From d129fd54acc078a711f7931a7f5261899aab8993 Mon Sep 17 00:00:00 2001
From: K900 <me@0upti.me>
Date: Sun, 9 Feb 2025 11:56:37 +0300
Subject: [PATCH] Validate the right username

3ad12b6 added username validation, but only validated the username
provided as part of the join event. When joining with an external
token, the username needs to be loaded from the token instead.

This broke in two ways:
- in the default UI, the username would be passed in as "" with token auth,
  which failed validation even if the token was valid
- you could pass in a valid username in the join event, and then pass in
  an invalid one in the token, and that would be accepted and used,
  presumably allowing for the same shenanigans 3ad12b6 sought to prevent

Move username validation to the end, where we know what the right username is.
---
 group/group.go | 11 ++++++-----
 1 file changed, 6 insertions(+), 5 deletions(-)

diff --git a/group/group.go b/group/group.go
index f1ccb23..6e1f475 100644
--- a/group/group.go
+++ b/group/group.go
@@ -1029,11 +1029,6 @@ func validUsername(username string) bool {
 
 // called locked
 func (g *Group) getPermission(creds ClientCredentials) (string, []string, error) {
-	if creds.Username != nil && !validUsername(*creds.Username) {
-		return "", nil, &NotAuthorisedError{
-			errors.New("invalid username"),
-		}
-	}
 	desc := g.description
 	var username string
 	var perms []string
@@ -1070,6 +1065,12 @@ func (g *Group) getPermission(creds ClientCredentials) (string, []string, error)
 		return "", nil, errors.New("neither username nor token provided")
 	}
 
+	if !validUsername(username) {
+		return "", nil, &NotAuthorisedError{
+			errors.New("invalid username"),
+		}
+	}
+
 	return username, perms, nil
 }