Fixes outbox privacy

bookwyrm/models/user.py

@@ -111,6 +111,7 @@ class User(OrderedCollectionPageMixin, AbstractUser):
         queryset = Status.objects.filter(
             user=self,
             deleted=False,
+            privacy__in=['public', 'unlisted'],
         ).select_subclasses().order_by('-published_date')
         return self.to_ordered_collection(queryset, \
                 remote_id=self.outbox, **kwargs)

bookwyrm/outgoing.py

@@ -27,7 +27,6 @@ def outbox(request, username):
     ''' outbox for the requested user '''
     user = get_object_or_404(models.User, localname=username)
 
-    # collection overview
     return JsonResponse(
         user.to_outbox(**request.GET),
         encoder=activitypub.ActivityEncoder

bookwyrm/tests/test_outgoing.py

@@ -69,6 +69,24 @@ class Outgoing(TestCase):
         result = outgoing.outbox(request, 'rat')
         self.assertEqual(result.status_code, 405)
 
+    def test_outbox_privacy(self):
+        ''' don't show dms et cetera in outbox '''
+        models.Status.objects.create(
+            content='PRIVATE!!', user=self.local_user, privacy='direct')
+        models.Status.objects.create(
+            content='bffs ONLY', user=self.local_user, privacy='followers')
+        models.Status.objects.create(
+            content='unlisted status', user=self.local_user, privacy='unlisted')
+        models.Status.objects.create(
+            content='look at this', user=self.local_user, privacy='public')
+
+        request = self.factory.get('')
+        result = outgoing.outbox(request, 'mouse')
+        self.assertIsInstance(result, JsonResponse)
+        data = json.loads(result.content)
+        self.assertEqual(data['type'], 'OrderedCollection')
+        self.assertEqual(data['totalItems'], 2)
+
 
     def test_handle_follow(self):
         ''' send a follow request '''