fix(labrinth): disclosure visibility (#7265)

apps/frontend/src/components/ui/project-settings/disclosures/form.ts

@@ -47,7 +47,7 @@ function createLockStatuses(
 	) as Record<DisclosureType, DisclosureLockStatus>
 
 	for (const disclosure of disclosures) {
-		lockStatuses[disclosure.type] = disclosure.lock_status
+		lockStatuses[disclosure.type] = disclosure.lock_status ?? 'unlocked'
 	}
 
 	return lockStatuses

apps/labrinth/src/models/v3/disclosures.rs

@@ -111,8 +111,10 @@ impl DisclosureLockStatus {
 pub struct ProjectDisclosureData {
     #[serde(flatten)]
     pub disclosure: ProjectDisclosure,
-    pub set_by_moderator: bool,
-    pub lock_status: DisclosureLockStatus,
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub set_by_moderator: Option<bool>,
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub lock_status: Option<DisclosureLockStatus>,
     pub updated_at: DateTime<Utc>,
     #[serde(skip_serializing_if = "Option::is_none")]
     pub updated_by: Option<UserId>,
@@ -124,16 +126,18 @@ impl ProjectDisclosureData {
     pub fn from_db(
         value: DBProjectDisclosure,
         viewer_is_moderator: bool,
+        viewer_is_member: bool,
     ) -> Self {
-        let updated_by = (!value.set_by_moderator || viewer_is_moderator)
-            .then_some(value.updated_by.into());
-
         Self {
             disclosure: value.disclosure,
-            set_by_moderator: value.set_by_moderator,
-            lock_status: value.lock_status,
+            set_by_moderator: (viewer_is_member || viewer_is_moderator)
+                .then_some(value.set_by_moderator),
+            lock_status: (viewer_is_member || viewer_is_moderator)
+                .then_some(value.lock_status),
             updated_at: value.updated_at,
-            updated_by,
+            updated_by: ((!value.set_by_moderator && viewer_is_member)
+                || viewer_is_moderator)
+                .then_some(value.updated_by.into()),
             deleted_at: value.deleted_at,
         }
     }

apps/labrinth/src/routes/v3/disclosures.rs

@@ -73,14 +73,15 @@ pub async fn get_project_disclosures(
     let viewer_is_moderator =
         user_option.as_ref().is_some_and(|user| user.role.is_mod());
 
-    let include_deleted = viewer_is_moderator
+    // Moderators can see regardless of membership, short circuit to avoid extra db call
+    let viewer_is_member = viewer_is_moderator
         || is_team_member_project(&project.inner, &user_option, &pool)
             .await
             .wrap_internal_err("failed to check project team membership")?;
 
     let disclosures = db_models::DBProjectDisclosure::get_many_for_project(
         project.inner.id,
-        include_deleted,
+        viewer_is_moderator || viewer_is_member,
         &***ro_pool,
     )
     .await
@@ -90,7 +91,11 @@ pub async fn get_project_disclosures(
         disclosures: disclosures
             .into_iter()
             .map(|disclosure| {
-                ProjectDisclosureData::from_db(disclosure, viewer_is_moderator)
+                ProjectDisclosureData::from_db(
+                    disclosure,
+                    viewer_is_moderator,
+                    viewer_is_member,
+                )
             })
             .collect(),
     }))