trails-cool/trails
1
1
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Drop has-public-content gate from profile loader

Browse source 
A public profile (`profile_visibility = 'public'`) with zero public
routes or activities now returns 200 and renders the empty profile
shell instead of 404. The earlier change kept the legacy "AND has
public content" gate to preserve a no-existence-leak guarantee, but
that conflated the implicit behavior with the new explicit setting.
With profile_visibility now a deliberate toggle, the cleaner contract
is: visibility = public means the profile renders, period.

Followability already only depends on profile_visibility, so this
brings the public-page contract in line with that. The `private`
toggle remains the way to hide a profile from visitors.

Updates social-feed change spec + design to match (drops the
"AND has at least one public" predicate and the matching 404
scenario; adds an explicit "empty public profile renders an empty
shell" scenario).

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
This commit is contained in:
Ullrich Schäfer 2026-04-25 23:11:46 +02:00
parent ede68712a3
commit 6a2f0bf089
3 changed files with 23 additions and 19 deletions
Download patch file Download diff file Expand all files Collapse all files

13
apps/journal/app/routes/users.$username.tsx
View file

@ -31,17 +31,16 @@ export async function loader({ params, request }: Route.LoaderArgs) {
const isOwn = currentUser?.id === user.id;
// Profile-visibility gate: a `private` profile 404s for everyone but
// the owner, regardless of how much public content they have.
// the owner, regardless of how much public content they have. With
// explicit `profile_visibility` we no longer 404 public profiles that
// happen to have zero public items — the page renders with empty
// sections, matching Mastodon-style "discoverable account, no posts
// yet" behavior. Existence-leak risk is accepted: explicit visibility
// is the contract.
if (!isOwn && user.profileVisibility !== "public") {
throw data({ error: "User not found" }, { status: 404 });
}
// 404 for public-but-empty profiles to prevent account enumeration.
// Owners still see their own profile even when empty.
if (!isOwn && publicRoutes.length === 0 && publicActivities.length === 0) {
throw data({ error: "User not found" }, { status: 404 });
}
// Follow state for non-owner viewers (null when anonymous).
const followState = !isOwn && currentUser
? await getFollowState(currentUser.id, user.username)