From ff179a5d0d4f3a8f7743cd74b595f2c689003953 Mon Sep 17 00:00:00 2001
From: Dicken <webmaster@sermerpartydorf.de>
Date: Fri, 29 May 2026 09:38:03 +0200
Subject: [PATCH] =?UTF-8?q?Nachrichten:=20hidden=20User=20nur=20f=C3=BCr?=
 =?UTF-8?q?=20Admins=20sichtbar?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 backend/src/tools/nachrichten/routes.js | 22 ++++++++++++++++++++--
 1 file changed, 20 insertions(+), 2 deletions(-)

diff --git a/backend/src/tools/nachrichten/routes.js b/backend/src/tools/nachrichten/routes.js
index b084363..1c1e58c 100644
--- a/backend/src/tools/nachrichten/routes.js
+++ b/backend/src/tools/nachrichten/routes.js
@@ -39,7 +39,25 @@ router.post('/keys', authenticate, (req, res) => {
 
 // ── Users ─────────────────────────────────────────────────────────────────────
 router.get('/users', authenticate, (req, res) => {
-  const me = req.user.id;
+  const me      = req.user.id;
+  const isAdmin = req.user.role === 'admin';
+
+  // Admins sehen alle. Normale User sehen:
+  // - keine hidden User
+  // - wenn sie selbst hidden sind: nur Admins
+  const meUser = db.prepare('SELECT hidden FROM users WHERE id=?').get(me);
+  const isMeHidden = !!meUser?.hidden;
+
+  let whereExtra = '';
+  if (!isAdmin && isMeHidden) {
+    // Ich bin hidden → sehe nur Admins
+    whereExtra = "AND u.role = 'admin'";
+  } else if (!isAdmin) {
+    // Normaler User → sieht keine hidden User
+    whereExtra = "AND (u.hidden = 0 OR u.hidden IS NULL)";
+  }
+  // Admin → kein Filter
+
   const users = db.prepare(`
     SELECT u.id, u.username, uk.public_key,
       (SELECT COUNT(*) FROM messages
@@ -49,7 +67,7 @@ router.get('/users', authenticate, (req, res) => {
           OR (sender_id = ? AND recipient_id = u.id)) AS last_message_at
     FROM users u
     LEFT JOIN user_keys uk ON uk.user_id = u.id
-    WHERE u.id != ?
+    WHERE u.id != ? ${whereExtra}
     ORDER BY last_message_at DESC, u.username ASC
   `).all(me, me, me, me);
   res.json(users);