Security + conventions hardening from a code audit.
Changes
- Privacy fix: A discussion's Open Graph meta tags are now rendered only when the request actor can actually see that discussion (
whereVisibleTo). Previously a restricted (tag/group-gated) discussion could leak its title and a first-post excerpt into the page's<meta>tags for guests, crawlers and bots — content the API would refuse them. Restricted/invisible discussions now fall back to the generic forum tags. - Read the
forum_titlesetting once instead of twice. - Tooling: migrate the admin JS to TypeScript (flarum-tsconfig + tsconfig.json) and remove a dead admin re-export.
Recommended update for any forum with private or restricted discussions.