Follower and following lists independently visible and revocable

A public follower list reveals a user's social graph to anyone who calls the API — who they follow exposes interests and associations; who follows them can reveal community membership. Users may have legitimate reasons to keep this information private: they may be following accounts related to health conditions, political views, or personal situations they haven't disclosed publicly. GDPR Art. 25's data minimization principle requires that social graph data not be exposed beyond what the user has authorized. OWASP A01:2021 applies when the API returns this data without checking visibility settings.

Add independent visibility flags to the users table and enforce them in every API route that returns follower or following lists. In src/app/api/users/[id]/followers/route.ts:

export async function GET(req: Request, { params }: { params: { id: string } }) {
  const { id: userId } = params;
  const requesterId = getRequesterId(req); // from session

  const user = await db.user.findUniqueOrThrow({ where: { id: userId } });

  if (!user.followers_list_visible && requesterId !== userId) {
    return new Response(JSON.stringify({ error: 'Follower list is private' }), { status: 403 });
  }

  const followers = await db.follow.findMany({ where: { followingId: userId } });
  return Response.json(followers);
}

Schema:

ALTER TABLE users
  ADD COLUMN followers_list_visible BOOLEAN NOT NULL DEFAULT true,
  ADD COLUMN following_list_visible BOOLEAN NOT NULL DEFAULT true;