Stop channel members from muting or renaming a channel for everyone #401

Summary

There are two mute flags:

• channel_members.mute_in_app_notifications is per user. The app's mute button writes this one (apps/webapp/src/components/chatroom/components/ChannelComposer/components/JoinBroadcastChannel.tsx:34). It mutes only that user. This part is correct.
• channels.mute_in_app_notifications is per channel. The notification triggers read it first, and return early for all members when it is true.

The app never writes the channel-level flag. But any channel member can write it directly through the Data API, and membership is self-service. So one free account can turn off mentions, replies and other notifications for every member of any channel. The same grant lets a member change the channel name, description and metadata.

• Severity: Medium
• Area: Supabase
• Source: security review of 2026-10-06, finding M3

Production check (2026-10-06, read-only)

• authenticated holds UPDATE on channels columns: allow_emoji_reactions, description, is_avatar_set, last_activity_at, last_message_preview, member_limit, metadata, mute_in_app_notifications, name.
• Policy channels_member_update: USING internal.is_channel_member(id).
• create_mention_notifications starts with select mute_in_app_notifications into is_channel_muted from public.channels where id = new.channel_id; if not found or is_channel_muted then return new;. create_everyone_notifications, create_regular_message_notifications, create_reply_notification and create_reaction_notifications read the same channel flag.
• join_workspace is executable by authenticated, and channel_members_join_insert lets a user add themself to any PUBLIC channel. So anyone can become a member.

Where

• Policy and grant: packages/supabase/migrations/20260513130000_chat_rls_rollout_catchup.sql:170-183; source packages/supabase/scripts/13-RLS.sql:135-148.
• Triggers: packages/supabase/migrations/20260921120000_chat_mention_token_rule.sql:28-35 (and siblings).
• Digest emails print the channel name: packages/email-templates/src/digestWalk.ts:71. The HTML is escaped, so this is spoofed text, not XSS.

Impact

• One update with mute_in_app_notifications = true stops in-app, push and email notifications for every member of that channel.
• allow_emoji_reactions = false disables reactions for everyone.
• A renamed channel shows attacker text in digest emails to every follower.

Fix plan

1. Revoke UPDATE on public.channels from authenticated, and drop the channels_member_update policy.
   • Every SQL writer of channels is a DEFINER trigger.
   • upsertChannel uses ignoreDuplicates (ON CONFLICT DO NOTHING), which needs no UPDATE right.
   • Confirm with grep -rn "from('channels')" apps/webapp/src that no client code calls .update( on channels.
2. If a channel-wide mute is a wanted feature, expose it through a DEFINER RPC that checks the document owner.
3. Mirror in packages/supabase/scripts/13-RLS.sql, then run bun run --filter @docs.plus/supabase_back types.

Acceptance criteria

• A signed-in member's PATCH /rest/v1/channels?id=eq.<id> with {"mute_in_app_notifications": true} is refused.
• The per-user mute button still works and mutes only that user.
• Channel creation, first message and unread counts still work.

Generated by Claude Code