okTurtles / group-income

A decentralized and private (end-to-end encrypted) financial safety net for you and your friends.
https://groupincome.org
GNU Affero General Public License v3.0
331 stars 44 forks source link

allow revoking 'Anyone' invite link when creator/admin is no longer a group member #2416

Open dotmacro opened 1 week ago

dotmacro commented 1 week ago

Problem

Currently, only the group admin/creator can revoke the "Anyone" invite link. When the admin/creator leaves the group, no other members can revoke the link. This is a great security/privacy concern because if the link is accidentally posted publicly or sent to the wrong email/account/etc, people not meant to be part of the group can join and no other members can prevent this from happening.

Solution

The "Anyone" invite link must be revocable by other group members when the admin/creator is no longer a member of the group.

dotmacro commented 1 week ago

Who else should be able to revoke the "Anyone" invite link?