diff --git a/server/api/users/:uuid/inbox/index.ts b/server/api/users/:uuid/inbox/index.ts index 6b92954d..3ae9cf76 100644 --- a/server/api/users/:uuid/inbox/index.ts +++ b/server/api/users/:uuid/inbox/index.ts @@ -92,6 +92,13 @@ export default (app: Hono) => return errorResponse("User not found", 404); } + if (user.isRemote()) { + return errorResponse( + "Cannot view users from remote instances", + 403, + ); + } + // @ts-expect-error IP attribute is not in types const requestIp = context.env?.ip as | SocketAddress diff --git a/server/api/users/:uuid/index.ts b/server/api/users/:uuid/index.ts index 10027eed..7a073362 100644 --- a/server/api/users/:uuid/index.ts +++ b/server/api/users/:uuid/index.ts @@ -37,6 +37,13 @@ export default (app: Hono) => return errorResponse("User not found", 404); } + if (user.isRemote()) { + return errorResponse( + "Cannot view users from remote instances", + 403, + ); + } + return jsonResponse(user.toLysand()); }, ); diff --git a/server/api/users/:uuid/outbox/index.ts b/server/api/users/:uuid/outbox/index.ts index 73715547..c057e7d6 100644 --- a/server/api/users/:uuid/outbox/index.ts +++ b/server/api/users/:uuid/outbox/index.ts @@ -48,6 +48,13 @@ export default (app: Hono) => return errorResponse("User not found", 404); } + if (author.isRemote()) { + return errorResponse( + "Cannot view users from remote instances", + 403, + ); + } + const pageNumber = Number(context.req.valid("query").page) || 1; const notes = await Note.manyFromSql(