Restrict Atom feeds to public posts

Limit profile Atom feeds to public and unlisted posts so
followers-only posts and direct messages are no longer exposed
through a public endpoint.

Add a regression test for /@handle/atom.xml and document the
security fix in CHANGES.md.

Fixes #440

Assisted-by: Codex:gpt-5.4

Author: dahlia

CHANGES.md

@@ -6,6 +6,12 @@ Version 0.7.11
 
 To be released.
 
+ -  Fixed a security vulnerability where a public profile's Atom feed could
+    expose followers-only posts and direct messages.  The Atom feed now only
+    serves public and unlisted posts.  [[#440]]
+
+[#440]: https://github.com/fedify-dev/hollo/issues/440
+
 
 Version 0.7.10
 --------------

src/pages/profile/index.test.ts

@@ -0,0 +1,63 @@
+import { Hono } from "hono";
+import { beforeEach, describe, expect, it } from "vitest";
+import { cleanDatabase } from "../../../tests/helpers";
+import { createAccount } from "../../../tests/helpers/oauth";
+import db from "../../db";
+import { type PostVisibility, posts } from "../../schema";
+import type { Uuid } from "../../uuid";
+import profile from "./index";
+
+const app = new Hono();
+
+app.route("/:handle{@[^/]+}", profile);
+
+async function createPost(
+  accountId: string,
+  visibility: PostVisibility,
+  content: string,
+) {
+  const id = crypto.randomUUID() as Uuid;
+  await db.insert(posts).values({
+    id,
+    iri: `https://hollo.test/@hollo/${id}`,
+    type: "Note",
+    accountId: accountId as Uuid,
+    visibility,
+    contentHtml: `<p>${content}</p>`,
+    content,
+    url: `https://hollo.test/@hollo/${id}`,
+    published: new Date(),
+  });
+}
+
+describe("Profile Atom feed", () => {
+  let accountId: string;
+
+  beforeEach(async () => {
+    await cleanDatabase();
+    const account = await createAccount({ generateKeyPair: true });
+    accountId = account.id;
+  });
+
+  it("only includes public and unlisted posts", async () => {
+    expect.assertions(6);
+
+    await createPost(accountId, "public", "public post");
+    await createPost(accountId, "unlisted", "unlisted post");
+    await createPost(accountId, "private", "followers-only post");
+    await createPost(accountId, "direct", "secret DM");
+
+    const response = await app.request("/@hollo/atom.xml");
+
+    expect(response.status).toBe(200);
+    expect(response.headers.get("content-type")).toContain(
+      "application/atom+xml",
+    );
+
+    const body = await response.text();
+    expect(body).toContain("public post");
+    expect(body).toContain("unlisted post");
+    expect(body).not.toContain("followers-only post");
+    expect(body).not.toContain("secret DM");
+  });
+});

src/pages/profile/index.tsx

@@ -321,7 +321,10 @@ profile.get("/atom.xml", async (c) => {
   if (owner == null) return c.notFound();
   const postList = await db.query.posts.findMany({
     with: { account: true },
-    where: eq(posts.accountId, owner.id),
+    where: and(
+      eq(posts.accountId, owner.id),
+      or(eq(posts.visibility, "public"), eq(posts.visibility, "unlisted")),
+    ),
     orderBy: desc(posts.published),
     limit: 100,
   });