User can join club repeatedly through invites.

stuysu / api.stuyactivities.org

https://api.stuyactivities.org/graphql

9 stars 2 forks source link

User can join club repeatedly through invites. #742

Open randysim opened 1 year ago

randysim commented 1 year ago

If a leader of a club gets invited to join the club on stuyactivities, they can click that invite link over and over again generating an inflated member count. To fix this, just check if the user is already in the club when adding the user.

TheEgghead27 commented 1 year ago

Note that there may be race conditions, especially in adding membership requests, due to database desync.

TheEgghead27 commented 1 year ago

In addition, when a bug fix is deployed, we should take care to scan for and purge extraneous memberships/requests

TheEgghead27 commented 1 year ago

Notes:

GraphQL API route rate-limiting for join requests and membership approvals should mitigate the race conditions.
Invitations must be checked for valid users
SQL may be used at the resolution of this bug to purge existing duplicate memberships/invitations