From b9adf46826a737d33289c72302ff09f5ac7917b3 Mon Sep 17 00:00:00 2001
From: wacpi <wacpi@users.noreply.github.com>
Date: Wed, 22 Jul 2026 04:02:19 +0800
Subject: [PATCH] fix: phone privacy check no longer bypassed for contacts

applyPrivacy() had '!phoneAllowed && !isContact' which meant
contacts always saw the phone number regardless of the user's
privacy settings (e.g. 'Nobody'). Removed the isContact bypass
so privacy rules are enforced for everyone.
---
 internal/app/userprojection/projection.go | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/internal/app/userprojection/projection.go b/internal/app/userprojection/projection.go
index 60fe7d19..053e6a3c 100644
--- a/internal/app/userprojection/projection.go
+++ b/internal/app/userprojection/projection.go
@@ -614,7 +614,7 @@ func applyPrivacy(ctx context.Context, privacy PrivacyEvaluator, viewerUserID in
 	if err != nil {
 		return domain.User{}, err
 	}
-	if !phoneAllowed && !isContact {
+	if !phoneAllowed {
 		user.Phone = ""
 	}
 	statusAllowed, err := canSee(domain.PrivacyKeyStatusTimestamp)