merge: Enforce DM visibility in generateVisibilityQuery (!1108)

View MR for information: https://activitypub.software/TransFem-org/Sharkey/-/merge_requests/1108

Approved-by: dakkar <dakkar@thenautilus.net>
Approved-by: Marie <github@yuugi.dev>
This commit is contained in:
Hazelnoot 2025-06-11 21:15:30 +00:00
commit 791487c4df
2 changed files with 11 additions and 10 deletions

View file

@ -157,15 +157,17 @@ export class QueryService {
qb qb
// My post // My post
.orWhere(':meId = note.userId') .orWhere(':meId = note.userId')
// Reply to me // Visible to me
.orWhere(':meId = note.replyUserId')
// DM to me
.orWhere(':meIdAsList <@ note.visibleUserIds') .orWhere(':meIdAsList <@ note.visibleUserIds')
// Followers-only post
.orWhere(new Brackets(qb => qb
.andWhere(new Brackets(qbb => this
// Following author
.orFollowingUser(qbb, ':meId', 'note.userId')
// Mentions me // Mentions me
.orWhere(':meIdAsList <@ note.mentions') .orWhere(':meIdAsList <@ note.mentions')
// Followers-only post // Reply to me
.orWhere(new Brackets(qb => this .orWhere(':meId = note.replyUserId')))
.andFollowingUser(qb, ':meId', 'note.userId')
.andWhere('note.visibility = \'followers\''))); .andWhere('note.visibility = \'followers\'')));
q.setParameters({ meId: me.id, meIdAsList: [me.id] }); q.setParameters({ meId: me.id, meIdAsList: [me.id] });

View file

@ -79,14 +79,13 @@ export default class extends Endpoint<typeof meta, typeof paramDef> { // eslint-
, 'source') , 'source')
.innerJoin(MiNote, 'note', 'note.id = source.id'); .innerJoin(MiNote, 'note', 'note.id = source.id');
// Mentioned or visible users can always access this.queryService.generateVisibilityQuery(qb, me);
//this.queryService.generateVisibilityQuery(query, me);
this.queryService.generateBlockedHostQueryForNote(qb); this.queryService.generateBlockedHostQueryForNote(qb);
this.queryService.generateMutedUserQueryForNotes(qb, me); this.queryService.generateMutedUserQueryForNotes(qb, me);
this.queryService.generateMutedNoteThreadQuery(qb, me); this.queryService.generateMutedNoteThreadQuery(qb, me);
this.queryService.generateBlockedUserQueryForNotes(qb, me); this.queryService.generateBlockedUserQueryForNotes(qb, me);
// A renote can't mention a user, so it will never appear here anyway. // A renote can't mention a user, so it will never appear here anyway.
//this.queryService.generateMutedUserRenotesQueryForNotes(query, me); //this.queryService.generateMutedUserRenotesQueryForNotes(qb, me);
if (ps.visibility) { if (ps.visibility) {
qb.andWhere('note.visibility = :visibility', { visibility: ps.visibility }); qb.andWhere('note.visibility = :visibility', { visibility: ps.visibility });