Do not allow voting if user is not in conv where the poll is

pollbot/pollbot/http.go

@@ -11,6 +11,7 @@ import (
 	"time"
 
 	"github.com/keybase/go-keybase-chat-bot/kbchat"
+	"github.com/keybase/go-keybase-chat-bot/kbchat/types/chat1"
 	"github.com/keybase/managed-bots/base"
 )
 
@@ -91,14 +92,25 @@ func (h *HTTPSrv) handleVote(w http.ResponseWriter, r *http.Request) {
 	// WithoutCancel: the browser submits the vote and may close the connection;
 	// DB writes and poll result updates must complete regardless.
 	ctx := context.WithoutCancel(r.Context())
-	if err := h.db.CastVote(ctx, username, vote); err != nil {
-		h.Errorf("failed to cast vote: %s", err)
+	convID, resultMsgID, numChoices, err := h.db.GetPollInfo(ctx, vote.ID)
+	if err != nil {
+		h.Errorf("failed to find poll result msg: %s", err)
 		h.showError(w)
 		return
 	}
-	convID, resultMsgID, numChoices, err := h.db.GetPollInfo(ctx, vote.ID)
+	members, err := h.kbc.ListMembersByConvID(convID)
 	if err != nil {
-		h.Errorf("failed to find poll result msg: %s", err)
+		h.Errorf("failed to list conv members: %s", err)
+		h.showError(w)
+		return
+	}
+	if !isConvMember(members, username) {
+		h.Debug("vote rejected: %s is not a member of %s", username, convID)
+		h.showError(w)
+		return
+	}
+	if err := h.db.CastVote(ctx, username, vote); err != nil {
+		h.Errorf("failed to cast vote: %s", err)
 		h.showError(w)
 		return
 	}
@@ -149,3 +161,17 @@ func (h *HTTPSrv) handleImage(w http.ResponseWriter, r *http.Request) {
 }
 
 func (h *HTTPSrv) handleHealthCheck(_ http.ResponseWriter, _ *http.Request) {}
+
+func isConvMember(members chat1.ChatMembersDetails, username string) bool {
+	allMembers := [][]chat1.ChatMemberDetails{
+		members.Owners, members.Admins, members.Writers, members.Readers,
+	}
+	for _, group := range allMembers {
+		for _, m := range group {
+			if m.Username == username {
+				return true
+			}
+		}
+	}
+	return false
+}

triviabot/triviabot/session.go

@@ -13,7 +13,6 @@
 
 	"github.com/keybase/go-keybase-chat-bot/kbchat"
 	"github.com/keybase/go-keybase-chat-bot/kbchat/types/chat1"
-	"github.com/keybase/go-keybase-chat-bot/kbchat/types/keybase1"
 	"github.com/keybase/managed-bots/base"
 )
 
@@ -218,14 +217,14 @@
 		// ignore bot users here
 		s.numUsersInConv = len(res.Owners) + len(res.Admins) + len(res.Writers) + len(res.Readers)
 		// If we're not a bot member exclude us from the member count.
 		if !s.isBotRole(res) {
 			s.numUsersInConv--
 		}
 	}
 	return nil
 }
 
-func (s *session) isBotRole(members keybase1.TeamMembersDetails) bool {
+func (s *session) isBotRole(members chat1.ChatMembersDetails) bool {
 	for _, member := range append(members.Bots, members.RestrictedBots...) {
 		if member.Username == s.kbc.GetUsername() {
 			return true