Disallow pinning someone else's post (bluesky-social#2840)

* Reapply "add failing test for pinning someone else's post" This reverts commit 16a2399. * make sure pinned post belongs to the person who pinned it * add snapshot * Use uriToDid --------- Co-authored-by: Eric Bailey <[email protected]>
rcombs · Oct 1, 2024 · a8c6b89 · a8c6b89
1 parent 023474c
commit a8c6b89
Show file tree

Hide file tree

Showing 3 changed files with 716 additions and 1 deletion.
diff --git a/packages/bsky/src/api/app/bsky/feed/getAuthorFeed.ts b/packages/bsky/src/api/app/bsky/feed/getAuthorFeed.ts
@@ -14,6 +14,7 @@ import {
 import { Views } from '../../../../views'
 import { DataPlaneClient } from '../../../../data-plane'
 import { parseString } from '../../../../hydration/util'
+import { uriToDid } from '../../../../util/uris'
 import { Actor } from '../../../../hydration/actor'
 import { FeedItem, Post } from '../../../../hydration/feed'
 import { FeedType } from '../../../../proto/bsky_pb'
@@ -82,7 +83,10 @@ export const skeleton = async (inputs: {
 
   const isFirstPageRequest = !params.cursor
   const shouldInsertPinnedPost =
-    isFirstPageRequest && params.includePins && !!actor.profile?.pinnedPost
+    isFirstPageRequest &&
+    params.includePins &&
+    !!actor.profile?.pinnedPost &&
+    uriToDid(actor.profile.pinnedPost.uri) === actor.did
 
   const res = await ctx.dataplane.getAuthorFeed({
     actorDid: did,