Thanks for this FEP, it made me realize that this case wasnt handled properly in Lemmy’s private group implementation (not released yet). However I came up with an easier solution which doesnt require any complicated token. Basically its like this:
- Private group hosted on alpha
- User on beta follows the group and makes a post
- User on gamma follows the group and attempts to fetch post from beta
- This would normally fail as beta has no way to know if gamma user is a member of the private group
- Instead beta makes an http request to alpha with
/c/{name}/followers?is_follower={gamma user id} - If this returns status 200, gamma is confirmed as follower and beta can return the post.