Skip to content

Thread text: a hidden message shows no sender or time - #61

Merged
markmnl merged 1 commit into
mainfrom
thread-text-hardening
Oct 29, 2026
Merged

markmnl merged 1 commit into
mainfrom
thread-text-hardening

Conversation

@markmnl

@markmnl markmnl commented Oct 29, 2026

Copy link
Copy Markdown
Owner

GET /fmsg/:id/thread printed the sender and send time of ancestors the caller isn't a participant of, for example earlier messages seen by someone added with add-to. Those entries now render as --- hidden --- and [message not visible to you], with nothing else.

GET /fmsg/:id/thread/messages is unchanged. It already hides everything except id and visible:false. Clients use those ids and root_id to group threads, and the ids are row numbers that return 403 when fetched.

  • renderThreadText skips the separator details for unreadable entries.
  • TestRenderThreadText checks that a hidden entry's sender doesn't appear.
  • README updated.

🤖 Generated with Claude Code

GET /fmsg/:id/thread printed the sender and send time of ancestors the
caller is not a participant of. Those entries now render as
"--- hidden ---" with the placeholder and nothing else.

Co-Authored-By: Claude Opus 5.5 <[email protected]>
@markmnl
markmnl merged commit f6fd334 into main Oct 29, 2026
1 check passed
@markmnl
markmnl deleted the thread-text-hardening branch October 29, 2026 13:08
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant