-
Notifications
You must be signed in to change notification settings - Fork 197
improve membersURI #812
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
base: master
Are you sure you want to change the base?
improve membersURI #812
Changes from 26 commits
a386393
3e5bf86
231b6b3
b828ed3
51c4294
7ebe8c7
ac8669b
9d41dd3
47e6eb0
a35202b
458e794
9849c0b
e342770
252acc3
1df3050
1da8ee9
b2c10b8
0ce6028
240ed25
1cd13f3
ad86432
3ca9efa
560a182
d285d3b
f96bf1d
84d905e
51b90b6
f052e0e
File filter
Filter by extension
Conversations
Jump to
Diff view
Diff view
There are no files selected for viewing
Original file line number | Diff line number | Diff line change |
---|---|---|
|
@@ -7,4 +7,4 @@ coverage | |
|
||
# Remove some common IDE working directories | ||
.idea | ||
.vscode | ||
.vscode |
Original file line number | Diff line number | Diff line change |
---|---|---|
|
@@ -219,6 +219,53 @@ async function getVotes(): Promise<Record<string, { votesCount7d: number }>> { | |
); | ||
} | ||
|
||
export async function getCombinedMembersAndVoters( | ||
spaceId: string, | ||
cursor: string | null, | ||
pageSize: number, | ||
knownAdmins: string[] = [], | ||
knownModerators: string[] = [], | ||
knownMembers: string[] = [] | ||
) { | ||
const params: (string | number)[] = [spaceId]; | ||
const exclusionList = [...knownAdmins, ...knownModerators, ...knownMembers]; | ||
|
||
// Other roles are already known and fetched at the app level while Space Verification | ||
// Building the exclusion clause only if the exclusion list is not empty | ||
let exclusionClause = ''; | ||
if (exclusionList.length > 0) { | ||
const placeholders = exclusionList.map(() => '?').join(', '); | ||
exclusionClause = `AND voter NOT IN (${placeholders})`; | ||
There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more. Can't this be used to inject arbitrary SQL? I think There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more. I don't think that would be of concern here because
There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more. These values (admins, moderators, members) are actually inputs from space admin, even if we have a strict format, I would prefer if that query doesn't depend on validation of such user input. And |
||
params.push(...exclusionList); | ||
} | ||
|
||
const cursorClause = cursor ? ' AND voter > ?' : ''; | ||
if (cursor) { | ||
params.push(cursor); | ||
} | ||
|
||
const query = ` | ||
SELECT DISTINCT voter AS address | ||
FROM votes | ||
WHERE space = ? ${exclusionClause} ${cursorClause} | ||
ORDER BY voter | ||
LIMIT ? | ||
`; | ||
params.push(pageSize); | ||
|
||
const results = await db.queryAsync(query, params); | ||
if (!results || results.length === 0) { | ||
return Promise.reject(new Error('NOT_FOUND')); | ||
} | ||
|
||
const nextCursor = | ||
results.length === pageSize ? results[results.length - 1].address : null; | ||
return { | ||
members: results.map(row => row.address), | ||
nextCursor: nextCursor | ||
}; | ||
} | ||
|
||
async function getFollowers(): Promise< | ||
Record<string, { followersCount7d: number }> | ||
> { | ||
|
Uh oh!
There was an error while loading. Please reload this page.