✨ Hide visibility of check-ins for individual users

app/Dto/Internal/CheckInRequestDto.php

@@ -27,6 +27,7 @@ class CheckInRequestDto
     public bool             $forceFlag;
     public bool             $postOnMastodonFlag;
     public bool             $chainFlag;
+    public array $hiddenUserIds;
 
     public function __construct() {
         $this->travelReason       = Business::PRIVATE;
@@ -36,6 +37,7 @@ public function __construct() {
         $this->forceFlag          = false;
         $this->postOnMastodonFlag = false;
         $this->chainFlag          = false;
+        $this->hiddenUserIds      = [];
     }
 
     public function setUser(Authenticatable $user): CheckInRequestDto {
@@ -102,4 +104,9 @@ public function setChainFlag(bool $chainFlag): CheckInRequestDto {
         $this->chainFlag = $chainFlag;
         return $this;
     }
+
+    public function setHiddenUserIds(array $hiddenUserIds): CheckInRequestDto {
+        $this->hiddenUserIds = $hiddenUserIds;
+        return $this;
+    }
 }

app/Http/Controllers/API/v1/StatusHiddenUserController.php

@@ -0,0 +1,210 @@
+<?php
+
+namespace App\Http\Controllers\API\v1;
+
+use App\Http\Resources\UserResource;
+use App\Models\Status;
+use App\Models\StatusHiddenUser;
+use App\Models\User;
+use Illuminate\Auth\Access\AuthorizationException;
+use Illuminate\Database\Eloquent\ModelNotFoundException;
+use Illuminate\Http\JsonResponse;
+use Illuminate\Http\Request;
+use Illuminate\Support\Facades\Validator;
+use Illuminate\Validation\ValidationException;
+
+class StatusHiddenUserController extends Controller
+{
+    /**
+     * @OA\Get(
+     *      path="/status/{statusId}/hidden-users",
+     *      operationId="getHiddenUsers",
+     *      tags={"Status"},
+     *      summary="Get users hidden from viewing a status",
+     *      description="Returns list of users who are hidden from viewing this specific status",
+     *      @OA\Parameter (
+     *          name="statusId",
+     *          in="path",
+     *          description="Status-ID",
+     *          example=1337,
+     *          @OA\Schema(type="integer")
+     *      ),
+     *      @OA\Response(
+     *          response=200,
+     *          description="successful operation",
+     *          @OA\JsonContent(
+     *              @OA\Property(
+     *                  property="data",
+     *                  type="array",
+     *                  @OA\Items(ref="#/components/schemas/UserResource")
+     *              )
+     *          )
+     *      ),
+     *      @OA\Response(response=403, description="User not authorized"),
+     *      @OA\Response(response=404, description="Status not found"),
+     *      security={
+     *          {"passport": {"read-statuses"}}, {"token": {}}
+     *      }
+     * )
+     *
+     * @param int $statusId
+     * @return JsonResponse
+     */
+    public function index(int $statusId): JsonResponse {
+        try {
+            $status = Status::findOrFail($statusId);
+            $this->authorize('update', $status);
+
+            $hiddenUsers = $status->hiddenUsers()->with('user')->get()->pluck('user');
+
+            return $this->sendResponse(UserResource::collection($hiddenUsers));
+        } catch (ModelNotFoundException) {
+            return $this->sendError('Status not found', 404);
+        } catch (AuthorizationException) {
+            return $this->sendError('You are not authorized to view hidden users for this status', 403);
+        }
+    }
+
+    /**
+     * @OA\Post(
+     *      path="/status/{statusId}/hidden-users",
+     *      operationId="addHiddenUser",
+     *      tags={"Status"},
+     *      summary="Add a user to the hidden list for a status",
+     *      description="Adds a user who will not be able to see this specific status",
+     *      @OA\Parameter (
+     *          name="statusId",
+     *          in="path",
+     *          description="Status-ID",
+     *          example=1337,
+     *          @OA\Schema(type="integer")
+     *      ),
+     *      @OA\RequestBody(
+     *          required=true,
+     *          @OA\JsonContent(
+     *              required={"userId"},
+     *              @OA\Property(property="userId", type="integer", example=42,
+     *                  description="ID of user to hide this status from")
+     *          )
+     *      ),
+     *      @OA\Response(
+     *          response=201,
+     *          description="User successfully added to hidden list",
+     *          @OA\JsonContent(
+     *              @OA\Property(property="message", type="string", example="User added to hidden list")
+     *          )
+     *      ),
+     *      @OA\Response(response=400, description="Bad request"),
+     *      @OA\Response(response=403, description="User not authorized"),
+     *      @OA\Response(response=404, description="Status or user not found"),
+     *      @OA\Response(response=409, description="User already hidden"),
+     *      security={
+     *          {"passport": {"write-statuses"}}, {"token": {}}
+     *      }
+     * )
+     *
+     * @param Request $request
+     * @param int $statusId
+     * @return JsonResponse
+     * @throws ValidationException
+     */
+    public function store(Request $request, int $statusId): JsonResponse {
+        $validator = Validator::make($request->all(), [
+            'userId' => ['required', 'integer', 'exists:users,id'],
+        ]);
+
+        if ($validator->fails()) {
+            return $this->sendError($validator->errors(), 400);
+        }
+
+        $validated = $validator->validate();
+
+        try {
+            $status = Status::findOrFail($statusId);
+            $this->authorize('update', $status);
+
+            $userToHide = User::findOrFail($validated['userId']);
+
+            // Can't hide yourself from your own status
+            if ($userToHide->id === $status->user_id) {
+                return $this->sendError('You cannot hide yourself from your own status', 400);
+            }
+
+            // Check if already hidden
+            if ($status->hiddenUsers()->where('user_id', $userToHide->id)->exists()) {
+                return $this->sendError('User is already hidden from this status', 409);
+            }
+
+            StatusHiddenUser::create([
+                'status_id' => $status->id,
+                'user_id'   => $userToHide->id,
+            ]);
+
+            return $this->sendResponse(['message' => __('status.hidden-user.added')], 201);
+        } catch (ModelNotFoundException) {
+            return $this->sendError('Status or user not found', 404);
+        } catch (AuthorizationException) {
+            return $this->sendError('You are not authorized to modify hidden users for this status', 403);
+        }
+    }
+
+    /**
+     * @OA\Delete(
+     *      path="/status/{statusId}/hidden-users/{userId}",
+     *      operationId="removeHiddenUser",
+     *      tags={"Status"},
+     *      summary="Remove a user from the hidden list for a status",
+     *      description="Removes a user from the hidden list, allowing them to see this status again",
+     *      @OA\Parameter (
+     *          name="statusId",
+     *          in="path",
+     *          description="Status-ID",
+     *          example=1337,
+     *          @OA\Schema(type="integer")
+     *      ),
+     *      @OA\Parameter (
+     *          name="userId",
+     *          in="path",
+     *          description="User-ID to remove from hidden list",
+     *          example=42,
+     *          @OA\Schema(type="integer")
+     *      ),
+     *      @OA\Response(
+     *          response=200,
+     *          description="User successfully removed from hidden list",
+     *          @OA\JsonContent(
+     *              @OA\Property(property="message", type="string", example="User removed from hidden list")
+     *          )
+     *      ),
+     *      @OA\Response(response=403, description="User not authorized"),
+     *      @OA\Response(response=404, description="Status or hidden user entry not found"),
+     *      security={
+     *          {"passport": {"write-statuses"}}, {"token": {}}
+     *      }
+     * )
+     *
+     * @param int $statusId
+     * @param int $userId
+     * @return JsonResponse
+     */
+    public function destroy(int $statusId, int $userId): JsonResponse {
+        try {
+            $status = Status::findOrFail($statusId);
+            $this->authorize('update', $status);
+
+            $hiddenEntry = $status->hiddenUsers()->where('user_id', $userId)->first();
+
+            if (!$hiddenEntry) {
+                return $this->sendError('User is not hidden from this status', 404);
+            }
+
+            $hiddenEntry->delete();
+
+            return $this->sendResponse(['message' => __('status.hidden-user.removed')]);
+        } catch (ModelNotFoundException) {
+            return $this->sendError('Status not found', 404);
+        } catch (AuthorizationException) {
+            return $this->sendError('You are not authorized to modify hidden users for this status', 403);
+        }
+    }
+}

app/Http/Controllers/API/v1/TransportController.php

@@ -393,22 +393,30 @@ public function create(Request $request): JsonResponse {
 
         $withUsers = null;
         $validated = $request->validate([
-                                            'body'        => ['nullable', 'max:280'],
-                                            'business'    => ['nullable', new Enum(Business::class)],
-                                            'visibility'  => ['nullable', new Enum(StatusVisibility::class)],
-                                            'eventId'     => ['nullable', 'integer', 'exists:events,id'],
-                                            'toot'        => ['nullable', 'boolean'],
-                                            'chainPost'   => ['nullable', 'boolean'],
-                                            'ibnr'        => ['nullable', 'boolean'],
-                                            'tripId'      => ['required'],
-                                            'lineName'    => ['required'],
-                                            'start'       => ['required', 'numeric'],
-                                            'destination' => ['required', 'numeric'],
-                                            'departure'   => ['required', 'date'],
-                                            'arrival'     => ['required', 'date'],
-                                            'force'       => ['nullable', 'boolean'],
-                                            'with'        => ['nullable', 'array', 'max:10'],
+                                            'body'          => ['nullable', 'max:280'],
+                                            'business'      => ['nullable', new Enum(Business::class)],
+                                            'visibility'    => ['nullable', new Enum(StatusVisibility::class)],
+                                            'eventId'       => ['nullable', 'integer', 'exists:events,id'],
+                                            'toot'          => ['nullable', 'boolean'],
+                                            'chainPost'     => ['nullable', 'boolean'],
+                                            'ibnr'          => ['nullable', 'boolean'],
+                                            'tripId'        => ['required'],
+                                            'lineName'      => ['required'],
+                                            'start'         => ['required', 'numeric'],
+                                            'destination'   => ['required', 'numeric'],
+                                            'departure'     => ['required', 'date'],
+                                            'arrival'       => ['required', 'date'],
+                                            'force'         => ['nullable', 'boolean'],
+                                            'with'          => ['nullable', 'array', 'max:10'],
+                                            'hiddenUserIds' => ['nullable', 'array'],
+                                            'hiddenUserIds.*' => ['integer', 'exists:users,id'],
                                         ]);
+
+        // Validate that user is not trying to hide themselves
+        if (isset($validated['hiddenUserIds']) && in_array(Auth::id(), $validated['hiddenUserIds'])) {
+            return $this->sendError('You cannot hide yourself from your own status.', 400);
+        }
+
         if (isset($validated['with'])) {
             $withUsers      = User::whereIn('id', $validated['with'])->get();
             $forbiddenUsers = collect();

app/Http/Controllers/Backend/Transport/StatusController.php

@@ -56,42 +56,52 @@ public static function getPrintableEscapedBody(Status $status): string {
      */
     public static function filterStatusVisibility(?User $viewingUser = null): Closure {
         return function(EloquentBuilder $query) use ($viewingUser) {
-            //Visibility checks: One of the following options must be true
-
-            //Option 1: User is public AND status is public
-            $query->where(function(EloquentBuilder $query) use ($viewingUser) {
-                $query->where('users.private_profile', 0)
-                      ->whereIn('visibility', [StatusVisibility::PUBLIC->value] + ($viewingUser !== null ? [StatusVisibility::AUTHENTICATED->value] : []));
-            });
-
             if ($viewingUser !== null) {
-                //Option 2: Status is from oneself
-                $query->orWhere('users.id', $viewingUser->id);
-
-                //Option 3: Status is from a followed BUT not unlisted or private or trusted users only
-                $query->orWhere(function(EloquentBuilder $query) use ($viewingUser) {
-                    $query->whereIn('users.id', $viewingUser->follows()->select('follow_id'))
-                          ->whereNotIn('statuses.visibility', [
-                              StatusVisibility::UNLISTED->value,
-                              StatusVisibility::PRIVATE->value,
-                              StatusVisibility::TRUSTED->value,
-                          ]);
+                $query->whereNotExists(function(QueryBuilder $subQuery) use ($viewingUser) {
+                    $subQuery->select(DB::raw(1))
+                             ->from('status_hidden_users')
+                             ->whereColumn('status_hidden_users.status_id', 'statuses.id')
+                             ->where('status_hidden_users.user_id', $viewingUser->id);
                 });
+            }
 
-                //Option 4: Status is from a user who trusts the viewing user
-                $query->orWhere(function(EloquentBuilder $query) use ($viewingUser) {
-                    $query->where('statuses.visibility', StatusVisibility::TRUSTED->value)
-                          ->whereExists(function(QueryBuilder $subQuery) use ($viewingUser) {
-                              $subQuery->from('trusted_users')
-                                       ->whereColumn('trusted_users.user_id', 'statuses.user_id')
-                                       ->where('trusted_users.trusted_id', $viewingUser->id)
-                                       ->where(function(QueryBuilder $expireQuery) {
-                                           $expireQuery->whereNull('trusted_users.expires_at')
-                                                       ->orWhere('trusted_users.expires_at', '>', now());
-                                       });
-                          });
+            //Visibility checks: One of the following options must be true
+            $query->where(function(EloquentBuilder $visibility) use ($viewingUser) {
+                //Option 1: User is public AND status is public
+                $visibility->where(function(EloquentBuilder $query) use ($viewingUser) {
+                    $query->where('users.private_profile', 0)
+                          ->whereIn('visibility', [StatusVisibility::PUBLIC->value] + ($viewingUser !== null ? [StatusVisibility::AUTHENTICATED->value] : []));
                 });
-            }
+
+                if ($viewingUser !== null) {
+                    //Option 2: Status is from oneself
+                    $visibility->orWhere('users.id', $viewingUser->id);
+
+                    //Option 3: Status is from a followed BUT not unlisted or private or trusted users only
+                    $visibility->orWhere(function(EloquentBuilder $query) use ($viewingUser) {
+                        $query->whereIn('users.id', $viewingUser->follows()->select('follow_id'))
+                              ->whereNotIn('statuses.visibility', [
+                                  StatusVisibility::UNLISTED->value,
+                                  StatusVisibility::PRIVATE->value,
+                                  StatusVisibility::TRUSTED->value,
+                              ]);
+                    });
+
+                    //Option 4: Status is from a user who trusts the viewing user
+                    $visibility->orWhere(function(EloquentBuilder $query) use ($viewingUser) {
+                        $query->where('statuses.visibility', StatusVisibility::TRUSTED->value)
+                              ->whereExists(function(QueryBuilder $subQuery) use ($viewingUser) {
+                                  $subQuery->from('trusted_users')
+                                           ->whereColumn('trusted_users.user_id', 'statuses.user_id')
+                                           ->where('trusted_users.trusted_id', $viewingUser->id)
+                                           ->where(function(QueryBuilder $expireQuery) {
+                                               $expireQuery->whereNull('trusted_users.expires_at')
+                                                           ->orWhere('trusted_users.expires_at', '>', now());
+                                           });
+                              });
+                    });
+                }
+            });
         };
     }
 }

app/Http/Controllers/Backend/Transport/TrainCheckinController.php

@@ -55,6 +55,16 @@ public static function checkin(CheckInRequestDto $dto, ?User $checkedInBy = null
                 event:      $dto->event
             );
 
+            // Add hidden users if specified
+            if (!empty($dto->hiddenUserIds)) {
+                foreach ($dto->hiddenUserIds as $userId) {
+                    \App\Models\StatusHiddenUser::create([
+                        'status_id' => $status->id,
+                        'user_id'   => $userId,
+                    ]);
+                }
+            }
+
             $checkinResponse = self::createCheckin(
                 status:      $status,
                 trip:        $dto->trip,