Mohammed Alaa Mohsen

class StoryQuerySet(models.QuerySet):
    """The one place that knows who may read a story."""

    def visible_to(self, user, *, with_own_unpublished=False):
        published = Q(status=Story.StatusChoices.PUBLISHED)
        public = Q(visibility=Story.VisibilityChoices.PUBLIC)
        if user is None or not user.is_authenticated:
            return self.filter(published & public)
        follows_author = Exists(
            Follow.objects.filter(follower=user, following=OuterRef("author_id"))
        )
        allowed = published & (public | Q(author=user) | Q(follows_author))
        if with_own_unpublished:
            allowed |= Q(author=user)
        return self.filter(allowed)

# Crawlers must be allowed to *fetch* the API; what they
# must not do is list its JSON as pages.
NOINDEX_PREFIXES = ("/api/", "/auth/", "/admin/")

class NoIndexApiMiddleware:
    def __call__(self, request):
        response = self.get_response(request)
        if request.path.startswith(NOINDEX_PREFIXES):
            response["X-Robots-Tag"] = "noindex, nofollow"
        return response

# A function is parsed whole before it runs, so the copy
# in memory is the one that finishes — even if `git pull`
# replaces this file midway.
set -euo pipefail

deploy() {
    $RUN_AS git -C "$APP" pull --ff-only
    $RUN_AS bash -c "cd '$APP/backend' && .venv/bin/python manage.py migrate"
    $RUN_AS bash -c "cd '$APP/frontend' && npm ci && npm run build"
    systemctl restart storyhub-web storyhub-worker
}

deploy "$@"