/events now carries only { id, status }, so a listener can no longer read another person's prompt or SVG. Before this, any signed-in viewer could read every other user's prompts and SVGs, live or through the since=0 replay of the last 100 events.
Fix:drawing.added in src/actions.ts and drawing.changed in src/draw.ts used to send the whole row. They now send only the id and status. I also narrowed the row type in src/draw.ts to match. drawing.removed already sent only the id.
Owner's page:static/live.js only uses the event type as a trigger and re-fetches the page through the normal authorised route, which already checks the owner. Nothing else in static/ reads event data, so the owner's board still updates live when a drawing finishes. I did not load the page in a browser to confirm that.
Test: the new test in src/server.test.ts has bob listening on /events, then a late since=0 connection by bob. Alice creates a drawing with a distinctive prompt. Neither bob stream may contain the prompt, <svg or the SVG's title, and both must still show drawing.changed.
Proof it bites: I stashed the source fix and ran the file, and the new test failed. With the fix, bun test passes (58 tests).
Type check: I did not run it successfully. bunx tsc --noEmit printed its help text rather than checking anything.
Not changed: the contract table and the /events auth are untouched.
/eventsnow carries only{ id, status }, so a listener can no longer read another person's prompt or SVG. Before this, any signed-in viewer could read every other user's prompts and SVGs, live or through thesince=0replay of the last 100 events.drawing.addedinsrc/actions.tsanddrawing.changedinsrc/draw.tsused to send the whole row. They now send only the id and status. I also narrowed the row type insrc/draw.tsto match.drawing.removedalready sent only the id.static/live.jsonly uses the event type as a trigger and re-fetches the page through the normal authorised route, which already checks the owner. Nothing else instatic/reads event data, so the owner's board still updates live when a drawing finishes. I did not load the page in a browser to confirm that.src/server.test.tshas bob listening on/events, then a latesince=0connection by bob. Alice creates a drawing with a distinctive prompt. Neither bob stream may contain the prompt,<svgor the SVG's title, and both must still showdrawing.changed.bun testpasses (58 tests).bunx tsc --noEmitprinted its help text rather than checking anything./eventsauth are untouched.🤖 Generated with Claude Code
Closes #3