Skip to content

bug(seo): event JSON-LD venues query lacks reveal_mode gate (latent info-disclosure) #635

Description

@BreakableHoodie

Found during #542 PR-4 (#634). functions/event/[slug].js's bands query now has the reveal_mode gate (announced-only on reveal-mode events), but the separate venues query does not — so on a reveal-mode event, a venue whose ONLY performance is unannounced would still appear in the MusicEvent location array, leaking part of an unannounced lineup to crawlers.

Latent, not active: no reveal-mode events exist in prod today (same status as the bands-gate bug PR-4 fixed). Left out of #634 deliberately to keep that SEO-flagged PR a single clean revertable commit.

Fix: apply AND (? = 0 OR p.is_announced = 1) (bound to the event's reveal_mode) to the venues query too, so location only reflects venues with at least one announced set. Add a test mirroring PR-4's reveal-mode assertion but for venues.

Metadata

Metadata

Assignees

No one assigned

    Labels

    bugSomething isn't workingpriority:p3Lower priority

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions