Add a noindex HTTP header on unlisted resources

Signed-off-by: Thomas Citharel <tcit@tcit.fr>

lib/web/controllers/page_controller.ex

@@ -7,6 +7,7 @@ defmodule Mobilizon.Web.PageController do
   alias Mobilizon.Discussions.Comment
   alias Mobilizon.Events.Event
   alias Mobilizon.Federation.ActivityPub
+  alias Mobilizon.Posts.Post
   alias Mobilizon.Tombstone
   alias Mobilizon.Web.{ActivityPubController, Cache, PageController}
 
@@ -122,7 +123,9 @@ defmodule Mobilizon.Web.PageController do
             |> render(object_type, object: object)
 
           _ ->
-            render(conn, object_type, object: object)
+            conn
+            |> maybe_add_noindex_header(object)
+            |> render(object_type, object: object)
         end
 
       :remote ->
@@ -153,4 +156,16 @@ defmodule Mobilizon.Web.PageController do
 
   defp is_local?(%{local: local}), do: if(local, do: true, else: :remote)
   defp is_local?(_), do: false
+
+  defp maybe_add_noindex_header(conn, %Event{visibility: visibility})
+       when visibility != :public do
+    put_resp_header(conn, "x-robots-tag", "noindex")
+  end
+
+  defp maybe_add_noindex_header(conn, %Post{visibility: visibility})
+       when visibility != :public do
+    put_resp_header(conn, "x-robots-tag", "noindex")
+  end
+
+  defp maybe_add_noindex_header(conn, _), do: conn
 end

test/web/controllers/page_controller_test.exs

@@ -30,11 +30,18 @@ defmodule Mobilizon.Web.PageControllerTest do
   end
 
   test "GET /events/:uuid", %{conn: conn} do
-    event = insert(:event)
+    event = insert(:event, visibility: :public)
     conn = get(conn, Routes.page_url(Endpoint, :event, event.uuid))
     assert html_response(conn, 200) =~ event.title
   end
 
+  test "GET /events/:uuid with unlisted event", %{conn: conn} do
+    event = insert(:event, visibility: :unlisted)
+    conn = get(conn, Routes.page_url(Endpoint, :event, event.uuid))
+    assert html_response(conn, 200) =~ event.title
+    assert ["noindex"] == get_resp_header(conn, "x-robots-tag")
+  end
+
   test "GET /events/:uuid with not existing event", %{conn: conn} do
     conn = get(conn, Routes.page_url(Endpoint, :event, "not_existing_event"))
     assert html_response(conn, 404)