Stop whispers leaking into full-text search

[Shalom-Karr]

Problem

Whisper posts (staff-only / limited-audience posts from the mod-categories sub-plugin) were indexed into post_search_data like any other post. Discourse's Search#execute runs ts_query against that table before any per-user visibility check, so any user — including anonymous/incognito — could discover whisper text via /search. The is:unseen advanced filter widened the same hole.

Reported here: https://forums.jtechforums.org/t/whispers-being-indexed-in-search/7800 (reporter demoed pulling a private whisper by searching a word from it, then walking further into the message word-by-word).

Fix — at the DB level, per the reporter's own suggestion

The whisper text is removed from the search index entirely rather than filtered on top of an exposed index:

• SearchIndexerExtension (lib/discourse_mod_categories/search_indexer_extension.rb) — prepends SearchIndexer.index to skip whisper posts and delete any existing post_search_data row. If it's not in the index, no ts_query or advanced filter can reach it.
• Backfill migration (db/migrate/20260701000001_purge_whisper_post_search_data.rb) — one DELETE strips every already-indexed whisper on deploy, so the leak stops immediately without waiting for each post to be re-touched.
• SearchExtension (lib/discourse_mod_categories/search_extension.rb) — belt-and-suspenders post-filter on Search#execute that drops any whisper row that lingers (indexer race, backfill pending, or a term-less is:unseen browse that never hits the index) for non-audience viewers, while the audience still sees it.
• Convert-to-public wiring — update_post_whisper fires :mod_whisper_state_changed; arming wipes the index row, disarming (convert to public) re-indexes the now-public post so it becomes discoverable again.

Both layers no-op unless mod_whisper_enabled, and every new code path is wrapped in rescue StandardError → fall back to vanilla behavior, so a future Discourse refactor can't break search indexing or search itself.

Behavior / tradeoff

Whispers become undiscoverable via full-text search for everyone, including the audience — they still read whispers in the topic stream, this only removes the /search discovery path. That matches the reporter's suggested "quickest solution" and is strictly safer than leaving sensitive text in post_search_data behind a query-time WHERE clause (which is exactly what leaked through two separate code paths here).

Tests

spec/requests/whisper_search_leak_spec.rb covers:

• the index gate never writes / deletes a whisper's post_search_data row, still indexes public posts;
• strangers and anonymous users can't surface a whisper by its text;
• the query-time filter strips a lingering real row for non-audience while the audience still sees it;
• convert-to-public re-indexes and makes the post discoverable again.

Linting: syntax_tree (the formatter enforced by the lint job) passes on all changed Ruby files.

🤖 Generated with Claude Code