From 413b6dbd5c2f1f4978f5174bf4c4076c08a02c8f Mon Sep 17 00:00:00 2001
From: Josh Perez <60019601+josh-signal@users.noreply.github.com>
Date: Tue, 23 Aug 2022 12:37:16 -0400
Subject: [PATCH] Assert that retried UUID is still part of dlist

---
 ts/util/handleRetry.ts | 33 +++++++++++++++++++++++++++++++++
 1 file changed, 33 insertions(+)

diff --git a/ts/util/handleRetry.ts b/ts/util/handleRetry.ts
index f7bbb31ea..dcc433348 100644
--- a/ts/util/handleRetry.ts
+++ b/ts/util/handleRetry.ts
@@ -8,6 +8,7 @@ import {
 import { isBoolean, isNumber } from 'lodash';
 
 import * as Bytes from '../Bytes';
+import dataInterface from '../sql/Client';
 import { isProduction } from './version';
 import { strictAssert } from './assert';
 import { getSendOptions } from './getSendOptions';
@@ -143,6 +144,38 @@ export async function onRetryRequest(event: RetryRequestEvent): Promise<void> {
     timestamp,
   });
 
+  // Assert that the requesting UUID is still part of a distribution list that
+  // the message was sent to.
+  if (contentProto.storyMessage) {
+    const { storyDistributionLists } = window.reduxStore.getState();
+    const membersByListId = new Map<string, Set<string>>();
+    storyDistributionLists.distributionLists.forEach(list => {
+      membersByListId.set(list.id, new Set(list.memberUuids));
+    });
+
+    const messages = await dataInterface.getMessagesBySentAt(timestamp);
+    const isInDistributionList = messages.some(message => {
+      if (!message.storyDistributionListId) {
+        return false;
+      }
+
+      const members = membersByListId.get(message.storyDistributionListId);
+      if (!members) {
+        return false;
+      }
+
+      return members.has(requesterUuid);
+    });
+
+    if (!isInDistributionList) {
+      log.warn(
+        `onRetryRequest/${logId}: requesterUuid is not in distribution list`
+      );
+      confirm();
+      return;
+    }
+  }
+
   const recipientConversation = window.ConversationController.getOrCreate(
     requesterUuid,
     'private'