From 0af523ab33404dda23b51ea5781c3f38d2e41642 Mon Sep 17 00:00:00 2001
From: Val Alexander <bunsthedev@gmail.com>
Date: Wed, 3 Jun 2026 06:49:35 -0500
Subject: [PATCH 1/7] fix(help-center): enforce public category visibility

---
 .../help-center-article.query.test.ts         | 39 +++++++++++++--
 .../help-center-article.service.test.ts       | 49 +++++++++++++++++++
 .../help-center/help-center.article.query.ts  | 45 ++++++++++++++++-
 .../help-center.article.service.ts            | 12 +++++
 4 files changed, 140 insertions(+), 5 deletions(-)

diff --git a/apps/web/src/lib/server/domains/help-center/__tests__/help-center-article.query.test.ts b/apps/web/src/lib/server/domains/help-center/__tests__/help-center-article.query.test.ts
index 4b43db60f..298295dbe 100644
--- a/apps/web/src/lib/server/domains/help-center/__tests__/help-center-article.query.test.ts
+++ b/apps/web/src/lib/server/domains/help-center/__tests__/help-center-article.query.test.ts
@@ -34,7 +34,13 @@ vi.mock('@/lib/server/db', () => ({
       }),
     })),
   },
-  helpCenterCategories: { id: 'id', slug: 'slug', name: 'name' },
+  helpCenterCategories: {
+    id: 'id',
+    slug: 'slug',
+    name: 'name',
+    isPublic: 'is_public',
+    deletedAt: 'deleted_at',
+  },
   helpCenterArticles: {
     id: 'id',
     slug: 'slug',
@@ -71,6 +77,7 @@ vi.mock('@/lib/server/db', () => ({
 }))
 
 let listArticles: typeof import('../help-center.article.query').listArticles
+let listPublicArticles: typeof import('../help-center.article.query').listPublicArticles
 let listPublicArticlesForCategory: typeof import('../help-center.article.query').listPublicArticlesForCategory
 
 beforeEach(async () => {
@@ -78,6 +85,7 @@ beforeEach(async () => {
 
   const mod = await import('../help-center.article.query')
   listArticles = mod.listArticles
+  listPublicArticles = mod.listPublicArticles
   listPublicArticlesForCategory = mod.listPublicArticlesForCategory
 })
 
@@ -107,7 +115,8 @@ describe('listPublicArticlesForCategory', () => {
     const orderByMock = vi.fn().mockResolvedValue(mockArticles)
     const whereMock = vi.fn().mockReturnValue({ orderBy: orderByMock })
     const leftJoinMock = vi.fn().mockReturnValue({ where: whereMock })
-    const fromMock = vi.fn().mockReturnValue({ leftJoin: leftJoinMock })
+    const innerJoinMock = vi.fn().mockReturnValue({ leftJoin: leftJoinMock })
+    const fromMock = vi.fn().mockReturnValue({ innerJoin: innerJoinMock })
     vi.mocked(db.select).mockReturnValueOnce({ from: fromMock } as never)
 
     const result = await listPublicArticlesForCategory('category_1')
@@ -126,7 +135,8 @@ describe('listPublicArticlesForCategory', () => {
     const orderByMock = vi.fn().mockResolvedValue([])
     const whereMock = vi.fn().mockReturnValue({ orderBy: orderByMock })
     const leftJoinMock = vi.fn().mockReturnValue({ where: whereMock })
-    const fromMock = vi.fn().mockReturnValue({ leftJoin: leftJoinMock })
+    const innerJoinMock = vi.fn().mockReturnValue({ leftJoin: leftJoinMock })
+    const fromMock = vi.fn().mockReturnValue({ innerJoin: innerJoinMock })
     vi.mocked(db.select).mockReturnValueOnce({ from: fromMock } as never)
 
     const result = await listPublicArticlesForCategory('category_1')
@@ -134,6 +144,29 @@ describe('listPublicArticlesForCategory', () => {
   })
 })
 
+
+describe('listPublicArticles', () => {
+  it('returns no articles when the requested category is not public', async () => {
+    mockCategoryFindMany.mockResolvedValue([{ id: 'category_public' }])
+
+    const result = await listPublicArticles({ categoryId: 'category_hidden' })
+
+    expect(result).toEqual({ items: [], nextCursor: null, hasMore: false })
+    expect(mockArticleFindMany).not.toHaveBeenCalled()
+  })
+
+  it('restricts public article listings to public category IDs', async () => {
+    const { inArray } = await import('@/lib/server/db')
+    mockCategoryFindMany.mockResolvedValue([{ id: 'category_public' }])
+    mockArticleFindMany.mockResolvedValue([])
+
+    await listPublicArticles({ limit: 20 })
+
+    expect(mockArticleFindMany).toHaveBeenCalled()
+    expect(inArray).toHaveBeenCalledWith('category_id', ['category_public'])
+  })
+})
+
 describe('listArticles with showDeleted option', () => {
   it('returns deleted articles within the 30-day window', async () => {
     const recentDeletedAt = new Date(Date.now() - 3 * 24 * 60 * 60 * 1000)
diff --git a/apps/web/src/lib/server/domains/help-center/__tests__/help-center-article.service.test.ts b/apps/web/src/lib/server/domains/help-center/__tests__/help-center-article.service.test.ts
index fd9642715..02b930524 100644
--- a/apps/web/src/lib/server/domains/help-center/__tests__/help-center-article.service.test.ts
+++ b/apps/web/src/lib/server/domains/help-center/__tests__/help-center-article.service.test.ts
@@ -15,6 +15,7 @@ function createUpdateChain() {
     updateWhereCalls.push(args)
     return chain
   })
+  chain.catch = vi.fn().mockResolvedValue(undefined)
   chain.returning = vi.fn().mockResolvedValue([
     {
       id: 'article_1' as HelpCenterArticleId,
@@ -79,6 +80,8 @@ vi.mock('@/lib/server/db', () => ({
     id: 'id',
     slug: 'slug',
     name: 'name',
+    isPublic: 'is_public',
+    deletedAt: 'deleted_at',
   },
   helpCenterArticles: {
     id: 'id',
@@ -132,6 +135,7 @@ let unpublishArticle: typeof import('../help-center.article.service').unpublishA
 let deleteArticle: typeof import('../help-center.article.service').deleteArticle
 let restoreArticle: typeof import('../help-center.article.service').restoreArticle
 let recordArticleFeedback: typeof import('../help-center.article.service').recordArticleFeedback
+let getPublicArticleBySlug: typeof import('../help-center.article.service').getPublicArticleBySlug
 
 beforeEach(async () => {
   vi.clearAllMocks()
@@ -148,6 +152,7 @@ beforeEach(async () => {
   deleteArticle = mod.deleteArticle
   restoreArticle = mod.restoreArticle
   recordArticleFeedback = mod.recordArticleFeedback
+  getPublicArticleBySlug = mod.getPublicArticleBySlug
 })
 
 describe('getArticleById', () => {
@@ -195,6 +200,46 @@ describe('getArticleById', () => {
   })
 })
 
+
+describe('getPublicArticleBySlug', () => {
+  const publishedArticle = {
+    id: 'article_1' as HelpCenterArticleId,
+    slug: 'how-to-start',
+    title: 'How to Start',
+    content: 'Content here',
+    contentJson: null,
+    categoryId: 'category_1',
+    principalId: null,
+    publishedAt: new Date(),
+    viewCount: 5,
+    helpfulCount: 2,
+    notHelpfulCount: 0,
+    createdAt: new Date(),
+    updatedAt: new Date(),
+  }
+
+  it('returns a published article when its category is public', async () => {
+    mockArticleFindFirst.mockResolvedValue(publishedArticle)
+    mockCategoryFindFirst
+      .mockResolvedValueOnce({ id: 'category_1' })
+      .mockResolvedValueOnce({ id: 'category_1', slug: 'getting-started', name: 'Getting Started' })
+    mockPrincipalFindFirst.mockResolvedValue(null)
+
+    const result = await getPublicArticleBySlug('how-to-start')
+
+    expect(result.title).toBe('How to Start')
+  })
+
+  it('throws NotFoundError when the article category is not public', async () => {
+    mockArticleFindFirst.mockResolvedValue(publishedArticle)
+    mockCategoryFindFirst.mockResolvedValue(null)
+
+    await expect(getPublicArticleBySlug('how-to-start')).rejects.toMatchObject({
+      code: 'ARTICLE_NOT_FOUND',
+    })
+  })
+})
+
 describe('createArticle', () => {
   it('creates article with generated slug', async () => {
     const { db } = await import('@/lib/server/db')
@@ -317,6 +362,7 @@ describe('createArticle', () => {
     const { db } = await import('@/lib/server/db')
     const chain: Record<string, unknown> = {}
     chain.values = vi.fn(() => chain)
+    chain.catch = vi.fn().mockResolvedValue(undefined)
     chain.returning = vi.fn().mockResolvedValue([
       {
         id: 'article_new' as HelpCenterArticleId,
@@ -482,6 +528,7 @@ describe('updateArticle authorId validation', () => {
     const chain: Record<string, unknown> = {}
     chain.set = vi.fn(() => chain)
     chain.where = vi.fn(() => chain)
+    chain.catch = vi.fn().mockResolvedValue(undefined)
     chain.returning = vi.fn().mockResolvedValue([
       {
         id: 'article_1' as HelpCenterArticleId,
@@ -523,6 +570,7 @@ describe('updateArticle authorId validation', () => {
     const chain: Record<string, unknown> = {}
     chain.set = vi.fn(() => chain)
     chain.where = vi.fn(() => chain)
+    chain.catch = vi.fn().mockResolvedValue(undefined)
     chain.returning = vi.fn().mockResolvedValue([
       {
         id: 'article_1' as HelpCenterArticleId,
@@ -641,6 +689,7 @@ describe('restoreArticle', () => {
       return chain
     })
     chain.where = vi.fn().mockReturnValue(chain)
+    chain.catch = vi.fn().mockResolvedValue(undefined)
     chain.returning = vi.fn().mockResolvedValue([
       {
         id: 'article_1' as HelpCenterArticleId,
diff --git a/apps/web/src/lib/server/domains/help-center/help-center.article.query.ts b/apps/web/src/lib/server/domains/help-center/help-center.article.query.ts
index f3b07d264..83657f5ac 100644
--- a/apps/web/src/lib/server/domains/help-center/help-center.article.query.ts
+++ b/apps/web/src/lib/server/domains/help-center/help-center.article.query.ts
@@ -31,9 +31,12 @@ import type {
 // Article Queries
 // ============================================================================
 
-export async function listArticles(params: ListArticlesParams): Promise<ArticleListResult> {
+export async function listArticles(
+  params: ListArticlesParams & { categoryIds?: HelpCenterCategoryId[] }
+): Promise<ArticleListResult> {
   const {
     categoryId,
+    categoryIds: categoryIdsFilter,
     status = 'all',
     search,
     cursor,
@@ -54,6 +57,10 @@ export async function listArticles(params: ListArticlesParams): Promise<ArticleL
 
   if (categoryId) {
     conditions.push(eq(helpCenterArticles.categoryId, categoryId as HelpCenterCategoryId))
+  } else if (categoryIdsFilter?.length) {
+    conditions.push(
+      inArray(helpCenterArticles.categoryId, categoryIdsFilter as HelpCenterCategoryId[])
+    )
   }
 
   if (!showDeleted) {
@@ -182,16 +189,40 @@ export async function listArticles(params: ListArticlesParams): Promise<ArticleL
   }
 }
 
+async function listPublicCategoryIds(): Promise<HelpCenterCategoryId[]> {
+  const categories = await db.query.helpCenterCategories.findMany({
+    where: and(eq(helpCenterCategories.isPublic, true), isNull(helpCenterCategories.deletedAt)),
+    columns: { id: true },
+  })
+  return categories.map((category) => category.id as HelpCenterCategoryId)
+}
+
 export async function listPublicArticles(params: {
   categoryId?: string
   search?: string
   cursor?: string
   limit?: number
 }): Promise<ArticleListResult> {
-  return listArticles({ ...params, status: 'published' })
+  const publicCategoryIds = await listPublicCategoryIds()
+
+  if (params.categoryId && !publicCategoryIds.includes(params.categoryId as HelpCenterCategoryId)) {
+    return { items: [], nextCursor: null, hasMore: false }
+  }
+
+  if (!params.categoryId && publicCategoryIds.length === 0) {
+    return { items: [], nextCursor: null, hasMore: false }
+  }
+
+  return listArticles({
+    ...params,
+    categoryIds: params.categoryId ? undefined : publicCategoryIds,
+    status: 'published',
+  })
 }
 
 export async function listPublicArticlesForCategory(categoryId: string) {
+  const now = new Date()
+
   return db
     .select({
       id: helpCenterArticles.id,
@@ -205,11 +236,15 @@ export async function listPublicArticlesForCategory(categoryId: string) {
       authorAvatarUrl: principal.avatarUrl,
     })
     .from(helpCenterArticles)
+    .innerJoin(helpCenterCategories, eq(helpCenterCategories.id, helpCenterArticles.categoryId))
     .leftJoin(principal, eq(principal.id, helpCenterArticles.principalId))
     .where(
       and(
         eq(helpCenterArticles.categoryId, categoryId as HelpCenterCategoryId),
+        eq(helpCenterCategories.isPublic, true),
+        isNull(helpCenterCategories.deletedAt),
         isNotNull(helpCenterArticles.publishedAt),
+        lte(helpCenterArticles.publishedAt, now),
         isNull(helpCenterArticles.deletedAt)
       )
     )
@@ -219,6 +254,8 @@ export async function listPublicArticlesForCategory(categoryId: string) {
 export async function listPublicCategoryEditors(): Promise<
   Record<string, Array<{ name: string; avatarUrl: string | null }>>
 > {
+  const now = new Date()
+
   const rows = await db
     .select({
       categoryId: helpCenterArticles.categoryId,
@@ -227,10 +264,14 @@ export async function listPublicCategoryEditors(): Promise<
       avatarUrl: principal.avatarUrl,
     })
     .from(helpCenterArticles)
+    .innerJoin(helpCenterCategories, eq(helpCenterCategories.id, helpCenterArticles.categoryId))
     .innerJoin(principal, eq(principal.id, helpCenterArticles.principalId))
     .where(
       and(
+        eq(helpCenterCategories.isPublic, true),
+        isNull(helpCenterCategories.deletedAt),
         isNotNull(helpCenterArticles.publishedAt),
+        lte(helpCenterArticles.publishedAt, now),
         isNull(helpCenterArticles.deletedAt),
         inArray(principal.role, ['admin', 'member'])
       )
diff --git a/apps/web/src/lib/server/domains/help-center/help-center.article.service.ts b/apps/web/src/lib/server/domains/help-center/help-center.article.service.ts
index bf1350bfc..3b98dd64c 100644
--- a/apps/web/src/lib/server/domains/help-center/help-center.article.service.ts
+++ b/apps/web/src/lib/server/domains/help-center/help-center.article.service.ts
@@ -99,6 +99,18 @@ export async function getPublicArticleBySlug(slug: string): Promise<HelpCenterAr
     throw new NotFoundError('ARTICLE_NOT_FOUND', `Article not found`)
   }
 
+  const publicCategory = await db.query.helpCenterCategories.findFirst({
+    where: and(
+      eq(helpCenterCategories.id, article.categoryId),
+      eq(helpCenterCategories.isPublic, true),
+      isNull(helpCenterCategories.deletedAt)
+    ),
+    columns: { id: true },
+  })
+  if (!publicCategory) {
+    throw new NotFoundError('ARTICLE_NOT_FOUND', `Article not found`)
+  }
+
   // Increment view count (fire and forget)
   db.update(helpCenterArticles)
     .set({ viewCount: sql`${helpCenterArticles.viewCount} + 1` })

From bafccfe6acffa8a1281bd8a04dd69dafbad4c598 Mon Sep 17 00:00:00 2001
From: Val Alexander <bunsthedev@gmail.com>
Date: Wed, 3 Jun 2026 06:50:42 -0500
Subject: [PATCH 2/7] fix(help-center): enforce authenticated access

---
 .../src/lib/server/functions/help-center.ts   |  9 +++++++
 apps/web/src/lib/server/help-center-access.ts | 27 +++++++++++++++++++
 apps/web/src/routes/_portal/hc.tsx            | 23 +++++++++++++---
 .../v1/help/__tests__/categories.test.ts      |  4 +++
 .../api/public/v1/help/articles/$slug.ts      |  2 ++
 .../v1/help/articles/__tests__/$slug.test.ts  |  4 +++
 .../routes/api/public/v1/help/categories.ts   |  2 ++
 apps/web/src/routes/api/widget/kb-search.ts   |  6 +++--
 apps/web/src/routes/hc/sitemap[.]xml.ts       |  7 ++---
 9 files changed, 76 insertions(+), 8 deletions(-)
 create mode 100644 apps/web/src/lib/server/help-center-access.ts

diff --git a/apps/web/src/lib/server/functions/help-center.ts b/apps/web/src/lib/server/functions/help-center.ts
index 6b9327517..311586531 100644
--- a/apps/web/src/lib/server/functions/help-center.ts
+++ b/apps/web/src/lib/server/functions/help-center.ts
@@ -55,6 +55,7 @@ import {
 } from '@/lib/shared/schemas/help-center'
 import { z } from 'zod'
 import { toIsoString, toIsoStringOrNull } from '@/lib/shared/utils'
+import { requirePublicHelpCenterAccess } from '@/lib/server/help-center-access'
 
 // ============================================================================
 // Helper: serialize article dates
@@ -98,6 +99,7 @@ export const listCategoriesFn = createServerFn({ method: 'GET' })
 export const listPublicCategoriesFn = createServerFn({ method: 'GET' })
   .inputValidator(z.object({}))
   .handler(async () => {
+    await requirePublicHelpCenterAccess()
     const categories = await listPublicCategories()
     return categories.map(serializeCategory)
   })
@@ -113,6 +115,7 @@ export const getCategoryFn = createServerFn({ method: 'GET' })
 export const getPublicCategoryBySlugFn = createServerFn({ method: 'GET' })
   .inputValidator(getCategoryBySlugSchema)
   .handler(async ({ data }) => {
+    await requirePublicHelpCenterAccess()
     const category = await getCategoryBySlug(data.slug)
     return serializeCategory(category)
   })
@@ -189,6 +192,7 @@ export const restoreArticleFn = createServerFn({ method: 'POST' })
 export const listPublicArticlesFn = createServerFn({ method: 'GET' })
   .inputValidator(listPublicArticlesSchema)
   .handler(async ({ data }) => {
+    await requirePublicHelpCenterAccess()
     const result = await listPublicArticles(data)
     return {
       ...result,
@@ -199,6 +203,7 @@ export const listPublicArticlesFn = createServerFn({ method: 'GET' })
 export const listPublicArticlesForCategoryFn = createServerFn({ method: 'GET' })
   .inputValidator(z.object({ categoryId: z.string() }))
   .handler(async ({ data }) => {
+    await requirePublicHelpCenterAccess()
     const articles = await listPublicArticlesForCategory(data.categoryId)
     return articles.map((a) => ({
       ...a,
@@ -209,6 +214,7 @@ export const listPublicArticlesForCategoryFn = createServerFn({ method: 'GET' })
 export const listPublicCategoryEditorsFn = createServerFn({ method: 'GET' })
   .inputValidator(z.object({}))
   .handler(async () => {
+    await requirePublicHelpCenterAccess()
     return listPublicCategoryEditors()
   })
 
@@ -223,6 +229,7 @@ export const getArticleFn = createServerFn({ method: 'GET' })
 export const getPublicArticleBySlugFn = createServerFn({ method: 'GET' })
   .inputValidator(getArticleBySlugSchema)
   .handler(async ({ data }) => {
+    await requirePublicHelpCenterAccess()
     const article = await getPublicArticleBySlug(data.slug)
     const { helpfulCount: _h, notHelpfulCount: _n, ...publicArticle } = serializeArticle(article)
     return publicArticle
@@ -280,6 +287,7 @@ export const deleteArticleFn = createServerFn({ method: 'POST' })
 export const recordArticleFeedbackFn = createServerFn({ method: 'POST' })
   .inputValidator(articleFeedbackSchema)
   .handler(async ({ data }) => {
+    await requirePublicHelpCenterAccess()
     const auth = await getOptionalAuth()
     await recordArticleFeedback(
       data.articleId as HelpCenterArticleId,
@@ -298,6 +306,7 @@ export const searchPublicArticlesFn = createServerFn({ method: 'GET' })
     z.object({ query: z.string().min(1), limit: z.number().int().min(1).max(20).optional() })
   )
   .handler(async ({ data }) => {
+    await requirePublicHelpCenterAccess()
     const { hybridSearch } =
       await import('@/lib/server/domains/help-center/help-center-search.service')
     return hybridSearch(data.query, data.limit ?? 10)
diff --git a/apps/web/src/lib/server/help-center-access.ts b/apps/web/src/lib/server/help-center-access.ts
new file mode 100644
index 000000000..c66ab02e2
--- /dev/null
+++ b/apps/web/src/lib/server/help-center-access.ts
@@ -0,0 +1,27 @@
+import { getOptionalAuth } from '@/lib/server/functions/auth-helpers'
+import type { HelpCenterConfig } from '@/lib/server/domains/settings'
+import type { FeatureFlags } from '@/lib/server/domains/settings/settings.types'
+import { NotFoundError, UnauthorizedError } from '@/lib/shared/errors'
+
+type HelpCenterAccessConfig = HelpCenterConfig & {
+  access?: 'public' | 'authenticated'
+}
+
+export function requiresHelpCenterAuthentication(config: HelpCenterConfig | undefined): boolean {
+  return (config as HelpCenterAccessConfig | undefined)?.access === 'authenticated'
+}
+
+export async function requirePublicHelpCenterAccess(): Promise<void> {
+  const { getTenantSettings } = await import('@/lib/server/domains/settings/settings.service')
+  const settings = await getTenantSettings()
+  const flags = settings?.featureFlags as FeatureFlags | undefined
+  const helpCenterConfig = settings?.helpCenterConfig as HelpCenterConfig | undefined
+
+  if (!flags?.helpCenter || !helpCenterConfig?.enabled) {
+    throw new NotFoundError('HELP_CENTER_NOT_FOUND', 'Help center is not available')
+  }
+
+  if (requiresHelpCenterAuthentication(helpCenterConfig) && !(await getOptionalAuth())) {
+    throw new UnauthorizedError('Authentication required')
+  }
+}
diff --git a/apps/web/src/routes/_portal/hc.tsx b/apps/web/src/routes/_portal/hc.tsx
index b613e5680..0e3b81632 100644
--- a/apps/web/src/routes/_portal/hc.tsx
+++ b/apps/web/src/routes/_portal/hc.tsx
@@ -1,6 +1,14 @@
-import { createFileRoute, notFound, Outlet } from '@tanstack/react-router'
+import { createFileRoute, notFound, Outlet, redirect } from '@tanstack/react-router'
 import type { FeatureFlags, HelpCenterConfig } from '@/lib/shared/types/settings'
 
+type HelpCenterAccessConfig = HelpCenterConfig & {
+  access?: 'public' | 'authenticated'
+}
+
+function requiresAuthentication(config: HelpCenterConfig | undefined): boolean {
+  return (config as HelpCenterAccessConfig | undefined)?.access === 'authenticated'
+}
+
 export const Route = createFileRoute('/_portal/hc')({
   beforeLoad: ({ context }) => {
     const { settings } = context
@@ -10,14 +18,23 @@ export const Route = createFileRoute('/_portal/hc')({
 
     const helpCenterConfig = settings?.helpCenterConfig as HelpCenterConfig | undefined
     if (!helpCenterConfig?.enabled) throw notFound()
+
+    if (requiresAuthentication(helpCenterConfig) && !context.session?.user) {
+      throw redirect({ to: '/auth/login' })
+    }
   },
   loader: async ({ context }) => {
     const { settings } = context
     const helpCenterConfig = (settings?.helpCenterConfig as HelpCenterConfig | null) ?? null
     return { helpCenterConfig }
   },
-  head: () => {
-    return { meta: [] }
+  head: ({ loaderData }) => {
+    const helpCenterConfig = loaderData?.helpCenterConfig ?? undefined
+    return {
+      meta: requiresAuthentication(helpCenterConfig)
+        ? [{ name: 'robots', content: 'noindex, nofollow' }]
+        : [],
+    }
   },
   component: HelpCenterLayoutRoute,
 })
diff --git a/apps/web/src/routes/api/public/v1/help/__tests__/categories.test.ts b/apps/web/src/routes/api/public/v1/help/__tests__/categories.test.ts
index 3737c7d14..e19ddb519 100644
--- a/apps/web/src/routes/api/public/v1/help/__tests__/categories.test.ts
+++ b/apps/web/src/routes/api/public/v1/help/__tests__/categories.test.ts
@@ -6,6 +6,10 @@ vi.mock('@tanstack/react-router', () => ({
   createFileRoute: vi.fn(() => (opts: unknown) => ({ options: opts })),
 }))
 
+vi.mock('@/lib/server/help-center-access', () => ({
+  requirePublicHelpCenterAccess: vi.fn(async () => undefined),
+}))
+
 vi.mock('@/lib/server/domains/help-center/help-center.category.service', () => ({
   listPublicCategories: (...args: unknown[]) => mockListPublicCategories(...args),
 }))
diff --git a/apps/web/src/routes/api/public/v1/help/articles/$slug.ts b/apps/web/src/routes/api/public/v1/help/articles/$slug.ts
index ad2c7a66e..4ba095945 100644
--- a/apps/web/src/routes/api/public/v1/help/articles/$slug.ts
+++ b/apps/web/src/routes/api/public/v1/help/articles/$slug.ts
@@ -4,12 +4,14 @@ import {
   notFoundResponse,
   handleDomainError,
 } from '@/lib/server/domains/api/responses'
+import { requirePublicHelpCenterAccess } from '@/lib/server/help-center-access'
 
 export const Route = createFileRoute('/api/public/v1/help/articles/$slug')({
   server: {
     handlers: {
       GET: async ({ params }) => {
         try {
+          await requirePublicHelpCenterAccess()
           const { getPublicArticleBySlug } =
             await import('@/lib/server/domains/help-center/help-center.article.service')
           const article = await getPublicArticleBySlug(params.slug)
diff --git a/apps/web/src/routes/api/public/v1/help/articles/__tests__/$slug.test.ts b/apps/web/src/routes/api/public/v1/help/articles/__tests__/$slug.test.ts
index b1e9f9cdd..73ebd3ff1 100644
--- a/apps/web/src/routes/api/public/v1/help/articles/__tests__/$slug.test.ts
+++ b/apps/web/src/routes/api/public/v1/help/articles/__tests__/$slug.test.ts
@@ -6,6 +6,10 @@ vi.mock('@tanstack/react-router', () => ({
   createFileRoute: vi.fn(() => (opts: unknown) => ({ options: opts })),
 }))
 
+vi.mock('@/lib/server/help-center-access', () => ({
+  requirePublicHelpCenterAccess: vi.fn(async () => undefined),
+}))
+
 vi.mock('@/lib/server/domains/help-center/help-center.article.service', () => ({
   getPublicArticleBySlug: (...args: unknown[]) => mockGetPublicArticleBySlug(...args),
 }))
diff --git a/apps/web/src/routes/api/public/v1/help/categories.ts b/apps/web/src/routes/api/public/v1/help/categories.ts
index 8424e2453..a16bfaca4 100644
--- a/apps/web/src/routes/api/public/v1/help/categories.ts
+++ b/apps/web/src/routes/api/public/v1/help/categories.ts
@@ -1,11 +1,13 @@
 import { createFileRoute } from '@tanstack/react-router'
 import { successResponse, handleDomainError } from '@/lib/server/domains/api/responses'
+import { requirePublicHelpCenterAccess } from '@/lib/server/help-center-access'
 
 export const Route = createFileRoute('/api/public/v1/help/categories')({
   server: {
     handlers: {
       GET: async () => {
         try {
+          await requirePublicHelpCenterAccess()
           const { listPublicCategories } =
             await import('@/lib/server/domains/help-center/help-center.category.service')
           const categories = await listPublicCategories()
diff --git a/apps/web/src/routes/api/widget/kb-search.ts b/apps/web/src/routes/api/widget/kb-search.ts
index 31f6d8694..bdf6986a5 100644
--- a/apps/web/src/routes/api/widget/kb-search.ts
+++ b/apps/web/src/routes/api/widget/kb-search.ts
@@ -1,12 +1,14 @@
 import { createFileRoute } from '@tanstack/react-router'
-import { isFeatureEnabled } from '@/lib/server/domains/settings/settings.service'
 import { hybridSearch } from '@/lib/server/domains/help-center/help-center-search.service'
+import { requirePublicHelpCenterAccess } from '@/lib/server/help-center-access'
 
 export const Route = createFileRoute('/api/widget/kb-search')({
   server: {
     handlers: {
       GET: async ({ request }) => {
-        if (!(await isFeatureEnabled('helpCenter'))) {
+        try {
+          await requirePublicHelpCenterAccess()
+        } catch {
           return Response.json(
             { error: { code: 'NOT_FOUND', message: 'Knowledge base not found' } },
             { status: 404, headers: corsHeaders() }
diff --git a/apps/web/src/routes/hc/sitemap[.]xml.ts b/apps/web/src/routes/hc/sitemap[.]xml.ts
index 8b3f27e5d..fb8c0e7d6 100644
--- a/apps/web/src/routes/hc/sitemap[.]xml.ts
+++ b/apps/web/src/routes/hc/sitemap[.]xml.ts
@@ -1,23 +1,24 @@
 import { createFileRoute } from '@tanstack/react-router'
 import type { SitemapArticle } from '@/lib/shared/help-center-sitemap'
+import { requirePublicHelpCenterAccess } from '@/lib/server/help-center-access'
 
 export const Route = createFileRoute('/hc/sitemap.xml')({
   server: {
     handlers: {
       GET: async ({ request }) => {
         const [
-          { isFeatureEnabled },
           { listPublicCategories, listPublicArticles },
           { buildHelpCenterSitemapUrls },
           { renderSitemap },
         ] = await Promise.all([
-          import('@/lib/server/domains/settings/settings.service'),
           import('@/lib/server/domains/help-center/help-center.service'),
           import('@/lib/shared/help-center-sitemap'),
           import('@/lib/server/sitemap'),
         ])
 
-        if (!(await isFeatureEnabled('helpCenter'))) {
+        try {
+          await requirePublicHelpCenterAccess()
+        } catch {
           return new Response('Not Found', { status: 404 })
         }
 

From 49f70df0d72f87af91242fb3ce571ffff7e5acde Mon Sep 17 00:00:00 2001
From: Val Alexander <bunsthedev@gmail.com>
Date: Wed, 3 Jun 2026 07:00:43 -0500
Subject: [PATCH 3/7] fix: enforce public help-center category visibility

---
 .../help-center-article.query.test.ts         | 24 ++++++++++-
 .../help-center-article.service.test.ts       | 30 +++++++++++++
 .../help-center-category.service.test.ts      | 28 ++++++++++++
 .../help-center/help-center-search.service.ts |  3 ++
 .../help-center/help-center.article.query.ts  | 43 ++++++++++++++++++-
 .../help-center.article.service.ts            | 12 ++++++
 .../help-center.category.service.ts           | 14 ++++++
 .../src/lib/server/functions/help-center.ts   |  4 +-
 8 files changed, 153 insertions(+), 5 deletions(-)

diff --git a/apps/web/src/lib/server/domains/help-center/__tests__/help-center-article.query.test.ts b/apps/web/src/lib/server/domains/help-center/__tests__/help-center-article.query.test.ts
index 4b43db60f..b52c31cf3 100644
--- a/apps/web/src/lib/server/domains/help-center/__tests__/help-center-article.query.test.ts
+++ b/apps/web/src/lib/server/domains/help-center/__tests__/help-center-article.query.test.ts
@@ -4,6 +4,7 @@ import type { HelpCenterArticleId } from '@opencoven-feedback/ids'
 const mockArticleFindFirst = vi.fn()
 const mockArticleFindMany = vi.fn()
 const mockCategoryFindMany = vi.fn()
+const mockCategoryFindFirst = vi.fn()
 
 vi.mock('@/lib/server/db', () => ({
   db: {
@@ -13,6 +14,7 @@ vi.mock('@/lib/server/db', () => ({
         findMany: (...args: unknown[]) => mockArticleFindMany(...args),
       },
       helpCenterCategories: {
+        findFirst: (...args: unknown[]) => mockCategoryFindFirst(...args),
         findMany: (...args: unknown[]) => mockCategoryFindMany(...args),
       },
       principal: {
@@ -34,7 +36,13 @@ vi.mock('@/lib/server/db', () => ({
       }),
     })),
   },
-  helpCenterCategories: { id: 'id', slug: 'slug', name: 'name' },
+  helpCenterCategories: {
+    id: 'id',
+    slug: 'slug',
+    name: 'name',
+    isPublic: 'is_public',
+    deletedAt: 'deleted_at',
+  },
   helpCenterArticles: {
     id: 'id',
     slug: 'slug',
@@ -71,13 +79,16 @@ vi.mock('@/lib/server/db', () => ({
 }))
 
 let listArticles: typeof import('../help-center.article.query').listArticles
+let listPublicArticles: typeof import('../help-center.article.query').listPublicArticles
 let listPublicArticlesForCategory: typeof import('../help-center.article.query').listPublicArticlesForCategory
 
 beforeEach(async () => {
   vi.clearAllMocks()
+  mockCategoryFindFirst.mockResolvedValue({ id: 'category_1' })
 
   const mod = await import('../help-center.article.query')
   listArticles = mod.listArticles
+  listPublicArticles = mod.listPublicArticles
   listPublicArticlesForCategory = mod.listPublicArticlesForCategory
 })
 
@@ -134,6 +145,17 @@ describe('listPublicArticlesForCategory', () => {
   })
 })
 
+describe('listPublicArticles', () => {
+  it('does not return articles when no public categories exist', async () => {
+    mockCategoryFindMany.mockResolvedValueOnce([])
+
+    const result = await listPublicArticles({ search: 'private' })
+
+    expect(result).toEqual({ items: [], nextCursor: null, hasMore: false })
+    expect(mockArticleFindMany).not.toHaveBeenCalled()
+  })
+})
+
 describe('listArticles with showDeleted option', () => {
   it('returns deleted articles within the 30-day window', async () => {
     const recentDeletedAt = new Date(Date.now() - 3 * 24 * 60 * 60 * 1000)
diff --git a/apps/web/src/lib/server/domains/help-center/__tests__/help-center-article.service.test.ts b/apps/web/src/lib/server/domains/help-center/__tests__/help-center-article.service.test.ts
index fd9642715..435cf0b32 100644
--- a/apps/web/src/lib/server/domains/help-center/__tests__/help-center-article.service.test.ts
+++ b/apps/web/src/lib/server/domains/help-center/__tests__/help-center-article.service.test.ts
@@ -79,6 +79,8 @@ vi.mock('@/lib/server/db', () => ({
     id: 'id',
     slug: 'slug',
     name: 'name',
+    isPublic: 'is_public',
+    deletedAt: 'deleted_at',
   },
   helpCenterArticles: {
     id: 'id',
@@ -125,6 +127,7 @@ vi.mock('@/lib/server/markdown-tiptap', () => ({
 }))
 
 let getArticleById: typeof import('../help-center.article.service').getArticleById
+let getPublicArticleBySlug: typeof import('../help-center.article.service').getPublicArticleBySlug
 let createArticle: typeof import('../help-center.article.service').createArticle
 let updateArticle: typeof import('../help-center.article.service').updateArticle
 let publishArticle: typeof import('../help-center.article.service').publishArticle
@@ -141,6 +144,7 @@ beforeEach(async () => {
 
   const mod = await import('../help-center.article.service')
   getArticleById = mod.getArticleById
+  getPublicArticleBySlug = mod.getPublicArticleBySlug
   createArticle = mod.createArticle
   updateArticle = mod.updateArticle
   publishArticle = mod.publishArticle
@@ -195,6 +199,32 @@ describe('getArticleById', () => {
   })
 })
 
+describe('getPublicArticleBySlug', () => {
+  it('throws NotFoundError when the published article belongs to a private category', async () => {
+    mockArticleFindFirst.mockResolvedValue({
+      id: 'article_1' as HelpCenterArticleId,
+      slug: 'private-article',
+      title: 'Private Article',
+      content: 'Private content',
+      contentJson: null,
+      categoryId: 'category_private',
+      principalId: 'principal_1',
+      publishedAt: new Date(),
+      viewCount: 0,
+      helpfulCount: 0,
+      notHelpfulCount: 0,
+      createdAt: new Date(),
+      updatedAt: new Date(),
+    })
+    mockCategoryFindFirst.mockResolvedValue(null)
+
+    await expect(getPublicArticleBySlug('private-article')).rejects.toMatchObject({
+      code: 'ARTICLE_NOT_FOUND',
+    })
+    expect(updateSetCalls).toHaveLength(0)
+  })
+})
+
 describe('createArticle', () => {
   it('creates article with generated slug', async () => {
     const { db } = await import('@/lib/server/db')
diff --git a/apps/web/src/lib/server/domains/help-center/__tests__/help-center-category.service.test.ts b/apps/web/src/lib/server/domains/help-center/__tests__/help-center-category.service.test.ts
index 2c16b23a7..231a9efa4 100644
--- a/apps/web/src/lib/server/domains/help-center/__tests__/help-center-category.service.test.ts
+++ b/apps/web/src/lib/server/domains/help-center/__tests__/help-center-category.service.test.ts
@@ -119,6 +119,7 @@ let listCategories: typeof import('../help-center.category.service').listCategor
 let listPublicCategories: typeof import('../help-center.category.service').listPublicCategories
 let getCategoryById: typeof import('../help-center.category.service').getCategoryById
 let getCategoryBySlug: typeof import('../help-center.category.service').getCategoryBySlug
+let getPublicCategoryBySlug: typeof import('../help-center.category.service').getPublicCategoryBySlug
 let createCategory: typeof import('../help-center.category.service').createCategory
 let updateCategory: typeof import('../help-center.category.service').updateCategory
 let deleteCategory: typeof import('../help-center.category.service').deleteCategory
@@ -135,6 +136,7 @@ beforeEach(async () => {
   listPublicCategories = mod.listPublicCategories
   getCategoryById = mod.getCategoryById
   getCategoryBySlug = mod.getCategoryBySlug
+  getPublicCategoryBySlug = mod.getPublicCategoryBySlug
   createCategory = mod.createCategory
   updateCategory = mod.updateCategory
   deleteCategory = mod.deleteCategory
@@ -392,6 +394,32 @@ describe('getCategoryBySlug', () => {
   })
 })
 
+describe('getPublicCategoryBySlug', () => {
+  it('returns public categories by slug', async () => {
+    mockCategoryFindFirst.mockResolvedValue({
+      id: 'category_1' as HelpCenterCategoryId,
+      slug: 'getting-started',
+      name: 'Getting Started',
+      description: null,
+      isPublic: true,
+      position: 0,
+      createdAt: new Date(),
+      updatedAt: new Date(),
+    })
+
+    const result = await getPublicCategoryBySlug('getting-started')
+    expect(result.slug).toBe('getting-started')
+  })
+
+  it('throws NotFoundError when a category is not public', async () => {
+    mockCategoryFindFirst.mockResolvedValue(null)
+
+    await expect(getPublicCategoryBySlug('private-category')).rejects.toMatchObject({
+      code: 'CATEGORY_NOT_FOUND',
+    })
+  })
+})
+
 describe('createCategory', () => {
   it('creates a category with auto-generated slug', async () => {
     const result = await createCategory({ name: 'Getting Started' })
diff --git a/apps/web/src/lib/server/domains/help-center/help-center-search.service.ts b/apps/web/src/lib/server/domains/help-center/help-center-search.service.ts
index 66db7bcc9..dcf66245f 100644
--- a/apps/web/src/lib/server/domains/help-center/help-center-search.service.ts
+++ b/apps/web/src/lib/server/domains/help-center/help-center-search.service.ts
@@ -14,6 +14,7 @@ import {
   isNull,
   isNotNull,
   sql,
+  eq,
 } from '@/lib/server/db'
 import { generateKbEmbedding } from './help-center-embedding.service'
 
@@ -103,6 +104,7 @@ async function hybridQuery(
       and(
         isNotNull(helpCenterArticles.publishedAt),
         isNull(helpCenterArticles.deletedAt),
+        eq(helpCenterCategories.isPublic, true),
         isNull(helpCenterCategories.deletedAt),
         sql`(
           ${helpCenterArticles.searchVector} @@ ${tsQuery}
@@ -156,6 +158,7 @@ async function keywordOnlyQuery(query: string, limit: number): Promise<HybridSea
       and(
         isNotNull(helpCenterArticles.publishedAt),
         isNull(helpCenterArticles.deletedAt),
+        eq(helpCenterCategories.isPublic, true),
         isNull(helpCenterCategories.deletedAt),
         sql`${helpCenterArticles.searchVector} @@ ${tsQuery}`
       )
diff --git a/apps/web/src/lib/server/domains/help-center/help-center.article.query.ts b/apps/web/src/lib/server/domains/help-center/help-center.article.query.ts
index f3b07d264..f132b8fce 100644
--- a/apps/web/src/lib/server/domains/help-center/help-center.article.query.ts
+++ b/apps/web/src/lib/server/domains/help-center/help-center.article.query.ts
@@ -31,7 +31,17 @@ import type {
 // Article Queries
 // ============================================================================
 
-export async function listArticles(params: ListArticlesParams): Promise<ArticleListResult> {
+type InternalListArticlesParams = ListArticlesParams & { publicOnly?: boolean }
+
+async function listPublicCategoryIds(): Promise<HelpCenterCategoryId[]> {
+  const categories = await db.query.helpCenterCategories.findMany({
+    where: and(eq(helpCenterCategories.isPublic, true), isNull(helpCenterCategories.deletedAt)),
+    columns: { id: true },
+  })
+  return categories.map((cat) => cat.id as HelpCenterCategoryId)
+}
+
+export async function listArticles(params: InternalListArticlesParams): Promise<ArticleListResult> {
   const {
     categoryId,
     status = 'all',
@@ -40,6 +50,7 @@ export async function listArticles(params: ListArticlesParams): Promise<ArticleL
     limit = 20,
     showDeleted = false,
     sort = 'newest',
+    publicOnly = false,
   } = params
   const now = new Date()
 
@@ -52,6 +63,20 @@ export async function listArticles(params: ListArticlesParams): Promise<ArticleL
       ]
     : [isNull(helpCenterArticles.deletedAt)]
 
+  if (publicOnly) {
+    const publicCategoryIds = await listPublicCategoryIds()
+
+    if (categoryId && !publicCategoryIds.includes(categoryId as HelpCenterCategoryId)) {
+      return { items: [], nextCursor: null, hasMore: false }
+    }
+
+    if (publicCategoryIds.length === 0) {
+      return { items: [], nextCursor: null, hasMore: false }
+    }
+
+    conditions.push(inArray(helpCenterArticles.categoryId, publicCategoryIds))
+  }
+
   if (categoryId) {
     conditions.push(eq(helpCenterArticles.categoryId, categoryId as HelpCenterCategoryId))
   }
@@ -188,10 +213,20 @@ export async function listPublicArticles(params: {
   cursor?: string
   limit?: number
 }): Promise<ArticleListResult> {
-  return listArticles({ ...params, status: 'published' })
+  return listArticles({ ...params, status: 'published', publicOnly: true })
 }
 
 export async function listPublicArticlesForCategory(categoryId: string) {
+  const category = await db.query.helpCenterCategories.findFirst({
+    where: and(
+      eq(helpCenterCategories.id, categoryId as HelpCenterCategoryId),
+      eq(helpCenterCategories.isPublic, true),
+      isNull(helpCenterCategories.deletedAt)
+    ),
+    columns: { id: true },
+  })
+  if (!category) return []
+
   return db
     .select({
       id: helpCenterArticles.id,
@@ -219,6 +254,9 @@ export async function listPublicArticlesForCategory(categoryId: string) {
 export async function listPublicCategoryEditors(): Promise<
   Record<string, Array<{ name: string; avatarUrl: string | null }>>
 > {
+  const publicCategoryIds = await listPublicCategoryIds()
+  if (publicCategoryIds.length === 0) return {}
+
   const rows = await db
     .select({
       categoryId: helpCenterArticles.categoryId,
@@ -232,6 +270,7 @@ export async function listPublicCategoryEditors(): Promise<
       and(
         isNotNull(helpCenterArticles.publishedAt),
         isNull(helpCenterArticles.deletedAt),
+        inArray(helpCenterArticles.categoryId, publicCategoryIds),
         inArray(principal.role, ['admin', 'member'])
       )
     )
diff --git a/apps/web/src/lib/server/domains/help-center/help-center.article.service.ts b/apps/web/src/lib/server/domains/help-center/help-center.article.service.ts
index bf1350bfc..dc27873f1 100644
--- a/apps/web/src/lib/server/domains/help-center/help-center.article.service.ts
+++ b/apps/web/src/lib/server/domains/help-center/help-center.article.service.ts
@@ -99,6 +99,18 @@ export async function getPublicArticleBySlug(slug: string): Promise<HelpCenterAr
     throw new NotFoundError('ARTICLE_NOT_FOUND', `Article not found`)
   }
 
+  const category = await db.query.helpCenterCategories.findFirst({
+    where: and(
+      eq(helpCenterCategories.id, article.categoryId),
+      eq(helpCenterCategories.isPublic, true),
+      isNull(helpCenterCategories.deletedAt)
+    ),
+    columns: { id: true },
+  })
+  if (!category) {
+    throw new NotFoundError('ARTICLE_NOT_FOUND', `Article not found`)
+  }
+
   // Increment view count (fire and forget)
   db.update(helpCenterArticles)
     .set({ viewCount: sql`${helpCenterArticles.viewCount} + 1` })
diff --git a/apps/web/src/lib/server/domains/help-center/help-center.category.service.ts b/apps/web/src/lib/server/domains/help-center/help-center.category.service.ts
index cec9756e4..560b7b245 100644
--- a/apps/web/src/lib/server/domains/help-center/help-center.category.service.ts
+++ b/apps/web/src/lib/server/domains/help-center/help-center.category.service.ts
@@ -191,6 +191,20 @@ export async function getCategoryBySlug(slug: string): Promise<HelpCenterCategor
   return category
 }
 
+export async function getPublicCategoryBySlug(slug: string): Promise<HelpCenterCategory> {
+  const category = await db.query.helpCenterCategories.findFirst({
+    where: and(
+      eq(helpCenterCategories.slug, slug),
+      eq(helpCenterCategories.isPublic, true),
+      isNull(helpCenterCategories.deletedAt)
+    ),
+  })
+  if (!category) {
+    throw new NotFoundError('CATEGORY_NOT_FOUND', `Category with slug "${slug}" not found`)
+  }
+  return category
+}
+
 export async function createCategory(input: CreateCategoryInput): Promise<HelpCenterCategory> {
   const name = input.name?.trim()
   if (!name) throw new ValidationError('VALIDATION_ERROR', 'Name is required')
diff --git a/apps/web/src/lib/server/functions/help-center.ts b/apps/web/src/lib/server/functions/help-center.ts
index 6b9327517..9bac3603c 100644
--- a/apps/web/src/lib/server/functions/help-center.ts
+++ b/apps/web/src/lib/server/functions/help-center.ts
@@ -15,7 +15,7 @@ import {
   listPublicCategories,
   listPublicCategoryEditors,
   getCategoryById,
-  getCategoryBySlug,
+  getPublicCategoryBySlug,
   createCategory,
   updateCategory,
   deleteCategory,
@@ -113,7 +113,7 @@ export const getCategoryFn = createServerFn({ method: 'GET' })
 export const getPublicCategoryBySlugFn = createServerFn({ method: 'GET' })
   .inputValidator(getCategoryBySlugSchema)
   .handler(async ({ data }) => {
-    const category = await getCategoryBySlug(data.slug)
+    const category = await getPublicCategoryBySlug(data.slug)
     return serializeCategory(category)
   })
 

From 00d35276bde783566c3fc039af885d065674bb5b Mon Sep 17 00:00:00 2001
From: Val Alexander <bunsthedev@gmail.com>
Date: Fri, 5 Jun 2026 16:49:30 -0700
Subject: [PATCH 4/7] fix(portal): restrict similar posts to public boards

---
 apps/web/src/lib/server/functions/public-posts.ts | 8 ++++++--
 1 file changed, 6 insertions(+), 2 deletions(-)

diff --git a/apps/web/src/lib/server/functions/public-posts.ts b/apps/web/src/lib/server/functions/public-posts.ts
index b8693e8af..27427c73f 100644
--- a/apps/web/src/lib/server/functions/public-posts.ts
+++ b/apps/web/src/lib/server/functions/public-posts.ts
@@ -697,7 +697,7 @@ export const findSimilarPostsFn = createServerFn({ method: 'GET' })
   .handler(async ({ data }): Promise<SimilarPost[]> => {
     console.log(`[fn:public-posts] findSimilarPostsFn: title="${data.title.slice(0, 30)}..."`)
     try {
-      const { db, posts, boards, postStatuses, and, isNull, desc, sql, inArray } =
+      const { db, posts, boards, postStatuses, and, eq, isNull, desc, sql, inArray } =
         await import('@/lib/server/db')
       const { generateEmbedding } =
         await import('@/lib/server/domains/embeddings/embedding.service')
@@ -721,8 +721,10 @@ export const findSimilarPostsFn = createServerFn({ method: 'GET' })
             ),
         })
         .from(posts)
+        .innerJoin(boards, eq(posts.boardId, boards.id))
         .where(
           and(
+            eq(boards.isPublic, true),
             isNull(posts.deletedAt),
             isNull(posts.canonicalPostId),
             sql`${posts.searchVector} @@ plainto_tsquery('english', ${searchQuery})`
@@ -751,8 +753,10 @@ export const findSimilarPostsFn = createServerFn({ method: 'GET' })
               score: sql<number>`1 - (${posts.embedding} <=> ${vectorStr}::vector)`.as('score'),
             })
             .from(posts)
+            .innerJoin(boards, eq(posts.boardId, boards.id))
             .where(
               and(
+                eq(boards.isPublic, true),
                 isNull(posts.deletedAt),
                 isNull(posts.canonicalPostId),
                 sql`${posts.embedding} IS NOT NULL`,
@@ -831,7 +835,7 @@ export const findSimilarPostsFn = createServerFn({ method: 'GET' })
         db
           .select({ id: boards.id, slug: boards.slug })
           .from(boards)
-          .where(inArray(boards.id, boardIds)),
+          .where(and(inArray(boards.id, boardIds), eq(boards.isPublic, true))),
       ])
 
       const statusMap = new Map(statusesResult.map((s) => [String(s.id), s]))

From 81608420496a4b8a72781dd21fd88c85173e7447 Mon Sep 17 00:00:00 2001
From: Val Alexander <bunsthedev@gmail.com>
Date: Fri, 5 Jun 2026 16:42:24 -0700
Subject: [PATCH 5/7] fix: harden help center MCP and JSON-LD

---
 apps/web/src/components/json-ld.tsx           |  4 +++-
 apps/web/src/lib/server/mcp/tools.ts          | 20 ++++++++++++++++---
 .../__tests__/json-ld-serialization.test.ts   | 16 +++++++++++++++
 .../src/lib/shared/json-ld-serialization.ts   | 14 +++++++++++++
 4 files changed, 50 insertions(+), 4 deletions(-)
 create mode 100644 apps/web/src/lib/shared/__tests__/json-ld-serialization.test.ts
 create mode 100644 apps/web/src/lib/shared/json-ld-serialization.ts

diff --git a/apps/web/src/components/json-ld.tsx b/apps/web/src/components/json-ld.tsx
index a74cbea86..9db28b5ac 100644
--- a/apps/web/src/components/json-ld.tsx
+++ b/apps/web/src/components/json-ld.tsx
@@ -1,9 +1,11 @@
+import { serializeJsonLd } from '@/lib/shared/json-ld-serialization'
+
 /**
  * JsonLd - Renders a <script type="application/ld+json"> tag for structured data.
  * Use inside component bodies since TanStack Router head() doesn't support script injection.
  */
 export function JsonLd({ data }: { data: Record<string, unknown> }) {
   return (
-    <script type="application/ld+json" dangerouslySetInnerHTML={{ __html: JSON.stringify(data) }} />
+    <script type="application/ld+json" dangerouslySetInnerHTML={{ __html: serializeJsonLd(data) }} />
   )
 }
diff --git a/apps/web/src/lib/server/mcp/tools.ts b/apps/web/src/lib/server/mcp/tools.ts
index bf5205da9..0f87464a3 100644
--- a/apps/web/src/lib/server/mcp/tools.ts
+++ b/apps/web/src/lib/server/mcp/tools.ts
@@ -68,7 +68,7 @@ import {
   removePostFromRoadmap,
 } from '@/lib/server/domains/roadmaps/roadmap.service'
 import { getTypeIdPrefix, isTypeId, isValidTypeId } from '@opencoven-feedback/ids'
-import { isTeamMember } from '@/lib/shared/roles'
+import { isAdmin, isTeamMember } from '@/lib/shared/roles'
 import { truncate } from '@/lib/shared/utils/string'
 import {
   listArticles,
@@ -189,10 +189,24 @@ async function requireHelpCenter(): Promise<CallToolResult | null> {
   }
 }
 
-/** Combined gate: feature flag + scope + team role for help center write tools. */
+/** Return an error if the user doesn't have an admin role. */
+function requireAdminRole(auth: McpAuthContext): CallToolResult | null {
+  if (isAdmin(auth.role)) return null
+  return {
+    isError: true,
+    content: [
+      {
+        type: 'text',
+        text: 'Error: This operation requires an admin role.',
+      },
+    ],
+  }
+}
+
+/** Combined gate: feature flag + scope + admin role for help center write tools. */
 async function requireHelpCenterWrite(auth: McpAuthContext): Promise<CallToolResult | null> {
   return (
-    (await requireHelpCenter()) ?? requireScope(auth, 'write:help-center') ?? requireTeamRole(auth)
+    (await requireHelpCenter()) ?? requireScope(auth, 'write:help-center') ?? requireAdminRole(auth)
   )
 }
 
diff --git a/apps/web/src/lib/shared/__tests__/json-ld-serialization.test.ts b/apps/web/src/lib/shared/__tests__/json-ld-serialization.test.ts
new file mode 100644
index 000000000..31234f7f7
--- /dev/null
+++ b/apps/web/src/lib/shared/__tests__/json-ld-serialization.test.ts
@@ -0,0 +1,16 @@
+import { describe, expect, it } from 'vitest'
+import { serializeJsonLd } from '../json-ld-serialization'
+
+describe('serializeJsonLd', () => {
+  it('escapes script-breaking characters while preserving JSON values', () => {
+    const payload = '</script><script>alert(1)</script>&'
+
+    const result = serializeJsonLd({ headline: payload })
+
+    expect(result).not.toContain('</script>')
+    expect(result).not.toContain('<script>')
+    expect(result).toContain('\\u003c/script\\u003e\\u003cscript\\u003e')
+    expect(result).toContain('\\u0026')
+    expect(JSON.parse(result).headline).toBe(payload)
+  })
+})
diff --git a/apps/web/src/lib/shared/json-ld-serialization.ts b/apps/web/src/lib/shared/json-ld-serialization.ts
new file mode 100644
index 000000000..20349d163
--- /dev/null
+++ b/apps/web/src/lib/shared/json-ld-serialization.ts
@@ -0,0 +1,14 @@
+export function serializeJsonLd(data: Record<string, unknown>): string {
+  return JSON.stringify(data).replace(/[<>&]/g, (character) => {
+    switch (character) {
+      case '<':
+        return '\\u003c'
+      case '>':
+        return '\\u003e'
+      case '&':
+        return '\\u0026'
+      default:
+        return character
+    }
+  })
+}

From cbf61937083a1d28b7012dbce7d9701f088e93d8 Mon Sep 17 00:00:00 2001
From: "copilot-swe-agent[bot]" <198982749+Copilot@users.noreply.github.com>
Date: Sat, 6 Jun 2026 19:09:08 +0000
Subject: [PATCH 6/7] test: add MCP help-center admin gate regression coverage

---
 apps/web/src/components/json-ld.tsx           |   5 +-
 .../lib/server/mcp/__tests__/handler.test.ts  | 200 ++++++++++++++++++
 2 files changed, 204 insertions(+), 1 deletion(-)

diff --git a/apps/web/src/components/json-ld.tsx b/apps/web/src/components/json-ld.tsx
index 9db28b5ac..8beeab1c1 100644
--- a/apps/web/src/components/json-ld.tsx
+++ b/apps/web/src/components/json-ld.tsx
@@ -6,6 +6,9 @@ import { serializeJsonLd } from '@/lib/shared/json-ld-serialization'
  */
 export function JsonLd({ data }: { data: Record<string, unknown> }) {
   return (
-    <script type="application/ld+json" dangerouslySetInnerHTML={{ __html: serializeJsonLd(data) }} />
+    <script
+      type="application/ld+json"
+      dangerouslySetInnerHTML={{ __html: serializeJsonLd(data) }}
+    />
   )
 }
diff --git a/apps/web/src/lib/server/mcp/__tests__/handler.test.ts b/apps/web/src/lib/server/mcp/__tests__/handler.test.ts
index 54efdba70..0b53b9576 100644
--- a/apps/web/src/lib/server/mcp/__tests__/handler.test.ts
+++ b/apps/web/src/lib/server/mcp/__tests__/handler.test.ts
@@ -52,6 +52,7 @@ vi.mock('@/lib/server/domains/settings/settings.service', () => ({
     .fn()
     .mockResolvedValue({ mcpEnabled: true, mcpPortalAccessEnabled: false }),
   getTenantSettings: vi.fn().mockResolvedValue(null),
+  isFeatureEnabled: vi.fn().mockResolvedValue(true),
 }))
 
 // Mock config so baseUrl is available (used in WWW-Authenticate header)
@@ -213,6 +214,128 @@ vi.mock('@/lib/server/domains/changelog/changelog.query', () => ({
   }),
 }))
 
+vi.mock('@/lib/server/domains/help-center/help-center.service', () => ({
+  listArticles: vi.fn().mockResolvedValue({ items: [], nextCursor: null, hasMore: false }),
+  getArticleById: vi.fn().mockResolvedValue({
+    id: 'article_test',
+    slug: 'getting-started',
+    title: 'Getting Started',
+    content: 'Welcome',
+    description: null,
+    position: 1,
+    category: { id: 'category_test', slug: 'guides', name: 'Guides' },
+    author: { id: 'principal_test', name: 'Jane Admin', avatarUrl: null },
+    publishedAt: null,
+    viewCount: 0,
+    helpfulCount: 0,
+    notHelpfulCount: 0,
+    createdAt: new Date('2026-01-01'),
+    updatedAt: new Date('2026-01-01'),
+  }),
+  getCategoryById: vi.fn().mockResolvedValue({
+    id: 'category_test',
+    slug: 'guides',
+    name: 'Guides',
+    description: null,
+    icon: '📚',
+    parentId: null,
+    isPublic: true,
+    position: 1,
+    createdAt: new Date('2026-01-01'),
+    updatedAt: new Date('2026-01-01'),
+  }),
+  createArticle: vi.fn().mockResolvedValue({
+    id: 'article_test',
+    slug: 'getting-started',
+    title: 'Getting Started',
+    content: 'Welcome',
+    description: null,
+    position: 1,
+    category: { id: 'category_test', slug: 'guides', name: 'Guides' },
+    author: { id: 'principal_test', name: 'Jane Admin', avatarUrl: null },
+    publishedAt: null,
+    viewCount: 0,
+    helpfulCount: 0,
+    notHelpfulCount: 0,
+    createdAt: new Date('2026-01-01'),
+    updatedAt: new Date('2026-01-01'),
+  }),
+  updateArticle: vi.fn().mockResolvedValue({
+    id: 'article_test',
+    slug: 'getting-started',
+    title: 'Updated',
+    content: 'Updated content',
+    description: null,
+    position: 1,
+    category: { id: 'category_test', slug: 'guides', name: 'Guides' },
+    author: { id: 'principal_test', name: 'Jane Admin', avatarUrl: null },
+    publishedAt: null,
+    viewCount: 0,
+    helpfulCount: 0,
+    notHelpfulCount: 0,
+    createdAt: new Date('2026-01-01'),
+    updatedAt: new Date('2026-01-02'),
+  }),
+  publishArticle: vi.fn().mockResolvedValue({
+    id: 'article_test',
+    slug: 'getting-started',
+    title: 'Getting Started',
+    content: 'Welcome',
+    description: null,
+    position: 1,
+    category: { id: 'category_test', slug: 'guides', name: 'Guides' },
+    author: { id: 'principal_test', name: 'Jane Admin', avatarUrl: null },
+    publishedAt: new Date('2026-01-02'),
+    viewCount: 0,
+    helpfulCount: 0,
+    notHelpfulCount: 0,
+    createdAt: new Date('2026-01-01'),
+    updatedAt: new Date('2026-01-02'),
+  }),
+  unpublishArticle: vi.fn().mockResolvedValue({
+    id: 'article_test',
+    slug: 'getting-started',
+    title: 'Getting Started',
+    content: 'Welcome',
+    description: null,
+    position: 1,
+    category: { id: 'category_test', slug: 'guides', name: 'Guides' },
+    author: { id: 'principal_test', name: 'Jane Admin', avatarUrl: null },
+    publishedAt: null,
+    viewCount: 0,
+    helpfulCount: 0,
+    notHelpfulCount: 0,
+    createdAt: new Date('2026-01-01'),
+    updatedAt: new Date('2026-01-02'),
+  }),
+  deleteArticle: vi.fn().mockResolvedValue(undefined),
+  createCategory: vi.fn().mockResolvedValue({
+    id: 'category_test',
+    slug: 'guides',
+    name: 'Guides',
+    description: null,
+    icon: '📚',
+    parentId: null,
+    isPublic: true,
+    position: 1,
+    createdAt: new Date('2026-01-01'),
+    updatedAt: new Date('2026-01-01'),
+  }),
+  updateCategory: vi.fn().mockResolvedValue({
+    id: 'category_test',
+    slug: 'guides',
+    name: 'Updated Guides',
+    description: null,
+    icon: '📚',
+    parentId: null,
+    isPublic: true,
+    position: 1,
+    createdAt: new Date('2026-01-01'),
+    updatedAt: new Date('2026-01-02'),
+  }),
+  deleteCategory: vi.fn().mockResolvedValue(undefined),
+}))
+
 vi.mock('@/lib/server/domains/changelog/changelog.service', () => ({
   createChangelog: vi.fn().mockResolvedValue({
     id: 'changelog_new',
@@ -1677,6 +1800,83 @@ describe('MCP HTTP Handler', () => {
       expect(body.result.content[0].text).toContain('team member')
     })
 
+    it('should deny help center write tools for non-admin OAuth user with write:help-center', async () => {
+      const handleMcpRequest = await initializeOAuthSession(['write:help-center'])
+      await setupValidOAuth({
+        role: 'member',
+        scopes: ['write:help-center'],
+      })
+
+      const requests = [
+        {
+          name: 'create_article',
+          arguments: { categoryId: 'category_test', title: 'Getting Started', content: 'Welcome' },
+        },
+        {
+          name: 'update_article',
+          arguments: { articleId: 'article_test', title: 'Updated' },
+        },
+        {
+          name: 'manage_category',
+          arguments: { action: 'create', name: 'Guides' },
+        },
+      ] as const
+
+      for (const request of requests) {
+        const response = await handleMcpRequest(
+          oauthRequest(
+            jsonRpcRequest('tools/call', {
+              name: request.name,
+              arguments: request.arguments,
+            })
+          )
+        )
+
+        expect(response.status).toBe(200)
+        const body = (await response.json()) as {
+          result: { isError: boolean; content: Array<{ text: string }> }
+        }
+        expect(body.result.isError).toBe(true)
+        expect(body.result.content[0].text).toContain('admin role')
+      }
+    })
+
+    it('should allow help center write tools for admin OAuth user with write:help-center', async () => {
+      const handleMcpRequest = await initializeOAuthSession(['write:help-center'])
+
+      const requests = [
+        {
+          name: 'create_article',
+          arguments: { categoryId: 'category_test', title: 'Getting Started', content: 'Welcome' },
+        },
+        {
+          name: 'update_article',
+          arguments: { articleId: 'article_test', title: 'Updated' },
+        },
+        {
+          name: 'manage_category',
+          arguments: { action: 'create', name: 'Guides' },
+        },
+      ] as const
+
+      for (const request of requests) {
+        const response = await handleMcpRequest(
+          oauthRequest(
+            jsonRpcRequest('tools/call', {
+              name: request.name,
+              arguments: request.arguments,
+            })
+          )
+        )
+
+        expect(response.status).toBe(200)
+        const body = (await response.json()) as {
+          result: { isError?: boolean; content: Array<{ text: string }> }
+        }
+        expect(body.result.isError).toBeUndefined()
+      }
+    })
+
     it('should deny delete_post when write:feedback scope missing', async () => {
       const handleMcpRequest = await initializeOAuthSession(['read:feedback'])
 

From 84529d7f64729bc6a014036a56c7c531930a123a Mon Sep 17 00:00:00 2001
From: Val Alexander <bunsthedev@gmail.com>
Date: Fri, 5 Jun 2026 16:49:20 -0700
Subject: [PATCH 7/7] fix(posts): guard merge visibility leaks

---
 .../posts/__tests__/post-merge.test.ts        | 126 +++++++++++++--
 .../lib/server/domains/posts/post.merge.ts    | 150 ++++++++++++++----
 .../domains/posts/post.public.detail.ts       |   5 +-
 apps/web/src/lib/server/functions/portal.ts   |   6 +-
 4 files changed, 245 insertions(+), 42 deletions(-)

diff --git a/apps/web/src/lib/server/domains/posts/__tests__/post-merge.test.ts b/apps/web/src/lib/server/domains/posts/__tests__/post-merge.test.ts
index 863953d3d..96ec8697d 100644
--- a/apps/web/src/lib/server/domains/posts/__tests__/post-merge.test.ts
+++ b/apps/web/src/lib/server/domains/posts/__tests__/post-merge.test.ts
@@ -9,6 +9,7 @@ import type { PostId, PrincipalId } from '@opencoven-feedback/ids'
 const mockPostsFindFirst = vi.fn()
 const mockPrincipalFindFirst = vi.fn()
 const mockBoardsFindFirst = vi.fn()
+const mockDbSelect = vi.fn()
 const mockDbUpdate = vi.fn()
 const mockDbExecute = vi.fn()
 const createActivity = vi.fn()
@@ -21,6 +22,24 @@ function createUpdateChain() {
   return chain
 }
 
+type SelectChain = {
+  from: ReturnType<typeof vi.fn>
+  innerJoin: ReturnType<typeof vi.fn>
+  where: ReturnType<typeof vi.fn>
+  orderBy: ReturnType<typeof vi.fn>
+  limit: ReturnType<typeof vi.fn>
+}
+
+function createSelectChain(result: unknown[]): SelectChain {
+  const chain = {} as SelectChain
+  chain.from = vi.fn(() => chain)
+  chain.innerJoin = vi.fn(() => chain)
+  chain.where = vi.fn(() => chain)
+  chain.orderBy = vi.fn().mockResolvedValue(result)
+  chain.limit = vi.fn().mockResolvedValue(result)
+  return chain
+}
+
 vi.mock('@/lib/server/db', async () => {
   const { sql: realSql } = await vi.importActual<typeof import('drizzle-orm')>('drizzle-orm')
 
@@ -31,6 +50,7 @@ vi.mock('@/lib/server/db', async () => {
         principal: { findFirst: (...args: unknown[]) => mockPrincipalFindFirst(...args) },
         boards: { findFirst: (...args: unknown[]) => mockBoardsFindFirst(...args) },
       },
+      select: (...args: unknown[]) => mockDbSelect(...args),
       update: (..._args: unknown[]) => {
         mockDbUpdate(..._args)
         return createUpdateChain()
@@ -39,11 +59,11 @@ vi.mock('@/lib/server/db', async () => {
     },
     posts: { id: 'post_id', canonicalPostId: 'canonical_post_id' },
     votes: { principalId: 'principal_id', postId: 'post_id' },
-    boards: { id: 'board_id', slug: 'board_slug' },
+    boards: { id: 'board_id', slug: 'board_slug', isPublic: 'is_public' },
     principal: { id: 'principal_id', displayName: 'display_name' },
-    eq: vi.fn(),
-    and: vi.fn(),
-    isNull: vi.fn(),
+    eq: vi.fn((left, right) => ({ op: 'eq', left, right })),
+    and: vi.fn((...args) => ({ op: 'and', args })),
+    isNull: vi.fn((value) => ({ op: 'isNull', value })),
     sql: realSql,
   }
 })
@@ -84,7 +104,8 @@ vi.mock('@opencoven-feedback/ids', async (importOriginal) => {
 })
 
 // Import after mocks
-const { mergePost, unmergePost } = await import('../post.merge')
+const { mergePost, unmergePost, getPublicMergedPosts, getPublicPostMergeInfo } =
+  await import('../post.merge')
 
 const POST_A = 'post_aaa' as PostId
 const POST_B = 'post_bbb' as PostId
@@ -111,7 +132,7 @@ describe('mergePost', () => {
       return Promise.resolve(mockPost())
     })
     mockPrincipalFindFirst.mockResolvedValue({ displayName: 'Author' })
-    mockBoardsFindFirst.mockResolvedValue({ id: 'board_mock', slug: 'feedback' })
+    mockBoardsFindFirst.mockResolvedValue({ id: 'board_mock', slug: 'feedback', isPublic: true })
     // Default: vote count recalculation returns 5
     mockDbExecute.mockResolvedValue([{ unique_voters: 5 }])
   })
@@ -156,6 +177,18 @@ describe('mergePost', () => {
     )
   })
 
+  it('throws ValidationError when boards have different public visibility', async () => {
+    mockPostsFindFirst
+      .mockResolvedValueOnce(mockPost({ id: POST_A, boardId: 'private_board' }))
+      .mockResolvedValueOnce(mockPost({ id: POST_B, boardId: 'public_board' }))
+    mockBoardsFindFirst
+      .mockResolvedValueOnce({ slug: 'internal', isPublic: false })
+      .mockResolvedValueOnce({ slug: 'feedback', isPublic: true })
+
+    await expect(mergePost(POST_A, POST_B, ACTOR)).rejects.toThrow(/same public visibility/)
+    expect(mockDbUpdate).not.toHaveBeenCalled()
+  })
+
   it('records activity on both posts after successful merge', async () => {
     mockPostsFindFirst
       .mockResolvedValueOnce(mockPost({ id: POST_A, title: 'Duplicate' }))
@@ -215,8 +248,8 @@ describe('mergePost', () => {
       .mockResolvedValueOnce(mockPost({ id: POST_A, title: 'Dup', boardId: 'board_a' }))
       .mockResolvedValueOnce(mockPost({ id: POST_B, title: 'Canon', boardId: 'board_b' }))
     mockBoardsFindFirst
-      .mockResolvedValueOnce({ slug: 'board-a' })
-      .mockResolvedValueOnce({ slug: 'board-b' })
+      .mockResolvedValueOnce({ slug: 'board-a', isPublic: true })
+      .mockResolvedValueOnce({ slug: 'board-b', isPublic: true })
 
     await mergePost(POST_A, POST_B, ACTOR)
 
@@ -238,10 +271,81 @@ describe('mergePost', () => {
   })
 })
 
+describe('public merge visibility helpers', () => {
+  beforeEach(() => {
+    vi.clearAllMocks()
+  })
+
+  it('filters merged-post summaries through public-board visibility', async () => {
+    const mergedAt = new Date('2026-06-06T12:00:00.000Z')
+    const selectChain = createSelectChain([
+      {
+        id: POST_A,
+        title: 'Public duplicate',
+        voteCount: 4,
+        authorName: 'Author',
+        createdAt: new Date('2026-06-05T12:00:00.000Z'),
+        mergedAt,
+      },
+    ])
+    mockDbSelect.mockReturnValueOnce(selectChain)
+
+    const result = await getPublicMergedPosts(POST_B)
+
+    expect(result).toEqual([
+      {
+        id: POST_A,
+        title: 'Public duplicate',
+        voteCount: 4,
+        authorName: 'Author',
+        createdAt: new Date('2026-06-05T12:00:00.000Z'),
+        mergedAt,
+      },
+    ])
+    expect(selectChain.innerJoin).toHaveBeenCalled()
+    expect(JSON.stringify(vi.mocked(selectChain.where).mock.calls[0]?.[0])).toContain(
+      '"left":"is_public","right":true'
+    )
+  })
+
+  it('hides public merge info when the canonical target is not public or is deleted', async () => {
+    const mergedAt = new Date('2026-06-06T12:00:00.000Z')
+    mockDbSelect
+      .mockReturnValueOnce(createSelectChain([{ canonicalPostId: POST_B, mergedAt }]))
+      .mockReturnValueOnce(createSelectChain([]))
+
+    await expect(getPublicPostMergeInfo(POST_A)).resolves.toBeNull()
+  })
+
+  it('returns public merge info only after both post queries pass public-board filters', async () => {
+    const mergedAt = new Date('2026-06-06T12:00:00.000Z')
+    const mergedPostQuery = createSelectChain([{ canonicalPostId: POST_B, mergedAt }])
+    const canonicalPostQuery = createSelectChain([
+      { id: POST_B, title: 'Canonical public post', boardSlug: 'feedback' },
+    ])
+    mockDbSelect.mockReturnValueOnce(mergedPostQuery).mockReturnValueOnce(canonicalPostQuery)
+
+    const result = await getPublicPostMergeInfo(POST_A)
+
+    expect(result).toEqual({
+      canonicalPostId: POST_B,
+      canonicalPostTitle: 'Canonical public post',
+      canonicalPostBoardSlug: 'feedback',
+      mergedAt,
+    })
+    expect(JSON.stringify(vi.mocked(mergedPostQuery.where).mock.calls[0]?.[0])).toContain(
+      '"left":"is_public","right":true'
+    )
+    expect(JSON.stringify(vi.mocked(canonicalPostQuery.where).mock.calls[0]?.[0])).toContain(
+      '"left":"is_public","right":true'
+    )
+  })
+})
+
 describe('unmergePost', () => {
   beforeEach(() => {
     vi.clearAllMocks()
-    mockBoardsFindFirst.mockResolvedValue({ id: 'board_mock', slug: 'feedback' })
+    mockBoardsFindFirst.mockResolvedValue({ id: 'board_mock', slug: 'feedback', isPublic: true })
     mockDbExecute.mockResolvedValue([{ unique_voters: 3 }])
   })
 
@@ -301,8 +405,8 @@ describe('unmergePost', () => {
       )
       .mockResolvedValueOnce(mockPost({ id: POST_B, title: 'Canon', boardId: 'board_b' }))
     mockBoardsFindFirst
-      .mockResolvedValueOnce({ slug: 'board-a' })
-      .mockResolvedValueOnce({ slug: 'board-b' })
+      .mockResolvedValueOnce({ slug: 'board-a', isPublic: true })
+      .mockResolvedValueOnce({ slug: 'board-b', isPublic: true })
 
     await unmergePost(POST_A, ACTOR)
 
diff --git a/apps/web/src/lib/server/domains/posts/post.merge.ts b/apps/web/src/lib/server/domains/posts/post.merge.ts
index 25363fdc3..f9da505de 100644
--- a/apps/web/src/lib/server/domains/posts/post.merge.ts
+++ b/apps/web/src/lib/server/domains/posts/post.merge.ts
@@ -107,6 +107,28 @@ export async function mergePost(
     )
   }
 
+  const [duplicateBoard, canonicalBoard] = await Promise.all([
+    db.query.boards.findFirst({
+      where: eq(boards.id, duplicatePost.boardId),
+      columns: { slug: true, isPublic: true },
+    }),
+    db.query.boards.findFirst({
+      where: eq(boards.id, canonicalPost.boardId),
+      columns: { slug: true, isPublic: true },
+    }),
+  ])
+
+  if (!duplicateBoard || !canonicalBoard) {
+    throw new NotFoundError('BOARD_NOT_FOUND', 'One or both post boards could not be found')
+  }
+
+  if (duplicateBoard.isPublic !== canonicalBoard.isPublic) {
+    throw new ValidationError(
+      'INCOMPATIBLE_MERGE_VISIBILITY',
+      'Posts can only be merged when their boards have the same public visibility.'
+    )
+  }
+
   // Mark the duplicate post as merged
   await db
     .update(posts)
@@ -153,33 +175,21 @@ export async function mergePost(
   })
 
   // Dispatch post.merged event for webhooks and integrations
-  const [dupBoard, canBoard] = await Promise.all([
-    db.query.boards.findFirst({
-      where: eq(boards.id, duplicatePost.boardId),
-      columns: { slug: true },
-    }),
-    db.query.boards.findFirst({
-      where: eq(boards.id, canonicalPost.boardId),
-      columns: { slug: true },
-    }),
-  ])
-  if (dupBoard && canBoard) {
-    dispatchPostMerged(
-      buildEventActor({ principalId: actorPrincipalId, userId: actorUserId }),
-      {
-        id: duplicatePostId,
-        title: duplicatePost.title,
-        boardId: duplicatePost.boardId,
-        boardSlug: dupBoard.slug,
-      },
-      {
-        id: canonicalPostId,
-        title: canonicalPost.title,
-        boardId: canonicalPost.boardId,
-        boardSlug: canBoard.slug,
-      }
-    )
-  }
+  dispatchPostMerged(
+    buildEventActor({ principalId: actorPrincipalId, userId: actorUserId }),
+    {
+      id: duplicatePostId,
+      title: duplicatePost.title,
+      boardId: duplicatePost.boardId,
+      boardSlug: duplicateBoard.slug,
+    },
+    {
+      id: canonicalPostId,
+      title: canonicalPost.title,
+      boardId: canonicalPost.boardId,
+      boardSlug: canonicalBoard.slug,
+    }
+  )
 
   return {
     canonicalPost: { id: canonicalPostId, voteCount: newVoteCount },
@@ -336,6 +346,46 @@ export async function getMergedPosts(canonicalPostId: PostId): Promise<MergedPos
   }))
 }
 
+/**
+ * Get public-board posts merged into a canonical post.
+ *
+ * Public portal responses must not expose private/internal-board merged post
+ * metadata, even if an older cross-visibility merge exists.
+ */
+export async function getPublicMergedPosts(canonicalPostId: PostId): Promise<MergedPostSummary[]> {
+  const mergedPosts = await db
+    .select({
+      id: posts.id,
+      title: posts.title,
+      voteCount: posts.voteCount,
+      createdAt: posts.createdAt,
+      mergedAt: posts.mergedAt,
+      authorName: sql<string | null>`(
+        SELECT m.display_name FROM ${principalTable} m
+        WHERE m.id = ${posts.principalId}
+      )`.as('author_name'),
+    })
+    .from(posts)
+    .innerJoin(boards, eq(posts.boardId, boards.id))
+    .where(
+      and(
+        eq(posts.canonicalPostId, canonicalPostId),
+        isNull(posts.deletedAt),
+        eq(boards.isPublic, true)
+      )
+    )
+    .orderBy(posts.mergedAt)
+
+  return mergedPosts.map((p) => ({
+    id: p.id,
+    title: p.title,
+    voteCount: p.voteCount,
+    authorName: p.authorName,
+    createdAt: p.createdAt,
+    mergedAt: p.mergedAt!,
+  }))
+}
+
 /**
  * Get merge info for a post that has been merged into another.
  * Returns null if the post is not merged.
@@ -376,6 +426,52 @@ export async function getPostMergeInfo(postId: PostId): Promise<PostMergeInfo |
   }
 }
 
+/**
+ * Get merge info for a public portal post without exposing private canonical
+ * metadata. Returns null unless both the merged post and canonical target are
+ * on public boards and not deleted.
+ */
+export async function getPublicPostMergeInfo(postId: PostId): Promise<PostMergeInfo | null> {
+  const mergedPost = await db
+    .select({
+      canonicalPostId: posts.canonicalPostId,
+      mergedAt: posts.mergedAt,
+    })
+    .from(posts)
+    .innerJoin(boards, eq(posts.boardId, boards.id))
+    .where(and(eq(posts.id, postId), isNull(posts.deletedAt), eq(boards.isPublic, true)))
+    .limit(1)
+
+  const post = mergedPost[0]
+  if (!post?.canonicalPostId || !post.mergedAt) {
+    return null
+  }
+
+  const canonicalPost = await db
+    .select({
+      id: posts.id,
+      title: posts.title,
+      boardSlug: boards.slug,
+    })
+    .from(posts)
+    .innerJoin(boards, eq(posts.boardId, boards.id))
+    .where(
+      and(eq(posts.id, post.canonicalPostId), isNull(posts.deletedAt), eq(boards.isPublic, true))
+    )
+    .limit(1)
+
+  if (!canonicalPost[0]) {
+    return null
+  }
+
+  return {
+    canonicalPostId: canonicalPost[0].id,
+    canonicalPostTitle: canonicalPost[0].title,
+    canonicalPostBoardSlug: canonicalPost[0].boardSlug,
+    mergedAt: post.mergedAt,
+  }
+}
+
 /**
  * Result of a merge preview — simulates what the canonical post would look like after merging.
  */
diff --git a/apps/web/src/lib/server/domains/posts/post.public.detail.ts b/apps/web/src/lib/server/domains/posts/post.public.detail.ts
index 397e6b312..e21b8d182 100644
--- a/apps/web/src/lib/server/domains/posts/post.public.detail.ts
+++ b/apps/web/src/lib/server/domains/posts/post.public.detail.ts
@@ -147,7 +147,10 @@ export async function getPublicPostDetail(
         SELECT ${postUuid}::uuid
         UNION ALL
         SELECT p.id FROM ${posts} p
-        WHERE p.canonical_post_id = ${postUuid}::uuid AND p.deleted_at IS NULL
+        INNER JOIN ${boards} b ON b.id = p.board_id
+        WHERE p.canonical_post_id = ${postUuid}::uuid
+          AND p.deleted_at IS NULL
+          AND b.is_public = true
       )
       ${options?.includePrivateComments ? sql`` : sql`AND c.is_private = false`}
       GROUP BY c.id, m.display_name, m.avatar_key, m.avatar_url, scf.name, scf.color, sct.name, sct.color
diff --git a/apps/web/src/lib/server/functions/portal.ts b/apps/web/src/lib/server/functions/portal.ts
index 7b713ddd5..cc2094421 100644
--- a/apps/web/src/lib/server/functions/portal.ts
+++ b/apps/web/src/lib/server/functions/portal.ts
@@ -25,7 +25,7 @@ import {
   getVotedPostIdsByUserId,
 } from '@/lib/server/domains/posts/post.public'
 import { getPublicPostDetail } from '@/lib/server/domains/posts/post.public.detail'
-import { getPostMergeInfo, getMergedPosts } from '@/lib/server/domains/posts/post.merge'
+import { getPublicPostMergeInfo, getPublicMergedPosts } from '@/lib/server/domains/posts/post.merge'
 import { listPublicStatuses } from '@/lib/server/domains/statuses/status.service'
 import { listPublicTags } from '@/lib/server/domains/tags/tag.service'
 import { getSubscriptionStatus } from '@/lib/server/domains/subscriptions/subscription.service'
@@ -202,10 +202,10 @@ export const fetchPublicPostDetail = createServerFn({ method: 'GET' })
     // Fetch merge info for this post
     const postId = data.postId as PostId
     const [mergeInfo, mergedPostsList] = await Promise.all([
-      getPostMergeInfo(postId).then((info) =>
+      getPublicPostMergeInfo(postId).then((info) =>
         info ? { ...info, mergedAt: toISOString(info.mergedAt) } : null
       ),
-      getMergedPosts(postId),
+      getPublicMergedPosts(postId),
     ])
 
     return {