Filter preferences for app passwords (#1626)

filter preferences for app passwords
bluesky-social · Sep 18, 2023 · a441da8 · a441da8
1 parent 17ce804
commit a441da8
Showing 1 changed file with 8 additions and 1 deletion.
diff --git a/packages/pds/src/api/app/bsky/actor/getPreferences.ts b/packages/pds/src/api/app/bsky/actor/getPreferences.ts
@@ -1,15 +1,22 @@
 import { Server } from '../../../../lexicon'
 import AppContext from '../../../../context'
+import { AuthScope } from '../../../../auth'
 
 export default function (server: Server, ctx: AppContext) {
   server.app.bsky.actor.getPreferences({
     auth: ctx.accessVerifier,
     handler: async ({ auth }) => {
       const requester = auth.credentials.did
       const { services, db } = ctx
-      const preferences = await services
+      let preferences = await services
         .account(db)
         .getPreferences(requester, 'app.bsky')
+      if (auth.credentials.scope !== AuthScope.Access) {
+        // filter out personal details for app passwords
+        preferences = preferences.filter(
+          (pref) => pref.$type !== 'app.bsky.actor.defs#personalDetailsPref',
+        )
+      }
       return {
         encoding: 'application/json',
         body: { preferences },