block external profiles for unregistered users

web/src/routes/api/v1/profile/[handle]/+server.ts

@@ -1,4 +1,6 @@
+import { env } from '$env/dynamic/private';
 import type { Profile } from '$lib/models/profile';
+import { splitUsername } from '$lib/util/activitypub_util';
 import { handleError } from '$lib/util/api_util';
 import { error, json, type RequestEvent } from '@sveltejs/kit';
 
@@ -8,6 +10,10 @@ export async function GET(event: RequestEvent) {
         return error(400, { message: "Bad request" })
     }
 
+    if(splitUsername(handle)[1] !== env.ORIGIN && !event.locals.user) {
+        return error(401, { message: "Unauthorized" })
+    }
+
     try {
         const { actor, error } = await event.locals.pb.send(`/activitypub/actor?resource=acct:${handle}&follows=true`, { method: "GET", fetch: event.fetch, });