server

server-rs/src/routes/actual_listings.rs

@@ -55,6 +55,16 @@ pub async fn get_actual_listings(
 ) -> Result<Json<ActualListingsResponse>, Response> {
     let state = shared.load_state();
     let offset = params.offset.unwrap_or(0);
+
+    // Gate the entire feature behind the per-user `can_see_listings` flag. The
+    // flag is off by default for everyone, so listings are invisible unless a
+    // superuser has explicitly granted access to this account.
+    if !user.0.as_ref().is_some_and(|u| u.can_see_listings) {
+        return Err(
+            ApiError::Forbidden("You do not have access to listings".to_string()).into_response(),
+        );
+    }
+
     let Some(actual_listings) = state.actual_listings.clone() else {
         return Ok(Json(ActualListingsResponse {
             listings: Vec::new(),