fix: keep unlisted projects and events out of public directories

plugins/events/src/services/events.ts

@@ -1,4 +1,4 @@
-import { and, count, desc, eq, inArray, or } from "drizzle-orm";
+import { and, count, desc, eq, or } from "drizzle-orm";
 import { Context, Effect, Layer } from "every-plugin/effect";
 import { ORPCError } from "every-plugin/orpc";
 import { DatabaseTag } from "../db/layer";
@@ -280,13 +280,22 @@ const participantOwnerConditions = (userId: string, alternateUserId?: string) =>
     alternateUserId ? eq(eventParticipants.userId, alternateUserId) : undefined,
   ].filter(Boolean);
 
-const viewableEventConditions = (userId?: string, alternateUserId?: string) => {
-  const visibleConditions: any[] = [inArray(events.visibility, ["public", "unlisted"])];
+const viewableEventConditions = (
+  userId?: string,
+  alternateUserId?: string,
+  includeOwnedUnlisted = false,
+) => {
   const ownerConditions = [
     userId ? eq(events.ownerId, userId) : undefined,
     alternateUserId ? eq(events.ownerId, alternateUserId) : undefined,
   ].filter(Boolean);
-  if (ownerConditions.length > 0) visibleConditions.push(or(...ownerConditions));
+  const visibleConditions: any[] = [eq(events.visibility, "public")];
+  if (ownerConditions.length > 0) {
+    visibleConditions.push(and(or(...ownerConditions), eq(events.visibility, "private")));
+    if (includeOwnedUnlisted) {
+      visibleConditions.push(and(or(...ownerConditions), eq(events.visibility, "unlisted")));
+    }
+  }
   return or(...visibleConditions);
 };
 
@@ -307,7 +316,9 @@ export const EventServiceLive = Layer.effect(
 
           if (input.visibility) conditions.push(eq(events.visibility, input.visibility));
           if (userRole !== "admin") {
-            conditions.push(viewableEventConditions(userId, alternateUserId));
+            conditions.push(
+              viewableEventConditions(userId, alternateUserId, Boolean(input.ownerId)),
+            );
           }
 
           const whereClause = conditions.length > 0 ? and(...conditions) : undefined;

plugins/projects/src/__tests__/projects.test.ts

@@ -176,6 +176,43 @@ describe("projects router visibility", () => {
       "public",
     );
   });
+
+  it("keeps unlisted projects off the directory but readable by link", async () => {
+    const owner = loaded.createClient({
+      userId: "owner-user",
+      near: testNear("owner.near"),
+      user: testUser("owner-user", "member"),
+    });
+    const member = loaded.createClient({
+      userId: "member-user",
+      near: testNear("member.near"),
+      user: testUser("member-user", "member"),
+    });
+    const anonymous = loaded.createClient();
+    const unlisted = await owner.createProject({
+      kind: "idea",
+      title: "Unlisted project",
+      slug: "unlisted-project",
+      content: "Direct link only",
+      visibility: "unlisted",
+    });
+
+    expect((await anonymous.getProjectBySlug({ slug: "unlisted-project" })).data.id).toBe(
+      unlisted.id,
+    );
+    expect((await anonymous.listProjects({})).data.map((project) => project.id)).not.toContain(
+      unlisted.id,
+    );
+    expect((await member.listProjects({})).data.map((project) => project.id)).not.toContain(
+      unlisted.id,
+    );
+    expect((await owner.listProjects({})).data.map((project) => project.id)).not.toContain(
+      unlisted.id,
+    );
+    expect(
+      (await owner.listProjects({ ownerId: "owner.near" })).data.map((project) => project.id),
+    ).toContain(unlisted.id);
+  });
 });
 
 describe("project identity fields", () => {

plugins/projects/src/services/projects.ts

@@ -730,7 +730,10 @@ export const ProjectServiceLive = Layer.effect(
 
           if (input.visibility) {
             conditions.push(eq(projects.visibility, input.visibility));
-            if (input.visibility === "private" && userRole !== "admin") {
+            if (
+              (input.visibility === "private" || input.visibility === "unlisted") &&
+              userRole !== "admin"
+            ) {
               const viewerCollabIds = yield* getViewerCollabProjectIds;
               const accessConditions: any[] = [
                 userId ? eq(projects.ownerId, userId) : undefined,
@@ -740,14 +743,19 @@ export const ProjectServiceLive = Layer.effect(
               conditions.push(accessConditions.length > 0 ? or(...accessConditions) : sql`false`);
             }
           } else {
-            const visibleConditions: any[] = [inArray(projects.visibility, ["public", "unlisted"])];
-            if (userId || alternateUserId) {
-              const ownerConditions = [
-                userId ? eq(projects.ownerId, userId) : undefined,
-                alternateUserId ? eq(projects.ownerId, alternateUserId) : undefined,
-              ].filter(Boolean);
-              if (ownerConditions.length > 0) {
-                visibleConditions.push(or(...ownerConditions));
+            const ownerConditions = [
+              userId ? eq(projects.ownerId, userId) : undefined,
+              alternateUserId ? eq(projects.ownerId, alternateUserId) : undefined,
+            ].filter(Boolean);
+            const visibleConditions: any[] = [eq(projects.visibility, "public")];
+            if (ownerConditions.length > 0) {
+              visibleConditions.push(
+                and(or(...ownerConditions), eq(projects.visibility, "private")),
+              );
+              if (input.ownerId) {
+                visibleConditions.push(
+                  and(or(...ownerConditions), eq(projects.visibility, "unlisted")),
+                );
               }
               const viewerCollabIds = yield* getViewerCollabProjectIds;
               if (viewerCollabIds.length > 0) {