From d222fafc1baeaf69be845a64a794d28e8b2c0c0d Mon Sep 17 00:00:00 2001
From: dakkar <dakkar@thenautilus.net>
Date: Tue, 10 Jun 2025 15:13:53 +0100
Subject: [PATCH] fix visibility regressions and merge typos

---
 packages/backend/src/core/QueryService.ts     |  6 ++++--
 .../server/api/endpoints/notes/mentions.ts    | 19 +++++++++----------
 2 files changed, 13 insertions(+), 12 deletions(-)

diff --git a/packages/backend/src/core/QueryService.ts b/packages/backend/src/core/QueryService.ts
index 288e244cc7..4e423e73f2 100644
--- a/packages/backend/src/core/QueryService.ts
+++ b/packages/backend/src/core/QueryService.ts
@@ -168,8 +168,10 @@ export class QueryService {
 					.orWhere(':meId = note.replyUserId')
 					// DM to me
 					.orWhere(':meIdAsList <@ note.visibleUserIds')
-					// Mentions me
-					.orWhere(':meIdAsList <@ note.mentions')
+					// Mentions me (and not a direct message)
+					.orWhere(new Brackets(qb =>
+						qb.andWhere(':meIdAsList <@ note.mentions')
+							.andWhere('note.visibility != \'specified\'')))
 					// Followers-only post
 					.orWhere(new Brackets(qb => this
 						.andFollowingUser(qb, ':meId', 'note.userId')
diff --git a/packages/backend/src/server/api/endpoints/notes/mentions.ts b/packages/backend/src/server/api/endpoints/notes/mentions.ts
index 889e85b4a8..9e19d1676c 100644
--- a/packages/backend/src/server/api/endpoints/notes/mentions.ts
+++ b/packages/backend/src/server/api/endpoints/notes/mentions.ts
@@ -77,17 +77,21 @@ export default class extends Endpoint<typeof meta, typeof paramDef> { // eslint-
 							))
 							.setParameters({ meIdAsList: [me.id] })
 						, 'source')
-						.innerJoin(MiNote, 'note', 'note.id = source.id');
+						.innerJoin(MiNote, 'note', 'note.id = source.id')
+						.innerJoinAndSelect('note.user', 'user')
+						.leftJoinAndSelect('note.reply', 'reply')
+						.leftJoinAndSelect('note.renote', 'renote')
+						.leftJoinAndSelect('reply.user', 'replyUser')
+						.leftJoinAndSelect('renote.user', 'renoteUser');
 
-					// Mentioned or visible users can always access
-					//this.queryService.generateVisibilityQuery(query, me);
+					this.queryService.generateVisibilityQuery(qb, me);
 					this.queryService.generateBlockedHostQueryForNote(qb);
-					this.queryService.generateSuspendedUserQueryForNote(query);
+					this.queryService.generateSuspendedUserQueryForNote(qb);
 					this.queryService.generateMutedUserQueryForNotes(qb, me);
 					this.queryService.generateMutedNoteThreadQuery(qb, me);
 					this.queryService.generateBlockedUserQueryForNotes(qb, me);
 					// A renote can't mention a user, so it will never appear here anyway.
-					//this.queryService.generateMutedUserRenotesQueryForNotes(query, me);
+					//this.queryService.generateMutedUserRenotesQueryForNotes(qb, me);
 
 					if (ps.visibility) {
 						qb.andWhere('note.visibility = :visibility', { visibility: ps.visibility });
@@ -101,11 +105,6 @@ export default class extends Endpoint<typeof meta, typeof paramDef> { // eslint-
 
 					return qb;
 				}, 'source', 'source.id = note.id')
-				.innerJoinAndSelect('note.user', 'user')
-				.leftJoinAndSelect('note.reply', 'reply')
-				.leftJoinAndSelect('note.renote', 'renote')
-				.leftJoinAndSelect('reply.user', 'replyUser')
-				.leftJoinAndSelect('renote.user', 'renoteUser')
 				.limit(ps.limit);
 
 			const mentions = await query.getMany();