLouwerse,
bbrands02 and
rjzondervan
as code owners
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to subscribe to this conversation on GitHub.
Already have an account?
Sign in.
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
#307):requireChairOrAdmin()checked$pData['owner']but the participant schema now stores the Nextcloud UID innextcloudUserId(added in fix: correct OR ObjectService API, add Meeting.chair + Participant.nextcloudUserId, HMAC-sign mail votes #323). Updated to match onnextcloudUserIdwith a fallback to the legacyownerfield for pre-migration records.#306):listOpenActionItemswithscope=all: added post-filter — non-admin callers receive only action items linked to meetings they participate in. Admins are unrestricted.listRecentMeetings: added post-filter — non-admin callers receive only meetings where they have a participant record. Admins are unrestricted.getCallerMeetingUuids()resolves meeting UUIDs from the caller's participant records and fails closed (returns empty set) if OpenRegister is unavailable.Test plan
PUT /api/agendas/{id}/publish→ 200 (was 403)PUT /api/agendas/{id}/publish→ 403listRecentMeetingsas non-admin → only returns meetings where caller has a participant recordlistOpenActionItemswithscope=allas non-admin → only returns items from caller's meetingsFixes #306, #307