fix: raise Http404 on inaccessible posts

posts/api.py

@@ -25,7 +25,7 @@ def md_show_post(request, post_type, post_slug):
     if not post.is_public:
         access_denied = check_user_permissions(request, post=post)
         if access_denied:
-            raise ApiAuthRequired()
+            raise Http404()
 
     post_markdown = f"""# {post.title}\n\n{post.text}"""
 

posts/tests/test_views.py

@@ -49,6 +49,15 @@ def test_show_post(self):
 
             self.assertContains(response=response, text='', status_code=200)
 
+    def test_404_on_hidden_post(self):
+        post = self.creator.create_post(
+            is_visible=True,
+            is_public=False,
+        )
+        client = self._authorized_client(None)
+        response = client.get(self._post_url(post))
+        self.assertContains(response=response, text='', status_code=404)
+
     def test_show_draft_post(self):
         '''
         Is regression test for #545.

posts/views/posts.py

@@ -33,7 +33,7 @@ def show_post(request, post_type, post_slug):
     if not post.is_public:
         access_denied = check_user_permissions(request, post=post)
         if access_denied:
-            return access_denied
+            raise Http404()
 
     # record a new view
     last_view_at = None