fix(security): close member self-escalation + harden after full audit

Full-application audit (5 parallel read-only audits). Two agent
"blockers" were false alarms and verified as already-correct. Real
findings fixed:

- Self-escalation (BLOCKER): migration 024 + schema.sql section 16
  extend prevent_member_self_role_change to also block a
  non-privileged member changing their own tier_id (self tier
  upgrade) and onboarding_completed_at (skipping required
  code-of-conduct via a raw PostgREST call). finishOnboarding and
  skipOnboarding now set onboarding_completed_at through the service
  client AFTER their server-side required-steps check, so the
  legitimate path is unaffected.
- Cross-tenant write scoping: added .eq('space_id', member.space_id)
  to updateForumThread, deleteForumThread, editComment, deleteComment,
  deleteChannel, renameChannel (RLS-only -> defence-in-depth).
- generateInviteCode: crypto.getRandomValues, widened to 8 chars
  (was Math.random, ~21 bits, enumerable under the join rate limit).
- SafeMarkdown: dropped iframe and the global style attribute
  (no unsandboxed embeds / UI-redress); markdown + safe HTML stay.
- /settings: server-side admin redirect before fetching space and
  integration config (was client-hidden only).
- app/(app)/layout.tsx: export const dynamic = 'force-dynamic'.
- Bounded queries: loadComments .limit(500), tasks .limit(2000).

Backlog from the audit is tracked in HANDOFF (import Zod schemas,
types/database.ts + docs regen, email lowercasing, unauthorized-
handling consistency, KB-modal ACL hookup).

271/271 tests pass. Build clean. Migrations 023 + 024 idempotent,
apply via deploy.sh on next deploy.

lib/actions/comms.ts

@@ -55,12 +55,14 @@ export async function deleteChannel(channelId: string) {
   const supabase = await createClient()
   const auth = await requireMember(supabase)
   if (!auth.ok) return { error: auth.error }
+  const { member } = auth
 
   // Default channels are protected at the RLS layer too.
   const { error, count } = await supabase
     .from('comms_channels')
     .delete({ count: 'exact' })
     .eq('id', v.data)
+    .eq('space_id', member.space_id)
 
   if (error) return { error: error.message }
   if (count === 0) return { error: 'Cannot delete this channel' }
@@ -77,11 +79,13 @@ export async function renameChannel(channelId: string, name: string, description
   const supabase = await createClient()
   const auth = await requireMember(supabase)
   if (!auth.ok) return { error: auth.error }
+  const { member } = auth
 
   const { error } = await supabase
     .from('comms_channels')
     .update({ name: v.data.name, description: v.data.description ?? null })
     .eq('id', idCheck.data)
+    .eq('space_id', member.space_id)
 
   if (error) return { error: error.message }
   revalidatePath('/comms')

lib/actions/forum.ts

@@ -56,6 +56,7 @@ export async function updateForumThread(threadId: string, updates: {
   const supabase = await createClient()
   const auth = await requireMember(supabase)
   if (!auth.ok) return { error: auth.error }
+  const { member } = auth
 
   // Pinning/locking is moderator-only (admin/board). The RLS UPDATE policy
   // additionally requires the actor to be the author or admin/board, so a
@@ -73,7 +74,7 @@ export async function updateForumThread(threadId: string, updates: {
   if (v.data.pinned   !== undefined) patch.pinned = v.data.pinned
   if (v.data.locked   !== undefined) patch.locked = v.data.locked
 
-  const { error } = await supabase.from('forum_threads').update(patch).eq('id', idCheck.data)
+  const { error } = await supabase.from('forum_threads').update(patch).eq('id', idCheck.data).eq('space_id', member.space_id)
   if (error) return { error: error.message }
   revalidatePath('/forum')
   revalidatePath(`/forum/${idCheck.data}`)
@@ -87,6 +88,7 @@ export async function deleteForumThread(threadId: string) {
   const supabase = await createClient()
   const auth = await requireMember(supabase)
   if (!auth.ok) return { error: auth.error }
+  const { member } = auth
 
   // RLS DELETE allows the author or admin; non-authors get a row-not-found
   // error which we translate to a clearer message.
@@ -94,6 +96,7 @@ export async function deleteForumThread(threadId: string) {
     .from('forum_threads')
     .delete({ count: 'exact' })
     .eq('id', v.data)
+    .eq('space_id', member.space_id)
 
   if (error) return { error: error.message }
   if (count === 0) return { error: 'Not allowed to delete this thread' }
@@ -159,11 +162,13 @@ export async function editComment(commentId: string, body: string) {
   const supabase = await createClient()
   const auth = await requireMember(supabase)
   if (!auth.ok) return { error: auth.error }
+  const { member } = auth
 
   const { data, error } = await supabase
     .from('comments')
     .update({ body: v.data.body, edited_at: new Date().toISOString() })
     .eq('id', idCheck.data)
+    .eq('space_id', member.space_id)
     .select('entity_type, entity_id')
     .single()
 
@@ -179,11 +184,13 @@ export async function deleteComment(commentId: string) {
   const supabase = await createClient()
   const auth = await requireMember(supabase)
   if (!auth.ok) return { error: auth.error }
+  const { member } = auth
 
   const { data, error } = await supabase
     .from('comments')
     .delete()
     .eq('id', v.data)
+    .eq('space_id', member.space_id)
     .select('entity_type, entity_id')
     .single()
 

lib/actions/onboarding.ts

@@ -2,6 +2,7 @@
 
 import { revalidatePath } from 'next/cache'
 import { createClient } from '@/lib/supabase/server'
+import { createAdminClient } from '@/lib/supabase/admin'
 import { requireMember, requireMemberWithRole, parseInput } from '@/lib/auth-helpers'
 import {
   createOnboardingStepSchema,
@@ -173,10 +174,16 @@ export async function finishOnboarding() {
     return { error: 'Please complete the required steps before finishing.' }
   }
 
-  const { error } = await supabase
+  // onboarding_completed_at is blocked by the self-change trigger (migration
+  // 024) so a member cannot skip required steps via a raw PostgREST call.
+  // Set it via the service client AFTER the required-steps check above, scoped
+  // to this member's own id.
+  const admin = createAdminClient()
+  const { error } = await admin
     .from('space_members')
     .update({ onboarding_completed_at: new Date().toISOString() })
     .eq('id', member.id)
+    .eq('space_id', member.space_id)
 
   if (error) return { error: error.message }
   revalidatePath('/dashboard')
@@ -201,10 +208,12 @@ export async function skipOnboarding() {
     return { error: 'This space requires you to complete onboarding.' }
   }
 
-  const { error } = await supabase
+  const admin = createAdminClient()
+  const { error } = await admin
     .from('space_members')
     .update({ onboarding_completed_at: new Date().toISOString() })
     .eq('id', member.id)
+    .eq('space_id', member.space_id)
 
   if (error) return { error: error.message }
   revalidatePath('/dashboard')

lib/auth-actions.ts

@@ -6,11 +6,15 @@ import { redirect } from 'next/navigation'
 import { checkRateLimit, sanitizeString, sanitizeSlug } from '@/lib/security'
 
 function generateInviteCode() {
-  const chars = 'ABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789'
+  // Cryptographically random, and wider (8 chars) so the code space is not
+  // brute-forceable under the joinSpace rate limit.
+  const chars = 'ABCDEFGHJKLMNPQRSTUVWXYZ23456789'
   const prefix = 'HSL'
   const year = new Date().getFullYear()
+  const bytes = new Uint8Array(8)
+  crypto.getRandomValues(bytes)
   let code = ''
-  for (let i = 0; i < 4; i++) code += chars.charAt(Math.floor(Math.random() * chars.length))
+  for (let i = 0; i < 8; i++) code += chars[bytes[i] % chars.length]
   return `${prefix}-${year}-${code}`
 }