Don't create embeds of profiles/posts from users who ask not to be sh… (#2189)

* Don't create embeds of profiles/posts from users who ask not to be shown in public views

* Formatting cleanup

* Bump workflow file to build an image for this branch

2 files changed, 36 insertions, 18 deletions

diff --git a/.github/workflows/build-and-push-bskyweb-aws.yaml b/.github/workflows/build-and-push-bskyweb-aws.yaml
index 39136fca9..fef24f952 100644
--- a/.github/workflows/build-and-push-bskyweb-aws.yaml
+++ b/.github/workflows/build-and-push-bskyweb-aws.yaml
@@ -4,6 +4,7 @@ on:
     branches:
       - main
       - traffic-reduction
+      - respect-optout-for-embeds
 env:
   REGISTRY: ${{ secrets.AWS_ECR_REGISTRY_USEAST2_PACKAGES_REGISTRY }}
   USERNAME: ${{ secrets.AWS_ECR_REGISTRY_USEAST2_PACKAGES_USERNAME }}
diff --git a/bskyweb/cmd/bskyweb/server.go b/bskyweb/cmd/bskyweb/server.go
index 46848a82d..6cf54a9ef 100644
--- a/bskyweb/cmd/bskyweb/server.go
+++ b/bskyweb/cmd/bskyweb/server.go
@@ -296,21 +296,30 @@ func (srv *Server) WebPost(c echo.Context) error {
 		if err != nil {
 			log.Warnf("failed to fetch handle: %s\t%v", handle, err)
 		} else {
-			did := pv.Did
-			data["did"] = did
-
-			// then fetch the post thread (with extra context)
-			uri := fmt.Sprintf("at://%s/app.bsky.feed.post/%s", did, rkey)
-			tpv, err := appbsky.FeedGetPostThread(ctx, srv.xrpcc, 1, uri)
-			if err != nil {
-				log.Warnf("failed to fetch post: %s\t%v", uri, err)
-			} else {
-				req := c.Request()
-				postView := tpv.Thread.FeedDefs_ThreadViewPost.Post
-				data["postView"] = postView
-				data["requestURI"] = fmt.Sprintf("https://%s%s", req.Host, req.URL.Path)
-				if postView.Embed != nil && postView.Embed.EmbedImages_View != nil {
-					data["imgThumbUrl"] = postView.Embed.EmbedImages_View.Images[0].Thumb
+			unauthedViewingOkay := true
+			for _, label := range pv.Labels {
+				if label.Src == pv.Did && label.Val == "!no-unauthenticated" {
+					unauthedViewingOkay = false
+				}
+			}
+
+			if unauthedViewingOkay {
+				did := pv.Did
+				data["did"] = did
+
+				// then fetch the post thread (with extra context)
+				uri := fmt.Sprintf("at://%s/app.bsky.feed.post/%s", did, rkey)
+				tpv, err := appbsky.FeedGetPostThread(ctx, srv.xrpcc, 1, uri)
+				if err != nil {
+					log.Warnf("failed to fetch post: %s\t%v", uri, err)
+				} else {
+					req := c.Request()
+					postView := tpv.Thread.FeedDefs_ThreadViewPost.Post
+					data["postView"] = postView
+					data["requestURI"] = fmt.Sprintf("https://%s%s", req.Host, req.URL.Path)
+					if postView.Embed != nil && postView.Embed.EmbedImages_View != nil {
+						data["imgThumbUrl"] = postView.Embed.EmbedImages_View.Images[0].Thumb
+					}
 				}
 			}
 		}
@@ -329,9 +338,17 @@ func (srv *Server) WebProfile(c echo.Context) error {
 		if err != nil {
 			log.Warnf("failed to fetch handle: %s\t%v", handle, err)
 		} else {
-			req := c.Request()
-			data["profileView"] = pv
-			data["requestURI"] = fmt.Sprintf("https://%s%s", req.Host, req.URL.Path)
+			unauthedViewingOkay := true
+			for _, label := range pv.Labels {
+				if label.Src == pv.Did && label.Val == "!no-unauthenticated" {
+					unauthedViewingOkay = false
+				}
+			}
+			if unauthedViewingOkay {
+				req := c.Request()
+				data["profileView"] = pv
+				data["requestURI"] = fmt.Sprintf("https://%s%s", req.Host, req.URL.Path)
+			}
 		}
 	}