feat: sync public links and phone change updates

internal/app/privacy/service.go

@@ -110,6 +110,21 @@ func (s *Service) CanSee(ctx context.Context, ownerUserID, viewerUserID int64, k
 	return Evaluate(rules, evalCtx), nil
 }
 
+// CanSeeAnonymous evaluates one owner's privacy rules for an unauthenticated
+// public-web viewer. Anonymous viewers are never contacts, premium users,
+// close friends, bots, or shared-chat participants; explicit allow-all and
+// disallow rules still retain their normal precedence through Evaluate.
+func (s *Service) CanSeeAnonymous(ctx context.Context, ownerUserID int64, key domain.PrivacyKey) (bool, error) {
+	if ownerUserID == 0 {
+		return false, nil
+	}
+	rules, err := s.GetRules(ctx, ownerUserID, key)
+	if err != nil {
+		return false, err
+	}
+	return Evaluate(rules, domain.PrivacyContext{OwnerUserID: ownerUserID}), nil
+}
+
 // CanSeeBatch 批量评估多个 owner 对同一 viewer 在多个 key 上的可见性，结果等价于对每个
 // (owner,key) 调一次 CanSee，但只用一次 ListPrivacyRules + 一次 GetReverseContacts + 内存
 // Evaluate（消除 projectBatch / fan-out 投影里 per-user 3×CanSee×2行 的 N+1）。返回

internal/app/privacy/service_test.go

@@ -34,6 +34,32 @@ func TestDefaultPrivacyRules(t *testing.T) {
 	}
 }
 
+func TestCanSeeAnonymousHonorsPublicOnlyRules(t *testing.T) {
+	ctx := context.Background()
+	store := memory.NewPrivacyStore()
+	svc := NewService(store, nil)
+	const ownerID int64 = 1001
+
+	if visible, err := svc.CanSeeAnonymous(ctx, ownerID, domain.PrivacyKeyAbout); err != nil || !visible {
+		t.Fatalf("default anonymous about visibility = %v, err=%v; want true", visible, err)
+	}
+	if _, err := svc.SetRules(ctx, ownerID, domain.PrivacyKeyProfilePhoto, []domain.PrivacyRule{{Kind: domain.PrivacyRuleAllowContacts}}); err != nil {
+		t.Fatalf("set contacts-only profile photo: %v", err)
+	}
+	if visible, err := svc.CanSeeAnonymous(ctx, ownerID, domain.PrivacyKeyProfilePhoto); err != nil || visible {
+		t.Fatalf("contacts-only anonymous photo visibility = %v, err=%v; want false", visible, err)
+	}
+	if _, err := svc.SetRules(ctx, ownerID, domain.PrivacyKeyProfilePhoto, []domain.PrivacyRule{
+		{Kind: domain.PrivacyRuleDisallowUsers, UserIDs: []int64{2002}},
+		{Kind: domain.PrivacyRuleAllowAll},
+	}); err != nil {
+		t.Fatalf("set public profile photo: %v", err)
+	}
+	if visible, err := svc.CanSeeAnonymous(ctx, ownerID, domain.PrivacyKeyProfilePhoto); err != nil || !visible {
+		t.Fatalf("allow-all anonymous photo visibility = %v, err=%v; want true", visible, err)
+	}
+}
+
 func TestAddAllowUserOverridesDisallowAll(t *testing.T) {
 	ctx := context.Background()
 	svc := NewService(memory.NewPrivacyStore(), memory.NewContactStore())