PATCH /api/threads/{id}/visibility

​

Authentication

sub | ClaimTypes.NameIdentifier → User UUID (required)

​

Path Parameters

​

Request Body

if (string.IsNullOrWhiteSpace(request?.Visibility)) {
    return BadRequest("Visibility is required");
}

var validVisibilities = new[] { "private", "public", "unlisted" };
if (!Array.Exists(validVisibilities, v => v == request.Visibility.ToLowerInvariant())) {
    return BadRequest("Invalid visibility");
}

curl -X PATCH 'http://localhost:5079/api/threads/f47ac10b-58cc-4372-a567-0e02b2c3d479/visibility' \
  -H 'Authorization: Bearer YOUR_JWT_TOKEN' \
  -H 'Content-Type: application/json' \
  -d '{"visibility": "public"}'

{
  "success": true,
  "message": "Thread visibility updated successfully",
  "visibility": "public"
}

​

Authorization

var thread = await _threadsService.GetThreadAsync(threadId);
if (thread == null) {
    return NotFound("Thread not found");
}

if (thread.UserId != userId) {
    return StatusCode(403, "Only the thread owner can change visibility");
}

• ONLY thread owner can change visibility (Line 369)
• Explicit message: “Only the thread owner can change visibility” (Line 375)
• No delegation or admin override

​

Side Effects

await _threadsService.UpdateThreadVisibilityAsync(threadId, request.Visibility);

• UPDATE threads SET visibility = {request.Visibility}, updated_at = NOW() WHERE thread_id = {threadId}

• Changing TO "private": Thread becomes owner-only
• Changing TO "public": Thread becomes publicly accessible (if public_sharing feature enabled)
• Changing TO "unlisted": Thread accessible via direct link (if public_sharing feature enabled)

• Existing messages/comparisons/votes unaffected
• Thread remains in owner’s thread list
• Share URLs become invalid/valid based on new visibility

​

Permissions

• Thread owner only

• Other authenticated users
• Public thread viewers
• Admins (not documented as exception)

​

Visibility Semantics

​

private

• Access: Owner only, always
• Feature Flag: Irrelevant (owner-only regardless)
• Sharing: Cannot be shared

​

public

• Access: Anyone if public_sharing = true, owner only if false
• Discovery: May be listed in public directories (implementation-dependent)
• Indexing: May be indexed by search engines

​

unlisted

• Access: Anyone with link if public_sharing = true, owner only if false
• Discovery: Not listed publicly
• Indexing: Implementation-dependent

​

Edge Cases

1. Thread doesn’t exist: 404 (Lines 359-367)
2. User is not owner: 403 (Lines 369-378)
3. Visibility is null: 400 (Lines 381-389)
4. Visibility is empty: 400 (Lines 381-389)
5. Invalid visibility value: 400 (Lines 391-400)
6. Case variations ("Public", "PUBLIC"): Accepted, lowercased (Line 392)
7. Same visibility as current: Update proceeds (no change detection)
8. Thread currently has public viewers: Changing to private immediately denies access

​

Error Conditions

catch (Exception ex) {
    return StatusCode(500, new { error = ex.Message, code = "VISIBILITY_UPDATE_ERROR" });
}

​

Behavioral Guarantees

• updated_at timestamp changes on every call
• Even if visibility unchanged

• Next GET request reflects new visibility
• Access control updated instantly

​

Validation Order

1. User ID from JWT (401 if missing)
2. Thread existence (404 if not found)
3. Ownership (403 if not owner)
4. Visibility value validation (400 if invalid)
5. Update execution (500 if fails)

​

Security Implications

• Changing private → public exposes thread to world (if feature enabled)
• No confirmation required
• No warning for sensitive content

• Private → public/unlisted is one-way exposure
• Changing back to private doesn’t “un-share” (content may be cached elsewhere)

• Changing public → private immediately denies access to non-owners
• No grace period

​

Feature Flag Dependency

​

Response Format

• Includes visibility field echoing normalized value (lowercased)
• Example: Request "PUBLIC" → Response "public"