From e92eb593fd567bd77083b33b113ea7690b7149bf Mon Sep 17 00:00:00 2001
From: Anton Alexeyev <alexeyev.anton@gmail.com>
Date: Tue, 2 Sep 2025 13:18:30 +0700
Subject: [PATCH] Fix broadcasting txes with collab security (#9740)

Signed-off-by: Anton Alexeyev <alexeyev.anton@gmail.com>
---
 server/middleware/src/broadcast.ts | 16 ++++------------
 1 file changed, 4 insertions(+), 12 deletions(-)

diff --git a/server/middleware/src/broadcast.ts b/server/middleware/src/broadcast.ts
index cc3fe24f06..030086dd5d 100644
--- a/server/middleware/src/broadcast.ts
+++ b/server/middleware/src/broadcast.ts
@@ -78,7 +78,7 @@ export class BroadcastMiddleware extends BaseMiddleware implements Middleware {
     // Combine targets by sender
 
     const toSendTarget = new Map<AccountUuid | '', Tx[]>()
-    const excluded = new Map<AccountUuid, Tx[]>()
+    const txesWithExcludedAccounts = new Map<Tx, AccountUuid[]>()
 
     const getTxes = (key: AccountUuid | ''): Tx[] => {
       let txes = toSendTarget.get(key)
@@ -107,15 +107,7 @@ export class BroadcastMiddleware extends BaseMiddleware implements Middleware {
         }
       } else {
         if (isExlcude(target)) {
-          for (const e of target.exclude) {
-            const txes = excluded.get(e)
-            if (txes === undefined) {
-              excluded.set(e, [txd])
-            } else {
-              txes.push(txd)
-            }
-          }
-          continue
+          txesWithExcludedAccounts.set(txd, target.exclude)
         } else {
           for (const t of target.target) {
             getTxes(t).push(txd)
@@ -150,8 +142,8 @@ export class BroadcastMiddleware extends BaseMiddleware implements Middleware {
       void handleSend(ctx, v, k as AccountUuid)
     }
 
-    for (const [k, v] of excluded.entries()) {
-      void handleSend(ctx, v, undefined, [k])
+    for (const [tx, txExcludedAccounts] of txesWithExcludedAccounts.entries()) {
+      void handleSend(ctx, [tx], undefined, txExcludedAccounts)
     }
 
     // Send all other except us.