Changeset 0.24.3 (#159)

server/handlers/channels.go

@@ -120,6 +120,21 @@ func getUserID(c *gin.Context) string {
 	return s
 }
 
+// isSessionAuth returns true if the request is from a session participant (v0.24.3).
+func isSessionAuth(c *gin.Context) bool {
+	return c.GetString("auth_type") == "session"
+}
+
+// sessionCanAccessChannel validates that a session participant is authorized
+// for the given channel. The AuthOrSession middleware already verifies this,
+// but handlers call this as a defense-in-depth check.
+func sessionCanAccessChannel(c *gin.Context, channelID string) bool {
+	if !isSessionAuth(c) {
+		return false
+	}
+	return c.GetString("channel_id") == channelID
+}
+
 // parsePagination reads page and per_page from query params with defaults.
 func parsePagination(c *gin.Context) (page, perPage, offset int) {
 	page, _ = strconv.Atoi(c.DefaultQuery("page", "1"))