From 6e684f4b53874767fde107ae8cccc7a4e20bdb23 Mon Sep 17 00:00:00 2001
From: Dotta <bippadotta@protonmail.com>
Date: Sun, 24 May 2026 02:54:00 +0000
Subject: [PATCH] fix(briefs): enforce bridge user scope

---
 packages/plugins/plugin-briefs/src/worker.ts             | 9 ++++++---
 .../plugin-briefs/tests/managed-resources.spec.ts        | 8 ++++++++
 2 files changed, 14 insertions(+), 3 deletions(-)

diff --git a/packages/plugins/plugin-briefs/src/worker.ts b/packages/plugins/plugin-briefs/src/worker.ts
index 674672e2857..2310fbad579 100644
--- a/packages/plugins/plugin-briefs/src/worker.ts
+++ b/packages/plugins/plugin-briefs/src/worker.ts
@@ -340,9 +340,11 @@ async function refreshIssueTree(
   ctx: PluginContext,
   store: ReturnType<typeof createBriefsStore>,
   rawInput: Record<string, unknown>,
+  request?: PluginBridgeRequestContext,
 ) {
   const companyId = stringParam(rawInput.companyId, "companyId");
   const userId = stringParam(rawInput.userId, "userId");
+  if (request) assertTrustedBridgeUserScope(userId, request);
   const rootIssueId = stringParam(rawInput.rootIssueId, "rootIssueId");
   const card = await saveBriefCard(
     ctx,
@@ -439,16 +441,17 @@ const plugin = definePlugin({
       };
     });
 
-    ctx.actions.register("save-deterministic-card", async (params) => {
+    ctx.actions.register("save-deterministic-card", async (params, request) => {
       const input = bridgeParams(params);
       const bundle = objectParam(input.bundle, "bundle") as BriefsSourceBundle;
+      assertTrustedBridgeUserScope(stringParam(bundle.userId, "bundle.userId"), request);
       const options = (input.options && typeof input.options === "object" ? input.options : {}) as DeterministicBriefOptions;
       const card = await saveBriefCard(ctx, store, bundle, options);
       return { card };
     });
 
-    ctx.actions.register("refresh-issue-tree", async (params) => {
-      return refreshIssueTree(ctx, store, bridgeParams(params));
+    ctx.actions.register("refresh-issue-tree", async (params, request) => {
+      return refreshIssueTree(ctx, store, bridgeParams(params), request);
     });
 
     ctx.actions.register("reconcile-managed-agent", async (params) => {
diff --git a/packages/plugins/plugin-briefs/tests/managed-resources.spec.ts b/packages/plugins/plugin-briefs/tests/managed-resources.spec.ts
index 54406167a59..b41fe3967a8 100644
--- a/packages/plugins/plugin-briefs/tests/managed-resources.spec.ts
+++ b/packages/plugins/plugin-briefs/tests/managed-resources.spec.ts
@@ -280,6 +280,14 @@ describe("Briefs managed resources", () => {
       routineKey: BRIEFS_MANAGED_ROUTINE_KEYS[0],
       variables: { userId: "victim-user" },
     }, context)).rejects.toThrow("Briefs user scope mismatch");
+    await expect(harness.performAction("save-deterministic-card", {
+      bundle: { userId: "victim-user" },
+    }, context)).rejects.toThrow("Briefs user scope mismatch");
+    await expect(harness.performAction("refresh-issue-tree", {
+      companyId,
+      userId: "victim-user",
+      rootIssueId: "issue-1",
+    }, context)).rejects.toThrow("Briefs user scope mismatch");
   });
 
 });