From 399af5d627ecdbae443dcab6f6a7d0e99c00ed43 Mon Sep 17 00:00:00 2001
From: Jared Pereira <jared@awarm.space>
Date: Tue, 10 Feb 2026 21:44:21 +0400
Subject: [PATCH] check permissions on retractions

---
 src/replicache/cachedServerMutationContext.ts | 14 ++++++++++++++
 1 file changed, 14 insertions(+)

diff --git a/src/replicache/cachedServerMutationContext.ts b/src/replicache/cachedServerMutationContext.ts
index 322f773e..cad2eb64 100644
--- a/src/replicache/cachedServerMutationContext.ts
+++ b/src/replicache/cachedServerMutationContext.ts
@@ -155,6 +155,20 @@ export function cachedServerMutationContext(
         });
       },
       async retractFact(factID) {
+        let cachedFact = writeCache.find(
+          (f) => f.type === "put" && f.fact.id === factID,
+        );
+        let entity: string | undefined;
+        if (cachedFact && cachedFact.type === "put") {
+          entity = cachedFact.fact.entity;
+        } else {
+          let [row] = await tx
+            .select({ entity: facts.entity })
+            .from(facts)
+            .where(driz.eq(facts.id, factID));
+          entity = row?.entity;
+        }
+        if (!entity || !(await this.checkPermission(entity))) return;
         writeCache = writeCache.filter((f) => f.fact.id !== factID);
         writeCache.push({ type: "del", fact: { id: factID } });
       },
-- 
2.51.2