[backend] Only allow author to see hidden posts

2024-02-04 20:23:42 +01:00 · 2024-02-04 20:23:42 +01:00 · 1378037384
commit 1378037384
parent f14c5ed4ef
1 changed files with 6 additions and 0 deletions
--- a/packages/backend/src/server/api/common/generate-visibility-query.ts
+++ b/packages/backend/src/server/api/common/generate-visibility-query.ts
@ -57,6 +57,12 @@ export function generateVisibilityQuery(
 			}),
 		);

+		q.andWhere(new Brackets((qb) => {
+			qb.where(`note.visibility != 'hidden'`).orWhere(
+				`note.userId = :meId`,
+			);
+		}));
+
 		q.setParameters({ meId: me.id });
 	}
 }