From 27c27529f6b06374fed505ba87c6ee1165d23983 Mon Sep 17 00:00:00 2001
From: Hazelnoot <acomputerdog@gmail.com>
Date: Tue, 10 Jun 2025 19:52:47 -0400
Subject: [PATCH] enforce DM visibility in generateVisibilityQuery

---
 packages/backend/src/core/QueryService.ts | 16 +++++++++-------
 1 file changed, 9 insertions(+), 7 deletions(-)

diff --git a/packages/backend/src/core/QueryService.ts b/packages/backend/src/core/QueryService.ts
index 4089fc080c..2d8ea51e65 100644
--- a/packages/backend/src/core/QueryService.ts
+++ b/packages/backend/src/core/QueryService.ts
@@ -157,15 +157,17 @@ export class QueryService {
 				qb
 					// My post
 					.orWhere(':meId = note.userId')
-					// Reply to me
-					.orWhere(':meId = note.replyUserId')
-					// DM to me
+					// Visible to me
 					.orWhere(':meIdAsList <@ note.visibleUserIds')
-					// Mentions me
-					.orWhere(':meIdAsList <@ note.mentions')
 					// Followers-only post
-					.orWhere(new Brackets(qb => this
-						.andFollowingUser(qb, ':meId', 'note.userId')
+					.orWhere(new Brackets(qb => qb
+						.andWhere(new Brackets(qbb => this
+							// Following author
+							.orFollowingUser(qbb, ':meId', 'note.userId')
+							// Mentions me
+							.orWhere(':meIdAsList <@ note.mentions')
+							// Reply to me
+							.orWhere(':meId = note.replyUserId')))
 						.andWhere('note.visibility = \'followers\'')));
 
 				q.setParameters({ meId: me.id, meIdAsList: [me.id] });