feat: 添加可见性过滤功能，支持按公开/私密筛选回声

Author: lin-snow

CHANGELOG.md

@@ -9,6 +9,10 @@ For releases prior to v4.6.5, see the [GitHub releases page](https://github.com/
 
 ## [Unreleased]
 
+### Added
+
+- **Quick search can now filter by visibility (public / private).** The command palette (⌘K) gains a three-state **Visibility** section — *All*, *Public only*, *Private only* — shown only to logged-in admins; anonymous visitors don't see it and the timeline behaves exactly as before. An active filter shows up as a clearable chip next to the search box, like date-range and tag filters. Server-side, `POST /api/echo/query` accepts an optional `private` boolean; requests without private-content permission have it silently ignored and keep getting public-only results, so nothing can leak.
+
 ### Changed
 
 - **Built-in MCP server upgraded to protocol revision `2026-07-28`** (latest MCP spec, replacing `2025-11-25`) — **breaking for legacy MCP clients**. The server is now stateless per the new spec: the `initialize` handshake is gone (replaced by `server/discover`), every request must carry `params._meta` protocol metadata plus the `MCP-Protocol-Version` / `Mcp-Method` / `Mcp-Name` headers (validated with HTTP 400 + `-32020`/`-32022` on mismatch), unknown methods return HTTP 404, results carry `resultType` and `_meta.serverInfo`, and discover/list/read results include cache hints (`ttlMs` + `cacheScope`). `GET /mcp` (old status endpoint) and `DELETE /mcp` now return 405. Clients must speak `2026-07-28` — official SDKs (TypeScript v2, Go v1.7+, Python, C# v2) handle this automatically; legacy `initialize` clients receive a diagnostic naming the supported version.

go.sum

@@ -159,8 +159,6 @@ github.com/google/go-tpm v0.9.8/go.mod h1:h9jEsEECg7gtLis0upRBQU+GhYVH6jMjrFxI8u
 github.com/google/go-tpm-tools v0.3.13-0.20230620182252-4639ecce2aba h1:qJEJcuLzH5KDR0gKc0zcktin6KSAwL7+jWKBYceddTc=
 github.com/google/go-tpm-tools v0.3.13-0.20230620182252-4639ecce2aba/go.mod h1:EFYHy8/1y2KfgTAsx7Luu7NGhoxtuVHnNo8jE7FikKc=
 github.com/google/gofuzz v1.0.0/go.mod h1:dBl0BpW6vV/+mYPU4Po3pmUjxk6FQPldtuIdl/M65Eg=
-github.com/google/subcommands v1.2.0 h1:vWQspBTo2nEqTUFita5/KeEWlUL8kQObDFbub/EN9oE=
-github.com/google/subcommands v1.2.0/go.mod h1:ZjhPrFU+Olkh9WazFPsl27BQ4UPiG37m3yTrtFlrHVk=
 github.com/google/uuid v1.6.0 h1:NIvaJDMOsjHA8n1jAhLSgzrAzy1Hgr+hNrb57e+94F0=
 github.com/google/uuid v1.6.0/go.mod h1:TIyPZe4MgqvfeYDBFedMoGGpEw/LqOeaOT+nhxU+yHo=
 github.com/google/wire v0.7.0 h1:JxUKI6+CVBgCO2WToKy/nQk0sS+amI9z9EjVmdaocj4=
@@ -308,8 +306,6 @@ golang.org/x/sys v0.47.0 h1:o7XGOvZQCADBQQ4Y7VNq2dRWQR7JmOUW8Kxx4ZsNgWs=
 golang.org/x/sys v0.47.0/go.mod h1:4GL1E5IUh+htKOUEOaiffhrAeqysfVGipDYzABqnCmw=
 golang.org/x/text v0.40.0 h1:Ub2Z6/xjgF1WrYQz2nuITOEegKFtiIy+rieRJ5lHZKs=
 golang.org/x/text v0.40.0/go.mod h1:hpnzDAfGV753zIKo+wk3u1bVKCGPbrnF7+7LBF/UHVY=
-golang.org/x/tools v0.47.0 h1:7Kn5x/d1svx/PzryTsqeoZN4TZwqeH5pGWjefhLi/1Q=
-golang.org/x/tools v0.47.0/go.mod h1:dFHnyTvFWY212G+h7ZY4Vsp/K3U4/7W9TyVaAul8uCA=
 google.golang.org/protobuf v1.36.11 h1:fV6ZwhNocDyBLK0dj+fg8ektcVegBBuEolpbTQyBNVE=
 google.golang.org/protobuf v1.36.11/go.mod h1:HTf+CrKn2C3g5S8VImy6tdcUvCska2kB7j23XfzDpco=
 gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=

internal/model/common/common_dto.go

@@ -26,6 +26,10 @@ type EchoQueryDto struct {
 	// 0 或负数视为未设置。
 	DateFrom int64 `json:"dateFrom"`
 	DateTo   int64 `json:"dateTo"`
+	// Private：按可见性过滤的三态开关。nil 表示不过滤（现状行为：admin 公开+私密
+	// 混合，匿名仅公开）；true 仅私密、false 仅公开。仅当 viewer 具备私密可见权限
+	// （admin）时生效，无权限的请求在仓储层被静默忽略、仍强制仅公开。
+	Private *bool `json:"private,omitempty"`
 	// UserID：按作者（echos.user_id）精确过滤。opt-in——空串表示不限定作者
 	// （公开 /echo/query 等调用方留空即保持原行为）；Copilot Chat 用它把检索
 	// 收口到当前对话用户本人发布的 Echo。不暴露给前端 JSON 契约，仅服务内部设置。

internal/openapi/openapi.yaml

@@ -374,6 +374,8 @@ components:
         pageSize:
           format: int64
           type: integer
+        private:
+          type: boolean
         search:
           type: string
         sortBy:

internal/repository/echo/echo.go

@@ -401,7 +401,10 @@ func (echoRepository *EchoRepository) QueryEchos(
 				Where("echo_tags.tag_id IN ?", queryDto.TagIDs)
 		}
 		if !showPrivate {
+			// 无私密可见权限：强制仅公开，dto.Private 被静默忽略（防泄漏兜底）。
 			db = db.Where("echos.private = ?", false)
+		} else if queryDto.Private != nil {
+			db = db.Where("echos.private = ?", *queryDto.Private)
 		}
 		if queryDto.UserID != "" {
 			db = db.Where("echos.user_id = ?", queryDto.UserID)

internal/repository/echo/query_echos_test.go

@@ -83,6 +83,41 @@ func TestEchoRepository_QueryEchos_PrivateFilter(t *testing.T) {
 		assert.Equal(t, int64(2), total)
 		assert.Len(t, echos, 2)
 	})
+
+	ptr := func(b bool) *bool { return &b }
+
+	t.Run("showPrivate=true + Private=true narrows to private only", func(t *testing.T) {
+		echos, total, err := repo.QueryEchos(
+			commonModel.EchoQueryDto{Page: 1, PageSize: 10, Private: ptr(true)},
+			true,
+		)
+		require.NoError(t, err)
+		assert.Equal(t, int64(1), total)
+		require.Len(t, echos, 1)
+		assert.Equal(t, "e-prv", echos[0].ID)
+	})
+
+	t.Run("showPrivate=true + Private=false narrows to public only", func(t *testing.T) {
+		echos, total, err := repo.QueryEchos(
+			commonModel.EchoQueryDto{Page: 1, PageSize: 10, Private: ptr(false)},
+			true,
+		)
+		require.NoError(t, err)
+		assert.Equal(t, int64(1), total)
+		require.Len(t, echos, 1)
+		assert.Equal(t, "e-pub", echos[0].ID)
+	})
+
+	t.Run("showPrivate=false ignores Private=true (anti-leak)", func(t *testing.T) {
+		echos, total, err := repo.QueryEchos(
+			commonModel.EchoQueryDto{Page: 1, PageSize: 10, Private: ptr(true)},
+			false,
+		)
+		require.NoError(t, err)
+		assert.Equal(t, int64(1), total)
+		require.Len(t, echos, 1)
+		assert.Equal(t, "e-pub", echos[0].ID)
+	})
 }
 
 func TestEchoRepository_QueryEchos_TagJoinDistinctCount(t *testing.T) {

web/src/locales/messages/de-DE.json

@@ -394,6 +394,11 @@
     "dateRangeLast7Days": "Letzte 7 Tage",
     "dateRangeLast30Days": "Letzte 30 Tage",
     "dateRangeThisYear": "Dieses Jahr",
+    "visibilityLabel": "Sichtbarkeit",
+    "visibilityAll": "Alle",
+    "visibilityPublic": "Nur öffentlich",
+    "visibilityPrivate": "Nur privat",
+    "activeChipVisibilityPrefix": "Sichtbarkeit",
     "tagsLabel": "Tags",
     "tagsHint": "Beliebiges passt",
     "tagsEmpty": "Noch keine Tags",

web/src/locales/messages/en-US.json

@@ -394,6 +394,11 @@
     "dateRangeLast7Days": "Last 7 days",
     "dateRangeLast30Days": "Last 30 days",
     "dateRangeThisYear": "This year",
+    "visibilityLabel": "Visibility",
+    "visibilityAll": "All",
+    "visibilityPublic": "Public only",
+    "visibilityPrivate": "Private only",
+    "activeChipVisibilityPrefix": "Visibility",
     "tagsLabel": "Tags",
     "tagsHint": "Match any",
     "tagsEmpty": "No tags yet",

web/src/locales/messages/ja-JP.json

@@ -394,6 +394,11 @@
     "dateRangeLast7Days": "直近 7 日",
     "dateRangeLast30Days": "直近 30 日",
     "dateRangeThisYear": "今年",
+    "visibilityLabel": "公開範囲",
+    "visibilityAll": "すべて",
+    "visibilityPublic": "公開のみ",
+    "visibilityPrivate": "非公開のみ",
+    "activeChipVisibilityPrefix": "公開範囲",
     "tagsLabel": "タグ",
     "tagsHint": "いずれか一致",
     "tagsEmpty": "タグがありません",

web/src/locales/messages/zh-CN.json

@@ -394,6 +394,11 @@
     "dateRangeLast7Days": "最近 7 天",
     "dateRangeLast30Days": "最近 30 天",
     "dateRangeThisYear": "今年",
+    "visibilityLabel": "可见性",
+    "visibilityAll": "全部",
+    "visibilityPublic": "仅公开",
+    "visibilityPrivate": "仅私密",
+    "activeChipVisibilityPrefix": "可见性",
     "tagsLabel": "标签",
     "tagsHint": "任一匹配",
     "tagsEmpty": "暂无标签",