Profile visibility enforced at three or more tiers at API layer

Profile visibility enforced only on the frontend is not enforced at all — any API client that bypasses the UI gets full profile data regardless of the user's privacy setting. OWASP A01:2021 (Broken Access Control) is the top web application vulnerability for exactly this reason. GDPR Art. 25 (privacy by design) requires access restriction to be a default, not an afterthought. A two-tier public/private model also fails users who want followers-only visibility, forcing them to choose between full exposure and full lockdown.

Add at least three visibility tiers to the users table and enforce the check in every API handler that returns profile data. Never rely on frontend filtering. In your profile API route (e.g., src/app/api/users/[id]/route.ts):

async function getUserProfile(requesterId: string, targetUserId: string) {
  const user = await db.user.findUnique({ where: { id: targetUserId } });
  const canView = await checkProfileVisibility(requesterId, targetUserId, user.profile_visibility);
  if (!canView) throw new ForbiddenError('Profile not accessible');
  return sanitizeProfile(user, requesterId);
}

Schema addition:

ALTER TABLE users ADD COLUMN profile_visibility VARCHAR(20)
  DEFAULT 'public'
  CHECK (profile_visibility IN ('public', 'friends_only', 'followers_only', 'private'));