Check the recipient may still see the item when you send

How to do it

A digest, an escalation or a retry can run hours after the event. By then the recipient may have left the team or lost a role, or the item may be private or deleted. Queue the recipient ID and the item ID, never the rendered text. Run the same access check the item's own page runs, as Check access to every object says. Then render the text. Pending sends follow a removal at once, as Remove access when someone leaves describes. Digests read the same check, as in Batch small updates into a digest.

Examples

JavaScript example

export async function sendQueued(job) {
  const item = await items.find(job.itemId);
  if (!item || !(await canView(job.recipientId, item))) return { dropped: 'no-access' };
  return deliver(render(job.type, item, job.recipientId), job.recipientId);
}

Python example

def send_queued(job):
    item = items.find(job.item_id)
    if item is None or not can_view(job.recipient_id, item):
        return {"dropped": "no-access"}
    return deliver(render(job.type, item, job.recipient_id), job.recipient_id)

How to check

A test queues a comment notification for member B, removes B from the organisation, then runs the send job. No push, text or email reaches the provider, and B's digest stays empty. A second test does the same after the item becomes private.

Sources

• OWASP Authorization Cheat Sheet

Related rules

• Check ownership on every record in Security testing
• Remove access when someone leaves in Accounts
• Batch small updates into a digest in Notifications