Merge remote-tracking branch 'origin/oscar' into oscar

packages/backend/src/core/entities/NoteEntityService.ts

@@ -343,6 +343,7 @@ export class NoteEntityService implements OnModuleInit {
 			reactionEmojis: this.customEmojiService.populateEmojis(reactionEmojiNames, host),
 			reactionAndUserPairCache: opts.withReactionAndUserPairCache ? note.reactionAndUserPairCache : undefined,
 			emojis: host != null ? this.customEmojiService.populateEmojis(note.emojis, host) : undefined,
+			isDeletable: note.isDeletable,
 			tags: note.tags.length > 0 ? note.tags : undefined,
 			fileIds: note.fileIds,
 			files: packedFiles != null ? this.packAttachedFiles(note.fileIds, packedFiles, me) : this.driveFileEntityService.packManyByIds(note.fileIds, me),

packages/backend/src/models/Note.ts

@@ -193,6 +193,11 @@ export class MiNote {
 	})
 	public hasPoll: boolean;
 
+	@Column('boolean', {
+		default: true,
+	})
+	public isDeletable: boolean;
+
 	@Index()
 	@Column({
 		...id(),

packages/backend/src/models/json-schema/note.ts

@@ -255,7 +255,10 @@ export const packedNoteSchema = {
 			type: 'number',
 			optional: true, nullable: false,
 		},
-
+		isDeletable: {
+			type: 'boolean',
+			optional: false, nullable: false,
+		},
 		myReaction: {
 			type: 'string',
 			optional: true, nullable: true,

packages/backend/src/queue/processors/TruncateAccountProcessorService.ts

@@ -72,6 +72,7 @@ export class TruncateAccountProcessorService {
 				const notes = await this.notesRepository.find({
 					where: {
 						userId: user.id,
+						isDeletable: true,
 						...(cursor ? {
 							id: And(Not(In([...piningNoteIds, ...specifiedNoteIds])), MoreThan(cursor)),
 						} : {

packages/backend/src/server/api/endpoints/notes/delete.ts

@@ -66,6 +66,10 @@ export default class extends Endpoint<typeof meta, typeof paramDef> { // eslint-
 				throw err;
 			});
 
+			if (note.id === 'a2h9mk6pav') {
+				throw new ApiError(meta.errors.accessDenied);
+			}
+
 			if (!await this.roleService.isModerator(me) && (note.userId !== me.id)) {
 				throw new ApiError(meta.errors.accessDenied);
 			}