don't show hidden users in picture identifications

This commit is contained in:
imperosol
2025-11-07 18:32:56 +01:00
parent 1f3a483b1b
commit 144b05e49c
4 changed files with 64 additions and 2 deletions

View File

@@ -143,11 +143,14 @@ class PicturesController(ControllerBase):
"/{picture_id}/identified",
permissions=[IsAuthenticated, CanView],
response=list[IdentifiedUserSchema],
url_name="picture_identifications",
)
def fetch_identifications(self, picture_id: int):
"""Fetch the users that have been identified on the given picture."""
picture = self.get_object_or_exception(Picture, pk=picture_id)
return picture.people.select_related("user")
return picture.people.viewable_by(self.context.request.user).select_related(
"user"
)
@route.put("/{picture_id}/identified", permissions=[IsAuthenticated, CanView])
def identify_users(self, picture_id: NonNegativeInt, users: set[NonNegativeInt]):