Skip to content

fix(security): フォロワー限定・ダイレクト投稿の公開範囲を全取得経路で適用 - #294

Merged
sasagar merged 2 commits into
devfrom
fix/note-visibility
Oct 14, 2026
Merged

sasagar merged 2 commits into
devfrom
fix/note-visibility

Conversation

@sasagar

@sasagar sasagar commented Oct 14, 2026

Copy link
Copy Markdown
Member

変更

  • lib/noteVisibility.ts(新規): canViewNote / isNoteVisibleTo(Misskey 互換: public/home は誰でも、followers は作者・フォロワー・メンション先・リプライ先作者、specified は作者と宛先)
  • INoteRepository に任意の visibleTo: { viewerId } を追加し、pg / mysql / sqlite の getTimeline / getSocialTimeline / findByUserId / findReplies / findRenotes / findMentionsAndReplies で適用(フォロー判定は相関 EXISTS)
  • NoteService: findById / ユーザータイムライン / リプライに閲覧者を適用、埋め込みのリプライ先・リノート先も閲覧者でフィルタ、見えないノートへのリプライと他人の非公開ノートのリノートを拒否、ストリーミングとリスト通知でも非公開ノートを流さない
  • ルート: /api/notes/show・user-notes・replies・timeline・social-timeline、リストタイムライン、/api/mentions、AP /notes/:id・outbox(public/home かつ非ローカル限定のみ、宛先も修正)、oEmbed、リアクション系

挙動の変化

  • リモートサーバーがフォロワー限定ノートを URL で取得すると 404(inbox への配送は従来通り)

確認

  • typecheck / lint / format:check / ユニット 1159 件・SQLite 統合 37 件 pass
  • 使い捨ての Postgres 17 にマイグレーションを適用し、未ログイン・他人・フォロワー・DM 宛先・作者の 5 視点で findByUserId / findReplies / getTimeline / getSocialTimeline / findMentionsAndReplies の結果が期待通りであることを確認

https://claude.ai/code/session_01Y29fBeRP344FME6de48wUv

…ed notes

Followers-only and specified (DM) notes were readable by anyone through
several endpoints. Introduce Misskey-compatible visibility rules and apply
them everywhere notes are returned.

- Add lib/noteVisibility.ts (canViewNote, isNoteVisibleTo, isPubliclyVisible)
- Add optional TimelineOptions.visibleTo filter to INoteRepository, implemented
  in pg, mysql and sqlite repositories (EXISTS on follows, mentions match,
  reply-target author)
- /api/notes/show, /user-notes, /replies: viewer-aware filtering (404 / empty)
- Home, social and list timelines: filter non-visible notes (list membership
  does not imply following); hydrated reply/renote targets are filtered too
- /api/mentions: apply viewer filter
- AP /notes/:id and outbox: serve only public/home, non-local-only notes with
  correct addressing for home (unlisted)
- oEmbed and reaction endpoints: hide non-public / non-visible notes
- Reject replies to invisible notes and renotes of others' non-public notes
- Stream pushes no longer embed non-public reply/renote targets; list
  notifications skip owners who cannot see the note
- Tests: unit tests for visibility rules, route-level tests, sqlite
  integration tests for the repository filter

Claude-Session: https://claude.ai/code/session_01Y29fBeRP344FME6de48wUv
@coderabbitai

coderabbitai Bot commented Oct 14, 2026

Copy link
Copy Markdown
Contributor

Warning

Review limit reached

You've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository.

Next included review available in 19 minutes.

Check out review usage here.

View limit details

Limit details: You’ve used the included review currently available.

Learn how review limits work.

Review configuration:

⚙️ Run configuration
  • Configuration used: Repository: Love-Rox/rox/.coderabbit.yaml
  • Review profile: CHILL
  • Plan: Advanced
  • Run ID: 491dc14d-558d-406c-af81-0ae92610e438
📥 Commits

Reviewing files that changed from the base of the PR and between 768c035 and eadeed8.

📒 Files selected for processing: 16
  • packages/backend/src/interfaces/repositories/INoteRepository.ts
  • packages/backend/src/lib/noteVisibility.ts
  • packages/backend/src/repositories/mysql/MysqlNoteRepository.ts
  • packages/backend/src/repositories/pg/PostgresNoteRepository.ts
  • packages/backend/src/repositories/sqlite/SqliteNoteRepository.ts
  • packages/backend/src/routes/ap/note.ts
  • packages/backend/src/routes/ap/outbox.ts
  • packages/backend/src/routes/mentions.ts
  • packages/backend/src/routes/notes.ts
  • packages/backend/src/routes/oembed.ts
  • packages/backend/src/routes/reactions.ts
  • packages/backend/src/services/ListService.ts
  • packages/backend/src/services/NoteService.ts
  • packages/backend/src/tests/integration/sqlite-repositories.test.ts
  • packages/backend/src/tests/unit/NoteVisibilityRoutes.test.ts
  • packages/backend/src/tests/unit/noteVisibility.test.ts
  • Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

Comment @coderabbitai help to get the list of available commands.

@sasagar
sasagar merged commit 5474231 into dev Oct 14, 2026
11 checks passed
This was referenced Oct 14, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant