don't list pages the user can't view

4 files changed, 9 insertions, 15 deletions

diff --git a/routes/note.php b/routes/note.php
index 6dd0025..1967a2d 100644
--- a/routes/note.php
+++ b/routes/note.php
@@ -40,11 +40,8 @@ Router::getInstance()->mount('/@/:handle/note/:id', function (array $args) {
         throw new NotFound("i don't know that note");
     }
     // check the current user is allowed to see it
-    if ($note->privacy->scope != NotePrivacyScope::PUBLIC ) {
-        $user = UserAccount::requireByCurrentSession();
-        if (!in_array($user->actor, $note->getRelevantActors())) {
-            throw new Forbidden();
-        }
+    if (!$note->isViewableBy(UserAccount::findByCurrentSession())) {
+        throw new Forbidden();
     }
     // change the handle in the url if it's wrong
     if ($args['handle'] != $note->author->getFullHandle()) {
diff --git a/routes/pages.php b/routes/pages.php
index 418436f..f57d10d 100644
--- a/routes/pages.php
+++ b/routes/pages.php
@@ -58,11 +58,8 @@ Router::getInstance()->mount('/@/:handle/page/:id', function (array $args) {
         throw new NotFound("i don't know that note");
     }
     // check the current user is allowed to see it
-    if ($note->privacy->scope != NotePrivacyScope::PUBLIC ) {
-        $user = UserAccount::requireByCurrentSession();
-        if (!in_array($user->actor, $note->getRelevantActors())) {
-            throw new Forbidden();
-        }
+    if (!$note->isViewableBy(UserAccount::findByCurrentSession())) {
+        throw new Forbidden();
     }
     // go back to the note if it's not a page
     if (!$note->hasPage()) {
diff --git a/templates/pages/list_page.php b/templates/pages/list_page.php
index e347e18..3c8488b 100644
--- a/templates/pages/list_page.php
+++ b/templates/pages/list_page.php
@@ -1,6 +1,7 @@
 <?php
 
 use Digitigrade\Model\Note;
+use Digitigrade\Model\UserAccount;
 
 call_template('skeleton', ['pageTitle' => __('note.page.list.pageTitle')], function () {
     ?>
@@ -9,7 +10,10 @@ call_template('skeleton', ['pageTitle' => __('note.page.list.pageTitle')], funct
 
     $notes = Note::findAllWithExtension(Note::EXTENSION_PAGES, 20);
     foreach ($notes as $note) {
-        call_template('pages/list_item', ['note' => $note]);
+        /** @var Note $note */
+        if ($note->isViewableBy(UserAccount::findByCurrentSession())) {
+            call_template('pages/list_item', ['note' => $note]);
+        }
     }
     if (count($notes) == 0) {
         call_template('placeholder_text');
diff --git a/templates/pages/page.php b/templates/pages/page.php
index dfc171f..97cea6d 100644
--- a/templates/pages/page.php
+++ b/templates/pages/page.php
@@ -2,10 +2,6 @@
 
 /** @var \Digitigrade\Model\Note $note */
 
-use Digitigrade\FormattingProvider;
-use Digitigrade\Model\UserAccount;
-use Digitigrade\UserSettings;
-
 $page = $note->getPage();
 
 call_template('skeleton', [