Add check on activity visibility in sub notification

2 files changed, 15 insertions, 1 deletions

diff --git a/lib/pleroma/web/common_api/utils.ex b/lib/pleroma/web/common_api/utils.ex
index 4e0a6b2d9..a450a70c3 100644
--- a/lib/pleroma/web/common_api/utils.ex
+++ b/lib/pleroma/web/common_api/utils.ex
@@ -12,6 +12,7 @@ defmodule Pleroma.Web.CommonAPI.Utils do
   alias Pleroma.Repo
   alias Pleroma.User
   alias Pleroma.Web.ActivityPub.Utils
+  alias Pleroma.Web.ActivityPub.Visibility
   alias Pleroma.Web.Endpoint
   alias Pleroma.Web.MediaProxy
 
@@ -337,13 +338,14 @@ defmodule Pleroma.Web.CommonAPI.Utils do
 
   def maybe_notify_subscribers(
         recipients,
-        %Activity{data: %{"actor" => actor, "type" => type}}
+        %Activity{data: %{"actor" => actor, "type" => type}} = activity
       )
       when type == "Create" do
     with %User{} = user <- User.get_by_ap_id(actor) do
       subscriber_ids =
         user
         |> User.subscribers()
+        |> Enum.filter(&Visibility.visible_for_user?(activity, &1))
         |> Enum.map(& &1.ap_id)
 
       recipients ++ subscriber_ids
diff --git a/test/notification_test.exs b/test/notification_test.exs
index 8109623af..5727620c9 100644
--- a/test/notification_test.exs
+++ b/test/notification_test.exs
@@ -106,6 +106,18 @@ defmodule Pleroma.NotificationTest do
       {:ok, status} = TwitterAPI.create_status(user, %{"status" => "Akariiiin"})
       {:ok, [_notif]} = Notification.create_notifications(status)
     end
+
+    test "it doesn't create subscription notifications if the recipient cannot see the status" do
+      user = insert(:user)
+      subscriber = insert(:user)
+
+      User.subscribe(subscriber, user)
+
+      {:ok, status} =
+        TwitterAPI.create_status(user, %{"status" => "inwisible", "visibility" => "direct"})
+
+      assert {:ok, []} == Notification.create_notifications(status)
+    end
   end
 
   describe "get notification" do