Block/Mute Filtering in Feeds

Block enforcement applied only at the profile level but not the feed query means a blocked user's posts continue appearing in the blocker's feed — the block has the appearance of working while delivering no actual protection. This is OWASP A01 (Broken Access Control) and CWE-284: a declared access restriction not enforced at the data layer. GDPR Art. 25 requires that data minimization be built into the processing itself, not applied as a post-fetch client-side filter. Client-side filtering also leaks the count and shape of blocked content to the browser before suppression.

Add block and mute exclusions to the feed WHERE clause at query time in app/api/feed/route.ts. Load blocked and muted IDs once per request, then exclude them from the post filter — never rely on client-side filtering.

// app/api/feed/route.ts
export async function GET(req: Request) {
  const userId = getCurrentUserId()

  const [following, blocked, muted] = await Promise.all([
    db.follow.findMany({ where: { followerId: userId }, select: { followedId: true } }),
    db.block.findMany({ where: { blockerId: userId }, select: { blockedId: true } }),
    db.mute.findMany({ where: { muterId: userId }, select: { mutedId: true } })
  ])

  const excludedIds = [
    ...blocked.map(b => b.blockedId),
    ...muted.map(m => m.mutedId)
  ]

  const posts = await db.post.findMany({
    where: {
      userId: { in: following.map(f => f.followedId), notIn: excludedIds }
    },
    orderBy: { createdAt: 'desc' },
    take: 20
  })

  return Response.json(posts)
}