Skip to content

audit F23 [tech-debt]: kicked-member rejection missing for Message / EditMessage / DeleteMessage / Reaction #623

Description

@intendednull

File: crates/state/src/tests/permissions.rs:1196
Severity: tech-debt
Obvious? yes

crates/state/src/tests/permissions.rs has *_by_kicked_member_is_rejected tests for SetProfile (line 1196), UpdateProfile (1319), PinMessage (1491), and UnpinMessage (1683), but no parallel coverage for the four chat-channel event kinds: Message, EditMessage, DeleteMessage, Reaction. These are the most-emitted events in the system, and the e2e/permissions.spec.ts:77 Playwright test (a 30+ second multi-peer round-trip) is the only thing currently asserting that a kicked peer's Message is dropped. Per CLAUDE.md "Adding a new EventKind" rule + the decision tree §1.

Fix: add four state-tier tests in permissions.rs: message_by_kicked_member_is_rejected, edit_message_by_kicked_member_is_rejected, delete_message_by_kicked_member_is_rejected, reaction_by_kicked_member_is_rejected — each grants membership, kicks the member via Propose/Vote, then asserts apply_incremental returns the MemberKicked rejection. Sub-millisecond per test vs. the current 30-second Playwright roundtrip.


Filed by /general-audit @ 88498a5 (2026-05-04). master: #600.

Activity

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Assignees

No one assigned

    Projects

    No projects

      Milestone

      No milestone

      Relationships

      None yet

      Development

      No branches or pull requests

      Issue actions