From cb4f4f8125a971f5bcd7df54778b392a8d20a140 Mon Sep 17 00:00:00 2001
From: Christian Beutel <>
Date: Tue, 24 Jun 2025 15:15:35 +0200
Subject: [PATCH] fixes 404 for own private profile

---
 db/federation/actor.go | 11 ++++++-----
 db/main.go             | 10 +++++++++-
 2 files changed, 15 insertions(+), 6 deletions(-)

diff --git a/db/federation/actor.go b/db/federation/actor.go
index 65d7b520..c048f849 100644
--- a/db/federation/actor.go
+++ b/db/federation/actor.go
@@ -122,6 +122,7 @@ func assembleActor(dbActor *core.Record, app core.App, includeFollows bool) (*co
 		return nil, fmt.Errorf("ORIGIN environment variable not set")
 	}
 
+	private := false
 	if dbActor.GetBool("isLocal") {
 		user, err := app.FindRecordById("users", dbActor.GetString("user"))
 		if err != nil {
@@ -153,11 +154,7 @@ func assembleActor(dbActor *core.Record, app core.App, includeFollows bool) (*co
 		result := make(map[string]interface{})
 		json.Unmarshal([]byte(privacy), &result)
 
-		private := result["account"] == "private"
-
-		if private {
-			return nil, fmt.Errorf("profile is private")
-		}
+		private = result["account"] == "private"
 
 	} else {
 
@@ -219,6 +216,10 @@ func assembleActor(dbActor *core.Record, app core.App, includeFollows bool) (*co
 		return nil, err
 	}
 
+	if private {
+		return dbActor, fmt.Errorf("profile is private")
+	}
+
 	return dbActor, nil
 }
 
diff --git a/db/main.go b/db/main.go
index 09e59e19..45946acf 100644
--- a/db/main.go
+++ b/db/main.go
@@ -1050,11 +1050,19 @@ func registerRoutes(se *core.ServeEvent, client meilisearch.ServiceManager) {
 			actor, err = federation.GetActorByIRI(e.App, iri, follows)
 		}
 		if err != nil && actor == nil {
-			if strings.HasPrefix(err.Error(), "webfinger") || err.Error() == "profile is private" {
+			if strings.HasPrefix(err.Error(), "webfinger") {
 				return e.NotFoundError("Not found", err)
 			}
 			return err
 		} else if err != nil && actor != nil {
+			if err.Error() == "profile is private" {
+				// this is our own profile
+				if actor.GetString("user") == e.Auth.Id {
+					return e.JSON(http.StatusOK, map[string]any{"actor": actor, "error": nil})
+				} else {
+					return e.JSON(http.StatusNotFound, map[string]any{"error": "profile is private"})
+				}
+			}
 			// we could not fetch the remote actor so we return our local cached copy
 			return e.JSON(http.StatusOK, map[string]any{"actor": actor, "error": err.Error()})
 		}