Apply public-content-visibility: visibility flag + public profile

Implements the public-content-visibility OpenSpec change. Adds the
smallest social surface that lets us demo the product to logged-out
visitors without user signup.

Schema:
- `visibility text NOT NULL DEFAULT 'private'` on routes + activities.
- Shared Visibility type exported from the schema module.

Access:
- New canView(content, viewer, { asDirectLink }) helper in auth.server.ts
  centralises the rule: public → anyone; unlisted → anyone on direct
  link; private → owner only.
- routes.$id and activities.$id loaders return 404 (not 403) when
  canView rejects, so existence of private content isn't leaked.
- Detail pages emit Open Graph + Twitter Card meta on public/unlisted
  content only.

Editing:
- Visibility <select> on routes/:id/edit with owner-only access.
- Activity detail page gets a small visibility form + set-visibility
  action intent (no separate activity-edit page needed).
- EN + DE i18n under routes.visibility.* and activities.visibility.*.

Listings:
- Listing helpers listPublicRoutesForOwner / listPublicActivitiesForOwner
  for cross-user queries. Existing owner-scoped listRoutes/listActivities
  stay — owners see their own content regardless of visibility.

Public profile:
- /users/:username is now truly public. Renders the user's public
  routes + activities, 404s when no public content exists AND viewer
  isn't the owner (prevents account enumeration).
- Owner sees a short "this is your profile" note linking to settings.
- Open Graph meta (og:type=profile) for shareable preview.

Privacy manifest:
- Added a bullet noting public content is world-visible on profile
  and indexable by search engines.
- Bumped PRIVACY_LAST_UPDATED to 2026-04-20 + rendered legal-archive
  snapshot.

Tests:
- 13 unit tests for canView covering the full matrix.
- 6 E2E tests in e2e/public-content.test.ts covering:
  - Private route → 404 for logged-out visitor
  - Public route → reachable + OG tags present (og:title, og:type,
    og:site_name)
  - Owner still sees own private content
  - Profile 404 when no public content
  - Profile renders when at least one public route exists
  - Unlisted route reachable via direct URL but hidden from profile
- Test file runs serially (describe.configure mode=serial) to avoid
  WebAuthn virtual-authenticator races under Playwright's default
  parallel workers.
- New public-content Playwright project added to config.

Rollout safety: every existing row in prod keeps visibility='private'
by default — nothing becomes visible to outsiders until an owner
explicitly opts in.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

apps/journal/app/lib/activities.server.ts

@@ -2,6 +2,7 @@ import { randomUUID } from "node:crypto";
 import { eq, desc, and, sql } from "drizzle-orm";
 import { getDb } from "./db.ts";
 import { activities, routes, syncImports } from "@trails-cool/db/schema/journal";
+import type { Visibility } from "@trails-cool/db/schema/journal";
 import { parseGpxAsync } from "@trails-cool/gpx";
 import { setGeomFromGpx } from "./routes.server.ts";
 
@@ -13,6 +14,21 @@ export interface ActivityInput {
   distance?: number | null;
   duration?: number | null;
   startedAt?: Date | null;
+  visibility?: Visibility;
+}
+
+export async function updateActivityVisibility(
+  id: string,
+  ownerId: string,
+  visibility: Visibility,
+): Promise<boolean> {
+  const db = getDb();
+  const result = await db
+    .update(activities)
+    .set({ visibility })
+    .where(and(eq(activities.id, id), eq(activities.ownerId, ownerId)))
+    .returning({ id: activities.id });
+  return result.length > 0;
 }
 
 export async function createActivity(ownerId: string, input: ActivityInput) {
@@ -100,6 +116,24 @@ export async function listActivities(ownerId: string) {
   return rows.map((r) => ({ ...r, geojson: geojsonMap.get(r.id) ?? null }));
 }
 
+/**
+ * List the *public* activities of a given owner. Used for cross-user
+ * listings (the public profile page); never includes `unlisted` or
+ * `private` content.
+ */
+export async function listPublicActivitiesForOwner(ownerId: string) {
+  const db = getDb();
+  const rows = await db
+    .select()
+    .from(activities)
+    .where(and(eq(activities.ownerId, ownerId), eq(activities.visibility, "public")))
+    .orderBy(desc(activities.createdAt));
+
+  const ids = rows.map((r) => r.id);
+  const geojsonMap = ids.length > 0 ? await getSimplifiedActivityGeojsonBatch(ids) : new Map();
+  return rows.map((r) => ({ ...r, geojson: geojsonMap.get(r.id) ?? null }));
+}
+
 export async function linkActivityToRoute(activityId: string, routeId: string, _ownerId: string) {
   const db = getDb();
   await db

apps/journal/app/lib/auth.server.ts

@@ -13,6 +13,7 @@ import type {
 } from "@simplewebauthn/types";
 import { getDb } from "./db.ts";
 import { users, credentials, magicTokens } from "@trails-cool/db/schema/journal";
+import type { Visibility } from "@trails-cool/db/schema/journal";
 
 const RP_NAME = "trails.cool";
 const RP_ID = process.env.DOMAIN ?? "localhost";
@@ -410,6 +411,45 @@ export const sessionStorage = createCookieSessionStorage({
   },
 });
 
+/**
+ * A row that carries the minimum a visibility check needs.
+ */
+export interface Viewable {
+  ownerId: string;
+  visibility: Visibility;
+}
+
+/**
+ * The caller's identity. `null` represents a logged-out visitor.
+ */
+export interface Viewer {
+  id: string;
+}
+
+/**
+ * Decide whether a viewer may see a piece of content.
+ *
+ * - `public` content is viewable by anyone.
+ * - `unlisted` content is viewable only on direct-link access — listings
+ *   should omit it. Callers rendering a detail page pass `asDirectLink:
+ *   true`; listings default to `false`.
+ * - `private` content is viewable only by the owner.
+ *
+ * Centralised here so detail loaders and listing queries use the same
+ * rule. Intentionally does not throw; callers handle the `false` case
+ * (usually by returning HTTP 404 rather than 403 to avoid leaking
+ * existence).
+ */
+export function canView(
+  content: Viewable,
+  viewer: Viewer | null,
+  { asDirectLink = false }: { asDirectLink?: boolean } = {},
+): boolean {
+  if (content.visibility === "public") return true;
+  if (content.visibility === "unlisted" && asDirectLink) return true;
+  return viewer?.id === content.ownerId;
+}
+
 /**
  * Record the user's acceptance of the current Terms version. Updates both
  * `terms_accepted_at` (NOW) and `terms_version`. Used when an existing user

apps/journal/app/lib/canView.test.ts

@@ -0,0 +1,64 @@
+import { describe, it, expect } from "vitest";
+import { canView, type Viewable, type Viewer } from "./auth.server.ts";
+
+const owner: Viewer = { id: "owner-id" };
+const other: Viewer = { id: "other-id" };
+
+function row(visibility: "private" | "unlisted" | "public"): Viewable {
+  return { ownerId: owner.id, visibility };
+}
+
+describe("canView", () => {
+  describe("public content", () => {
+    it("is viewable by the owner", () => {
+      expect(canView(row("public"), owner)).toBe(true);
+    });
+    it("is viewable by another logged-in user", () => {
+      expect(canView(row("public"), other)).toBe(true);
+    });
+    it("is viewable by a logged-out visitor", () => {
+      expect(canView(row("public"), null)).toBe(true);
+    });
+    it("ignores asDirectLink (always viewable)", () => {
+      expect(canView(row("public"), null, { asDirectLink: false })).toBe(true);
+      expect(canView(row("public"), null, { asDirectLink: true })).toBe(true);
+    });
+  });
+
+  describe("unlisted content", () => {
+    it("is viewable by the owner", () => {
+      expect(canView(row("unlisted"), owner)).toBe(true);
+    });
+    it("is viewable by another user on a direct link", () => {
+      expect(canView(row("unlisted"), other, { asDirectLink: true })).toBe(true);
+    });
+    it("is viewable by a logged-out visitor on a direct link", () => {
+      expect(canView(row("unlisted"), null, { asDirectLink: true })).toBe(true);
+    });
+    it("is NOT visible in a listing to another user", () => {
+      expect(canView(row("unlisted"), other, { asDirectLink: false })).toBe(false);
+    });
+    it("is NOT visible in a listing to a logged-out visitor", () => {
+      expect(canView(row("unlisted"), null, { asDirectLink: false })).toBe(false);
+    });
+    it("defaults to the listing rule when asDirectLink is omitted", () => {
+      expect(canView(row("unlisted"), other)).toBe(false);
+      expect(canView(row("unlisted"), null)).toBe(false);
+    });
+  });
+
+  describe("private content", () => {
+    it("is viewable by the owner", () => {
+      expect(canView(row("private"), owner)).toBe(true);
+      expect(canView(row("private"), owner, { asDirectLink: true })).toBe(true);
+    });
+    it("is NOT viewable by another user", () => {
+      expect(canView(row("private"), other)).toBe(false);
+      expect(canView(row("private"), other, { asDirectLink: true })).toBe(false);
+    });
+    it("is NOT viewable by a logged-out visitor", () => {
+      expect(canView(row("private"), null)).toBe(false);
+      expect(canView(row("private"), null, { asDirectLink: true })).toBe(false);
+    });
+  });
+});

apps/journal/app/lib/legal.ts

@@ -16,4 +16,4 @@ export const TERMS_VERSION = "2026-04-19";
  * require re-acceptance (the policy is informational, not contract), so this
  * is display-only — not persisted.
  */
-export const PRIVACY_LAST_UPDATED = "2026-04-19";
+export const PRIVACY_LAST_UPDATED = "2026-04-20";

apps/journal/app/lib/routes.server.ts

@@ -2,6 +2,7 @@ import { randomUUID } from "node:crypto";
 import { eq, desc, and } from "drizzle-orm";
 import { getDb } from "./db.ts";
 import { routes, routeVersions } from "@trails-cool/db/schema/journal";
+import type { Visibility } from "@trails-cool/db/schema/journal";
 import { parseGpxAsync } from "@trails-cool/gpx";
 import { sql } from "drizzle-orm";
 
@@ -10,6 +11,7 @@ export interface RouteInput {
   description?: string;
   gpx?: string;
   routingProfile?: string;
+  visibility?: Visibility;
 }
 
 export async function createRoute(ownerId: string, input: RouteInput) {
@@ -96,6 +98,23 @@ export async function listRoutes(ownerId: string) {
   return rows.map((r) => ({ ...r, geojson: geojsonMap.get(r.id) ?? null }));
 }
 
+/**
+ * List the *public* routes of a given owner. Used for cross-user listings
+ * (the public profile page); never includes `unlisted` or `private` content.
+ */
+export async function listPublicRoutesForOwner(ownerId: string) {
+  const db = getDb();
+  const rows = await db
+    .select()
+    .from(routes)
+    .where(and(eq(routes.ownerId, ownerId), eq(routes.visibility, "public")))
+    .orderBy(desc(routes.updatedAt));
+
+  const ids = rows.map((r) => r.id);
+  const geojsonMap = ids.length > 0 ? await getSimplifiedGeojsonBatch(ids) : new Map();
+  return rows.map((r) => ({ ...r, geojson: geojsonMap.get(r.id) ?? null }));
+}
+
 export async function updateRoute(
   id: string,
   ownerId: string,
@@ -106,6 +125,7 @@ export async function updateRoute(
   const updateData: Record<string, unknown> = { updatedAt: new Date() };
   if (input.name !== undefined) updateData.name = input.name;
   if (input.description !== undefined) updateData.description = input.description;
+  if (input.visibility !== undefined) updateData.visibility = input.visibility;
 
   if (input.gpx) {
     updateData.gpx = input.gpx;