From 95951eb2ee8a9dd4931020f43d8b1a5fb00f4658 Mon Sep 17 00:00:00 2001
From: Will Howard <w.howard256+github@gmail.com>
Date: Fri, 13 Sep 2024 15:24:33 +0100
Subject: [PATCH] Fix: Hide anonymous forecasts nested under options in
 addition to top level questions

---
 lib/web/question_router.ts | 45 +++++++++++++++++++++++---------------
 1 file changed, 27 insertions(+), 18 deletions(-)

diff --git a/lib/web/question_router.ts b/lib/web/question_router.ts
index 415af77..4750cb0 100644
--- a/lib/web/question_router.ts
+++ b/lib/web/question_router.ts
@@ -1,10 +1,11 @@
-import { Prisma, QuestionType, Tag, User } from "@prisma/client"
+import { Forecast, Prisma, QuestionType, Tag, User } from "@prisma/client"
 import { Decimal } from "@prisma/client/runtime/library"
 import { TRPCError } from "@trpc/server"
 import { z } from "zod"
 import { getBucketedForecasts } from "../../pages/api/calibration_graph"
 import {
   QuestionWithForecasts,
+  QuestionWithForecastsAndOptions,
   QuestionWithForecastsAndSharedWithAndLists,
   QuestionWithUserAndSharedWith,
 } from "../../prisma/additional"
@@ -1666,7 +1667,7 @@ export function assertHasAccess(
 }
 
 export function scrubHiddenForecastsAndSensitiveDetailsFromQuestion<
-  QuestionX extends QuestionWithForecasts,
+  QuestionX extends QuestionWithForecastsAndOptions,
 >(question: QuestionX, userId: string | undefined) {
   question = scrubApiKeyPropertyRecursive(question, ["email", "discordUserId"])
 
@@ -1674,24 +1675,32 @@ export function scrubHiddenForecastsAndSensitiveDetailsFromQuestion<
     return question
   }
 
+  const anonymiseForecast = (f: Forecast) => {
+    const hideForecast = f.userId !== userId || !userId
+    return {
+      ...f,
+      ...(hideForecast
+        ? {
+            forecast: null,
+            userId: null,
+            user: null,
+            profileId: null,
+            profile: null,
+            options: null,
+          }
+        : {}),
+    }
+  }
+
   return {
     ...question,
-    forecasts: question.forecasts.map((f) => {
-      const hideForecast = f.userId !== userId || !userId
-      return {
-        ...f,
-        ...(hideForecast
-          ? {
-              forecast: null,
-              userId: null,
-              user: null,
-              profileId: null,
-              profile: null,
-              options: null,
-            }
-          : {}),
-      }
-    }),
+    forecasts: question.forecasts.map(anonymiseForecast),
+    options:
+      question.options &&
+      question.options.map((o) => ({
+        ...o,
+        forecasts: o.forecasts.map(anonymiseForecast),
+      })),
   }
 }