From 3b1eab806935325673405205288ada891472c321 Mon Sep 17 00:00:00 2001
From: Natty <natty.sh.git@gmail.com>
Date: Mon, 8 Jan 2024 04:30:12 +0100
Subject: [PATCH] Apply visibility checks to parent notes and renote targets

---
 ext_calckey_model/src/model_ext.rs  | 21 +++++++++++++++++++++
 ext_calckey_model/src/note_model.rs | 29 ++++++++++++++++++++++++-----
 2 files changed, 45 insertions(+), 5 deletions(-)

diff --git a/ext_calckey_model/src/model_ext.rs b/ext_calckey_model/src/model_ext.rs
index 108314b..5a9cd30 100644
--- a/ext_calckey_model/src/model_ext.rs
+++ b/ext_calckey_model/src/model_ext.rs
@@ -10,6 +10,14 @@ pub(crate) trait SelectColumnsExt {
         rel: RelationDef,
         alias: I,
     ) -> &mut Self;
+
+    fn join_columns_on<I: IntoIden>(
+        &mut self,
+        join: JoinType,
+        rel: RelationDef,
+        alias: I,
+        condition: Condition,
+    ) -> &mut Self;
 }
 
 pub(crate) fn join_columns_default(rel: RelationDef) -> Condition {
@@ -62,6 +70,19 @@ impl SelectColumnsExt for SelectStatement {
         self.join(join, rel.to_tbl.clone(), join_columns_default(rel));
         self
     }
+
+    fn join_columns_on<I: IntoIden>(
+        &mut self,
+        join: JoinType,
+        mut rel: RelationDef,
+        alias: I,
+        condition: Condition,
+    ) -> &mut Self {
+        let alias = alias.into_iden();
+        rel.to_tbl = rel.to_tbl.alias(alias);
+        self.join(join, rel.to_tbl.clone(), condition);
+        self
+    }
 }
 
 pub(crate) fn joined_prefix_str(prefix: &str, suffix: &str) -> String {
diff --git a/ext_calckey_model/src/note_model.rs b/ext_calckey_model/src/note_model.rs
index cfb6d52..8829ca7 100644
--- a/ext_calckey_model/src/note_model.rs
+++ b/ext_calckey_model/src/note_model.rs
@@ -1,8 +1,8 @@
 use ext_calckey_model_migration::SelectStatement;
 use sea_orm::sea_query::{Alias, Asterisk, Expr, IntoIden, Query, SelectExpr, SimpleExpr};
 use sea_orm::{
-    DbErr, EntityName, EntityTrait, FromQueryResult, Iden, JoinType, QueryFilter, QueryOrder,
-    QueryResult, QuerySelect, QueryTrait, Select,
+    Condition, DbErr, EntityName, EntityTrait, FromQueryResult, Iden, JoinType, QueryFilter,
+    QueryOrder, QueryResult, QuerySelect, QueryTrait, Select,
 };
 use serde::{Deserialize, Serialize};
 
@@ -10,7 +10,8 @@ use ck::{note, note_reaction, user, user_note_pining};
 use magnetar_sdk::types::SpanFilter;
 
 use crate::model_ext::{
-    joined_prefix, joined_prefix_alias, joined_prefix_str, EntityPrefixExt, SelectColumnsExt,
+    join_columns_default, joined_prefix, joined_prefix_alias, joined_prefix_str, EntityPrefixExt,
+    SelectColumnsExt,
 };
 use crate::paginated::PaginatedModel;
 use crate::user_model::{UserData, UserResolver};
@@ -291,10 +292,19 @@ impl NoteResolver {
 
         // Recursively attach reply parents
         if reply_depth > 0 {
-            q.join_columns(
+            let visibility_filter = options
+                .visibility_filter
+                .with_note_and_user_tables(Some(joined_prefix_alias(prefix, REPLY)));
+            let mut rel = note::Relation::SelfRef2.with_alias(Alias::new(prefix).into_iden());
+            rel.to_tbl = rel.to_tbl.alias(joined_prefix_alias(prefix, REPLY));
+            let condition = Condition::all()
+                .add(join_columns_default(rel))
+                .add(visibility_filter);
+            q.join_columns_on(
                 JoinType::LeftJoin,
                 note::Relation::SelfRef2.with_alias(Alias::new(prefix).into_iden()),
                 joined_prefix(prefix, REPLY),
+                condition,
             );
 
             self.attach_note(
@@ -309,10 +319,19 @@ impl NoteResolver {
 
         // Recursively attach renote/quote targets
         if renote_depth > 0 {
-            q.join_columns(
+            let visibility_filter = options
+                .visibility_filter
+                .with_note_and_user_tables(Some(joined_prefix_alias(prefix, RENOTE)));
+            let mut rel = note::Relation::SelfRef1.with_alias(Alias::new(prefix).into_iden());
+            rel.to_tbl = rel.to_tbl.alias(joined_prefix_alias(prefix, RENOTE));
+            let condition = Condition::all()
+                .add(join_columns_default(rel))
+                .add(visibility_filter);
+            q.join_columns_on(
                 JoinType::LeftJoin,
                 note::Relation::SelfRef1.with_alias(Alias::new(prefix).into_iden()),
                 joined_prefix(prefix, RENOTE),
+                condition,
             );
 
             self.attach_note(