From f64dd6472a6532dcdec5f3f63c698480d16b5eca Mon Sep 17 00:00:00 2001 From: Jake Barnby Date: Mon, 18 May 2026 13:38:27 +1200 Subject: [PATCH] fix: validate realtime manual auth outside guest scope --- app/realtime.php | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/app/realtime.php b/app/realtime.php index 9f42d77461..185a7be78b 100644 --- a/app/realtime.php +++ b/app/realtime.php @@ -1061,7 +1061,9 @@ $server->onMessage(function (int $connection, string $message) use ($server, $re $store->decode($message['data']['session']); /** @var User $user */ - $user = $database->getDocument('users', $store->getProperty('id', '')); + $user = $database->getAuthorization()->skip( + fn () => $database->getDocument('users', $store->getProperty('id', '')) + ); /** * TODO: