notazof/yavsc
1
1
Fork 0
Code Issues 1 Pull requests Projects 2 Releases 8 Packages Wiki Activity Actions

Revert "feat(blog): add Visibility { Private, Public } to gate post reads"

Browse source 
This reverts commit 33ecfa7ebd.
This commit is contained in:
Paul Schneider 2026-08-18 15:40:52 +01:00
commit 42625f5ddd
Signed by: notazof
GPG key ID: 1DD5D838E5343B06
16 changed files with 46 additions and 5427 deletions
Download patch file Download diff file Expand all files Collapse all files

34
src/Yavsc.Server/Services/BlogSpotService.cs
View file

@ -200,46 +200,28 @@ public class BlogSpotService
Where(c => c.Members.Any(m => m.MemberId == viewerId))
.Select(c => c.Id).ToArrayAsync();
// Visibility drives the read gate:
// * Public : the ACL decides. Open if the ACL is
// empty, narrowed otherwise to author +
// ACL circles + admin.
// * Private : ACL is ignored at read time. Only the
// author (and administrators, checked
// elsewhere) can read.
// Admin reads (the Administrator role) go through
// IsInMsRole("Administrator") upstream in
// PermissionHandler; we don't repeat that here so the
// listing query stays role-agnostic.
posts = _context.BlogSpot
.Include(b => b.Author)
.Include(p => p.ACL)
.Include(p => p.Tags)
.Include(p => p.Comments)
.Where(p =>
(p.Visibility == Visibility.Private && p.AuthorId == viewerId)
|| (p.Visibility == Visibility.Public
&& (p.ACL == null
|| p.ACL.Count == 0
|| p.AuthorId == viewerId
|| (userCircles != null
&& p.ACL.Any(a => userCircles.Contains(a.CircleId))))));
.Where(p => p.ACL == null
|| p.ACL.Count == 0
|| (p.AuthorId == viewerId)
|| (userCircles != null &&
p.ACL.Any(a => userCircles.Contains(a.CircleId)))
);
}
else
{
// Anonymous callers only see Public posts with no
// ACL — anything else either requires membership
// (which we have no way to check without an
// identity) or is Private.
posts = _context.blogSpotPublications
.Include(p => p.BlogPost)
.Include(b => b.BlogPost.Author)
.Include(p => p.BlogPost.ACL)
.Include(p => p.BlogPost.Tags)
.Include(p => p.BlogPost.Comments)
.Where(p => p.BlogPost.Visibility == Visibility.Public
&& (p.BlogPost.ACL == null
|| p.BlogPost.ACL.Count == 0))
.Where(p => p.BlogPost.ACL == null
|| p.BlogPost.ACL.Count == 0)
.Select(p => p.BlogPost).ToArray();
}