diff --git a/core/models.py b/core/models.py index 0f0ef10e..43d2e7ca 100644 --- a/core/models.py +++ b/core/models.py @@ -131,7 +131,9 @@ class UserQuerySet(models.QuerySet): if user.has_perm("core.view_hidden_user"): return self if user.has_perm("core.view_user"): - return self.filter(Q(is_viewable=True) | Q(whitelisted_users=user)) + return self.filter( + Q(is_viewable=True) | Q(whitelisted_users=user) | Q(pk=user.pk) + ) if user.is_anonymous: return self.none() return self.filter(id=user.id) diff --git a/core/tests/test_user.py b/core/tests/test_user.py index 5dd3e62f..634a6a0b 100644 --- a/core/tests/test_user.py +++ b/core/tests/test_user.py @@ -417,12 +417,26 @@ class TestUserQuerySetViewableBy: viewable = User.objects.filter(id__in=[u.id for u in users]).viewable_by(user) assert set(viewable) == {users[0], users[1]} + def test_hidden(self, users: list[User]): + user = subscriber_user.make() + viewable = User.objects.filter( + id__in=[u.id for u in [*users, user]] + ).viewable_by(user) + assert set(viewable) == {user, users[0], users[1]} + def test_whitelist(self, users: list[User]): user = subscriber_user.make() users[3].whitelisted_users.add(user) viewable = User.objects.filter(id__in=[u.id for u in users]).viewable_by(user) assert set(viewable) == {users[0], users[1], users[3]} + def test_hidden_user_can_see_itself(self, users: list[User]): + user = subscriber_user.make(is_viewable=False) + viewable = User.objects.filter( + id__in=[u.id for u in [*users, user]] + ).viewable_by(user) + assert set(viewable) == {user, users[0], users[1]} + @pytest.mark.parametrize("user_factory", [lambda: baker.make(User), AnonymousUser]) def test_not_subscriber(self, users: list[User], user_factory): user = user_factory()