security: add missed authorization check

[asvishnyakov]

No description provided.

[jbcallaghan]

Can you please review this change again as it breaks co-pilot mode

[fgalind1]

Can you please review this change again as it breaks co-pilot mode

+1 broke it on my end also

[jbcallaghan]

I just tested changing my local copy of socket.py with your changes and it seems to be working now with copilot :-)

These are the only changes I made:

    if thread_id:
        if data_layer := get_data_layer():
            thread = await data_layer.get_thread(thread_id)
            if thread and not (thread["userIdentifier"] == user.identifier):
                logger.error("Authorization for the thread failed.")
                raise ConnectionRefusedError("authorization failed")

[asvishnyakov]

@jbcallaghan I wrote a few tests locally to cover this and similar situations with copilot, ACL, etc., but wasn't able to make most critical of them working. I'll complete this PR ASAP and merge it

[jbcallaghan]

@asvishnyakov thanks very much for your help in fixing this issue, much appreciated.

[jbcallaghan]

Any news on when this change will make it into the next release?

[asvishnyakov]

@jbcallaghan Yes, I think I'll complete and release it later today