httpd: Filter-out private-but-pinned repos

They should only be visible to localhost.
2024-02-16 15:27:08 +01:00 · 2024-02-16 15:27:08 +01:00 · 0908c65f50
parent 9767b485c2
commit 0908c65f50
1 changed files with 8 additions and 1 deletions
--- a/radicle-httpd/src/api/v1/projects.rs
+++ b/radicle-httpd/src/api/v1/projects.rs
@ -100,7 +100,14 @@ async fn project_root_handler(
                Visibility::Public => true,
            })
            .collect::<Vec<_>>(),
-        ProjectQuery::Pinned => storage.repositories_by_id(pinned.repositories.iter())?,
+        ProjectQuery::Pinned => storage
+            .repositories_by_id(pinned.repositories.iter())?
+            .into_iter()
+            .filter(|repo| match &repo.doc.visibility {
+                Visibility::Private { .. } => addr.ip().is_loopback(),
+                Visibility::Public => true,
+            })
+            .collect::<Vec<_>>(),
    };
    projects.sort_by_key(|p| p.rid);