notazof/yavsc
Watch
1
1
Fork
You've already forked yavsc
 0
Code Issues 4 Pull requests Projects 2 Releases 25 Packages Wiki Activity Actions

Revert "feat(blog): add Visibility { Private, Public } to gate post reads"

Browse source 
This reverts commit 44dcbdd82e.
This commit is contained in:
Paul Schneider 2026-08-18 15:40:52 +01:00
commit 252327d88c
16 changed files with 46 additions and 5427 deletions
Download patch file Download diff file Expand all files Collapse all files

34
src/Yavsc.Server/Services/BlogSpotService.cs
View file

@ -200,46 +200,28 @@ public class BlogSpotService
Where(c => c.Members.Any(m => m.MemberId == viewerId))
.Select(c => c.Id).ToArrayAsync();
// Visibility drives the read gate:
// * Public : the ACL decides. Open if the ACL is
// empty, narrowed otherwise to author +
// ACL circles + admin.
// * Private : ACL is ignored at read time. Only the
// author (and administrators, checked
// elsewhere) can read.
// Admin reads (the Administrator role) go through
// IsInMsRole("Administrator") upstream in
// PermissionHandler; we don't repeat that here so the
// listing query stays role-agnostic.
posts = _context.BlogSpot
.Include(b => b.Author)
.Include(p => p.ACL)
.Include(p => p.Tags)
.Include(p => p.Comments)
.Where(p =>
(p.Visibility == Visibility.Private && p.AuthorId == viewerId)
|| (p.Visibility == Visibility.Public
&& (p.ACL == null
|| p.ACL.Count == 0
|| p.AuthorId == viewerId
|| (userCircles != null
&& p.ACL.Any(a => userCircles.Contains(a.CircleId))))));
.Where(p => p.ACL == null
|| p.ACL.Count == 0
|| (p.AuthorId == viewerId)
|| (userCircles != null &&
p.ACL.Any(a => userCircles.Contains(a.CircleId)))
);
}
else
{
// Anonymous callers only see Public posts with no
// ACL — anything else either requires membership
// (which we have no way to check without an
// identity) or is Private.
posts = _context.blogSpotPublications
.Include(p => p.BlogPost)
.Include(b => b.BlogPost.Author)
.Include(p => p.BlogPost.ACL)
.Include(p => p.BlogPost.Tags)
.Include(p => p.BlogPost.Comments)
.Where(p => p.BlogPost.Visibility == Visibility.Public
&& (p.BlogPost.ACL == null
|| p.BlogPost.ACL.Count == 0))
.Where(p => p.BlogPost.ACL == null
|| p.BlogPost.ACL.Count == 0)
.Select(p => p.BlogPost).ToArray();
}

13
src/Yavsc.Server/Services/PermissionHandler.cs
View file

@ -3,7 +3,6 @@ using Microsoft.AspNetCore.Authorization;
using Microsoft.AspNetCore.Http;
using Microsoft.AspNetCore.Routing;
using Microsoft.EntityFrameworkCore;
using Yavsc.Blogspot;
using Yavsc.Models;
using Yavsc.Models.Blog;
using Yavsc.Server.Helpers;
@ -56,15 +55,9 @@ public class PermissionHandler : IAuthorizationHandler
{
if (resource is BlogPost blogPost)
{
// IsPublic is the authz twin of the Index/listing
// filter in BlogSpotService: a post is "publicly
// readable" (no membership required) iff its
// Visibility is Public and its ACL is empty.
// Visibility.Public + non-empty ACL is narrowed by
// the ACL, so it does NOT pass IsPublic here; the
// caller has to match IsSponsor for that.
return blogPost.Visibility == Visibility.Public
&& (blogPost.ACL == null || blogPost.ACL.Count == 0);
return
applicationDbContext.blogSpotPublications
.Any(p=>p.BlogpostId == blogPost.Id);
}
return false;
}