Nachrichten: hidden User nur für Admins sichtbar

backend/src/tools/nachrichten/routes.js

@@ -39,7 +39,25 @@ router.post('/keys', authenticate, (req, res) => {
 
 // ── Users ─────────────────────────────────────────────────────────────────────
 router.get('/users', authenticate, (req, res) => {
-  const me = req.user.id;
+  const me      = req.user.id;
+  const isAdmin = req.user.role === 'admin';
+
+  // Admins sehen alle. Normale User sehen:
+  // - keine hidden User
+  // - wenn sie selbst hidden sind: nur Admins
+  const meUser = db.prepare('SELECT hidden FROM users WHERE id=?').get(me);
+  const isMeHidden = !!meUser?.hidden;
+
+  let whereExtra = '';
+  if (!isAdmin && isMeHidden) {
+    // Ich bin hidden → sehe nur Admins
+    whereExtra = "AND u.role = 'admin'";
+  } else if (!isAdmin) {
+    // Normaler User → sieht keine hidden User
+    whereExtra = "AND (u.hidden = 0 OR u.hidden IS NULL)";
+  }
+  // Admin → kein Filter
+
   const users = db.prepare(`
     SELECT u.id, u.username, uk.public_key,
       (SELECT COUNT(*) FROM messages
@@ -49,7 +67,7 @@ router.get('/users', authenticate, (req, res) => {
           OR (sender_id = ? AND recipient_id = u.id)) AS last_message_at
     FROM users u
     LEFT JOIN user_keys uk ON uk.user_id = u.id
-    WHERE u.id != ?
+    WHERE u.id != ? ${whereExtra}
     ORDER BY last_message_at DESC, u.username ASC
   `).all(me, me, me, me);
   res.json(users);