HomePhabricator
Diffusion Comm 2dba9fb9b5ed

[keyserver] Avoid trusting FIDs passed from client in updateRelationships

Description

[keyserver] Avoid trusting FIDs passed from client in updateRelationships

Summary:
We first implemented this code in the Hackathon, and forgot to reconsider it later.

We should avoid trusting the user's claims about FIDs. Instead, we should query the identity service.

This diff avoids changing the API, but updates the implementation to ignore the FIDs passed by the client.

Depends on D13435

Test Plan: I haven't done this yet, but I need to confirm that the Farcaster mutual logic still works correctly

Reviewers: varun

Reviewed By: varun

Subscribers: tomek

Differential Revision: https://phab.comm.dev/D13436

Details

Provenance
ashoatAuthored on Sep 20 2024, 12:48 PM
Reviewer
varun
Differential Revision
D13436: [keyserver] Avoid trusting FIDs passed from client in updateRelationships
Parents
rCOMM43ea688c82d5: [keyserver] Factor out findUserIdentities
Branches
Unknown
Tags
Unknown