prompt: We are currently solving the following issue within our repository. Here is the issue text:
  --- BEGIN ISSUE ---
  should be able to see logged-in user's following/followers
  **Describe the bug**
  if i click on the following users (https://ziurkes.group.lt/user/athinkingmeat/following) - i get 403 page, which is not expected. i would expect to see my own following/follower users.
  
  **To Reproduce**
  Steps to reproduce the behavior:
  just click on following/followers on logged-in user's profile page
  
  **Expected behavior**
  should see a list of following users
  
  **Screenshots**
  <img width="552" alt="image" src="https://user-images.githubusercontent.com/81133/169102523-1891c406-aab5-485f-9c9b-d9caa9ca3c6f.png">
  
  **Instance**
  https://ziurkes.group.lt
  
  
  
  --- END ISSUE ---
  
  Below are some code segments, each from a relevant file. One or more of these files may contain bugs.
  --- BEGIN FILES ---
  Path: `bookwyrm/views/user.py`
  Content:
  ```
  1 """ non-interactive pages """
  2 from django.contrib.auth.decorators import login_required
  3 from django.core.exceptions import PermissionDenied
  4 from django.core.paginator import Paginator
  5 from django.db.models import Q, Count
  6 from django.http import Http404
  7 from django.shortcuts import redirect
  8 from django.template.response import TemplateResponse
  9 from django.utils import timezone
  10 from django.views import View
  11 from django.views.decorators.http import require_POST
  12 
  13 from bookwyrm import models
  14 from bookwyrm.activitypub import ActivitypubResponse
  15 from bookwyrm.settings import PAGE_LENGTH
  16 from .helpers import get_user_from_username, is_api_request
  17 
  18 
  19 # pylint: disable=no-self-use
  20 class User(View):
  21     """user profile page"""
  22 
  23     def get(self, request, username):
  24         """profile page for a user"""
  25         user = get_user_from_username(request.user, username)
  26 
  27         if is_api_request(request):
  28             # we have a json request
  29             return ActivitypubResponse(user.to_activity())
  30         # otherwise we're at a UI view
  31 
  32         shelf_preview = []
  33 
  34         # only show shelves that should be visible
  35         is_self = request.user.id == user.id
  36         if not is_self:
  37             shelves = (
  38                 models.Shelf.privacy_filter(
  39                     request.user, privacy_levels=["public", "followers"]
  40                 )
  41                 .filter(user=user, books__isnull=False)
  42                 .distinct()
  43             )
  44         else:
  45             shelves = user.shelf_set.filter(books__isnull=False).distinct()
  46 
  47         for user_shelf in shelves.all()[:3]:
  48             shelf_preview.append(
  49                 {
  50                     "name": user_shelf.name,
  51                     "local_path": user_shelf.local_path,
  52                     "books": user_shelf.books.all()[:3],
  53                     "size": user_shelf.books.count(),
  54                 }
  55             )
  56 
  57         # user's posts
  58         activities = (
  59             models.Status.privacy_filter(
  60                 request.user,
  61             )
  62             .filter(user=user)
  63             .select_related(
  64                 "user",
  65                 "reply_parent",
  66                 "review__book",
  67                 "comment__book",
  68                 "quotation__book",
  69             )
  70             .prefetch_related(
  71                 "mention_books",
  72                 "mention_users",
  73                 "attachments",
  74             )
  75         )
  76 
  77         paginated = Paginator(activities, PAGE_LENGTH)
  78         goal = models.AnnualGoal.objects.filter(
  79             user=user, year=timezone.now().year
  80         ).first()
  81         if goal:
  82             try:
  83                 goal.raise_visible_to_user(request.user)
  84             except Http404:
  85                 goal = None
  86 
  87         data = {
  88             "user": user,
  89             "is_self": is_self,
  90             "shelves": shelf_preview,
  91             "shelf_count": shelves.count(),
  92             "activities": paginated.get_page(request.GET.get("page", 1)),
  93             "goal": goal,
  94         }
  95 
  96         return TemplateResponse(request, "user/user.html", data)
  97 
  98 
  99 class Followers(View):
  100     """list of followers view"""
  101 
  102     def get(self, request, username):
  103         """list of followers"""
  104         user = get_user_from_username(request.user, username)
  105 
  106         if is_api_request(request):
  107             return ActivitypubResponse(user.to_followers_activity(**request.GET))
  108 
  109         if user.hide_follows:
  110             raise PermissionDenied()
  111 
  112         followers = annotate_if_follows(request.user, user.followers)
  113         paginated = Paginator(followers.all(), PAGE_LENGTH)
  114         data = {
  115             "user": user,
  116             "is_self": request.user.id == user.id,
  117             "follow_list": paginated.get_page(request.GET.get("page")),
  118         }
  119         return TemplateResponse(request, "user/relationships/followers.html", data)
  120 
  121 
  122 class Following(View):
  123     """list of following view"""
  124 
  125     def get(self, request, username):
  126         """list of followers"""
  127         user = get_user_from_username(request.user, username)
  128 
  129         if is_api_request(request):
  130             return ActivitypubResponse(user.to_following_activity(**request.GET))
  131 
  132         if user.hide_follows:
  133             raise PermissionDenied()
  134 
  135         following = annotate_if_follows(request.user, user.following)
  136         paginated = Paginator(following.all(), PAGE_LENGTH)
  137         data = {
  138             "user": user,
  139             "is_self": request.user.id == user.id,
  140             "follow_list": paginated.get_page(request.GET.get("page")),
  141         }
  142         return TemplateResponse(request, "user/relationships/following.html", data)
  143 
  144 
  145 def annotate_if_follows(user, queryset):
  146     """Sort a list of users by if you follow them"""
  147     if not user.is_authenticated:
  148         return queryset.order_by("-created_date")
  149 
  150     return queryset.annotate(
  151         request_user_follows=Count("followers", filter=Q(followers=user))
  152     ).order_by("-request_user_follows", "-created_date")
  153 
  154 
  155 @require_POST
  156 @login_required
  157 def hide_suggestions(request):
  158     """not everyone wants user suggestions"""
  159     request.user.show_suggested_users = False
  160     request.user.save(broadcast=False, update_fields=["show_suggested_users"])
  161     return redirect(request.headers.get("Referer", "/"))
  162 
  163 
  164 # pylint: disable=unused-argument
  165 def user_redirect(request, username):
  166     """redirect to a user's feed"""
  167     return redirect("user-feed", username=username)
  168
  ```
  --- END FILES ---
  
  Please first localize the bug based on the issue statement, and then generate a patch according to the `git diff` format fenced by three backticks.
  
  Here is an example:
  
  ```diff
  diff --git a/examples/server_async.py b/examples/server_async.py
  --- a/examples/server_async.py
  +++ b/examples/server_async.py
  @@ -313,4 +313,4 @@
   
   
   if __name__ == "__main__":
  -    asyncio.run(run_async_server("."), debug=True)
  +    asyncio.run(run_async_server(), debug=True)
  diff --git a/examples/server_sync.py b/examples/server_sync.py
  --- a/examples/server_sync.py
  +++ b/examples/server_sync.py
  @@ -313,5 +313,5 @@
   
   
   if __name__ == "__main__":
  -    server = run_sync_server(".")
  +    server = run_sync_server()
       server.shutdown()
  
  ```
  
golden_diff: diff --git a/bookwyrm/views/user.py b/bookwyrm/views/user.py
  --- a/bookwyrm/views/user.py
  +++ b/bookwyrm/views/user.py
  @@ -106,7 +106,7 @@
           if is_api_request(request):
               return ActivitypubResponse(user.to_followers_activity(**request.GET))
   
  -        if user.hide_follows:
  +        if user.hide_follows and user != request.user:
               raise PermissionDenied()
   
           followers = annotate_if_follows(request.user, user.followers)
  @@ -129,7 +129,7 @@
           if is_api_request(request):
               return ActivitypubResponse(user.to_following_activity(**request.GET))
   
  -        if user.hide_follows:
  +        if user.hide_follows and user != request.user:
               raise PermissionDenied()
   
           following = annotate_if_follows(request.user, user.following)
  
verification_info: {"golden_diff": "diff --git a/bookwyrm/views/user.py b/bookwyrm/views/user.py\n--- a/bookwyrm/views/user.py\n+++ b/bookwyrm/views/user.py\n@@ -106,7 +106,7 @@\n         if is_api_request(request):\n             return ActivitypubResponse(user.to_followers_activity(**request.GET))\n \n-        if user.hide_follows:\n+        if user.hide_follows and user != request.user:\n             raise PermissionDenied()\n \n         followers = annotate_if_follows(request.user, user.followers)\n@@ -129,7 +129,7 @@\n         if is_api_request(request):\n             return ActivitypubResponse(user.to_following_activity(**request.GET))\n \n-        if user.hide_follows:\n+        if user.hide_follows and user != request.user:\n             raise PermissionDenied()\n \n         following = annotate_if_follows(request.user, user.following)\n", "issue": "should be able to see logged-in user's following/followers\n**Describe the bug**\r\nif i click on the following users (https://ziurkes.group.lt/user/athinkingmeat/following) - i get 403 page, which is not expected. i would expect to see my own following/follower users.\r\n\r\n**To Reproduce**\r\nSteps to reproduce the behavior:\r\njust click on following/followers on logged-in user's profile page\r\n\r\n**Expected behavior**\r\nshould see a list of following users\r\n\r\n**Screenshots**\r\n<img width=\"552\" alt=\"image\" src=\"https://user-images.githubusercontent.com/81133/169102523-1891c406-aab5-485f-9c9b-d9caa9ca3c6f.png\">\r\n\r\n**Instance**\r\nhttps://ziurkes.group.lt\r\n\r\n\n", "before_files": [{"content": "\"\"\" non-interactive pages \"\"\"\nfrom django.contrib.auth.decorators import login_required\nfrom django.core.exceptions import PermissionDenied\nfrom django.core.paginator import Paginator\nfrom django.db.models import Q, Count\nfrom django.http import Http404\nfrom django.shortcuts import redirect\nfrom django.template.response import TemplateResponse\nfrom django.utils import timezone\nfrom django.views import View\nfrom django.views.decorators.http import require_POST\n\nfrom bookwyrm import models\nfrom bookwyrm.activitypub import ActivitypubResponse\nfrom bookwyrm.settings import PAGE_LENGTH\nfrom .helpers import get_user_from_username, is_api_request\n\n\n# pylint: disable=no-self-use\nclass User(View):\n    \"\"\"user profile page\"\"\"\n\n    def get(self, request, username):\n        \"\"\"profile page for a user\"\"\"\n        user = get_user_from_username(request.user, username)\n\n        if is_api_request(request):\n            # we have a json request\n            return ActivitypubResponse(user.to_activity())\n        # otherwise we're at a UI view\n\n        shelf_preview = []\n\n        # only show shelves that should be visible\n        is_self = request.user.id == user.id\n        if not is_self:\n            shelves = (\n                models.Shelf.privacy_filter(\n                    request.user, privacy_levels=[\"public\", \"followers\"]\n                )\n                .filter(user=user, books__isnull=False)\n                .distinct()\n            )\n        else:\n            shelves = user.shelf_set.filter(books__isnull=False).distinct()\n\n        for user_shelf in shelves.all()[:3]:\n            shelf_preview.append(\n                {\n                    \"name\": user_shelf.name,\n                    \"local_path\": user_shelf.local_path,\n                    \"books\": user_shelf.books.all()[:3],\n                    \"size\": user_shelf.books.count(),\n                }\n            )\n\n        # user's posts\n        activities = (\n            models.Status.privacy_filter(\n                request.user,\n            )\n            .filter(user=user)\n            .select_related(\n                \"user\",\n                \"reply_parent\",\n                \"review__book\",\n                \"comment__book\",\n                \"quotation__book\",\n            )\n            .prefetch_related(\n                \"mention_books\",\n                \"mention_users\",\n                \"attachments\",\n            )\n        )\n\n        paginated = Paginator(activities, PAGE_LENGTH)\n        goal = models.AnnualGoal.objects.filter(\n            user=user, year=timezone.now().year\n        ).first()\n        if goal:\n            try:\n                goal.raise_visible_to_user(request.user)\n            except Http404:\n                goal = None\n\n        data = {\n            \"user\": user,\n            \"is_self\": is_self,\n            \"shelves\": shelf_preview,\n            \"shelf_count\": shelves.count(),\n            \"activities\": paginated.get_page(request.GET.get(\"page\", 1)),\n            \"goal\": goal,\n        }\n\n        return TemplateResponse(request, \"user/user.html\", data)\n\n\nclass Followers(View):\n    \"\"\"list of followers view\"\"\"\n\n    def get(self, request, username):\n        \"\"\"list of followers\"\"\"\n        user = get_user_from_username(request.user, username)\n\n        if is_api_request(request):\n            return ActivitypubResponse(user.to_followers_activity(**request.GET))\n\n        if user.hide_follows:\n            raise PermissionDenied()\n\n        followers = annotate_if_follows(request.user, user.followers)\n        paginated = Paginator(followers.all(), PAGE_LENGTH)\n        data = {\n            \"user\": user,\n            \"is_self\": request.user.id == user.id,\n            \"follow_list\": paginated.get_page(request.GET.get(\"page\")),\n        }\n        return TemplateResponse(request, \"user/relationships/followers.html\", data)\n\n\nclass Following(View):\n    \"\"\"list of following view\"\"\"\n\n    def get(self, request, username):\n        \"\"\"list of followers\"\"\"\n        user = get_user_from_username(request.user, username)\n\n        if is_api_request(request):\n            return ActivitypubResponse(user.to_following_activity(**request.GET))\n\n        if user.hide_follows:\n            raise PermissionDenied()\n\n        following = annotate_if_follows(request.user, user.following)\n        paginated = Paginator(following.all(), PAGE_LENGTH)\n        data = {\n            \"user\": user,\n            \"is_self\": request.user.id == user.id,\n            \"follow_list\": paginated.get_page(request.GET.get(\"page\")),\n        }\n        return TemplateResponse(request, \"user/relationships/following.html\", data)\n\n\ndef annotate_if_follows(user, queryset):\n    \"\"\"Sort a list of users by if you follow them\"\"\"\n    if not user.is_authenticated:\n        return queryset.order_by(\"-created_date\")\n\n    return queryset.annotate(\n        request_user_follows=Count(\"followers\", filter=Q(followers=user))\n    ).order_by(\"-request_user_follows\", \"-created_date\")\n\n\n@require_POST\n@login_required\ndef hide_suggestions(request):\n    \"\"\"not everyone wants user suggestions\"\"\"\n    request.user.show_suggested_users = False\n    request.user.save(broadcast=False, update_fields=[\"show_suggested_users\"])\n    return redirect(request.headers.get(\"Referer\", \"/\"))\n\n\n# pylint: disable=unused-argument\ndef user_redirect(request, username):\n    \"\"\"redirect to a user's feed\"\"\"\n    return redirect(\"user-feed\", username=username)\n", "path": "bookwyrm/views/user.py"}], "after_files": [{"content": "\"\"\" non-interactive pages \"\"\"\nfrom django.contrib.auth.decorators import login_required\nfrom django.core.exceptions import PermissionDenied\nfrom django.core.paginator import Paginator\nfrom django.db.models import Q, Count\nfrom django.http import Http404\nfrom django.shortcuts import redirect\nfrom django.template.response import TemplateResponse\nfrom django.utils import timezone\nfrom django.views import View\nfrom django.views.decorators.http import require_POST\n\nfrom bookwyrm import models\nfrom bookwyrm.activitypub import ActivitypubResponse\nfrom bookwyrm.settings import PAGE_LENGTH\nfrom .helpers import get_user_from_username, is_api_request\n\n\n# pylint: disable=no-self-use\nclass User(View):\n    \"\"\"user profile page\"\"\"\n\n    def get(self, request, username):\n        \"\"\"profile page for a user\"\"\"\n        user = get_user_from_username(request.user, username)\n\n        if is_api_request(request):\n            # we have a json request\n            return ActivitypubResponse(user.to_activity())\n        # otherwise we're at a UI view\n\n        shelf_preview = []\n\n        # only show shelves that should be visible\n        is_self = request.user.id == user.id\n        if not is_self:\n            shelves = (\n                models.Shelf.privacy_filter(\n                    request.user, privacy_levels=[\"public\", \"followers\"]\n                )\n                .filter(user=user, books__isnull=False)\n                .distinct()\n            )\n        else:\n            shelves = user.shelf_set.filter(books__isnull=False).distinct()\n\n        for user_shelf in shelves.all()[:3]:\n            shelf_preview.append(\n                {\n                    \"name\": user_shelf.name,\n                    \"local_path\": user_shelf.local_path,\n                    \"books\": user_shelf.books.all()[:3],\n                    \"size\": user_shelf.books.count(),\n                }\n            )\n\n        # user's posts\n        activities = (\n            models.Status.privacy_filter(\n                request.user,\n            )\n            .filter(user=user)\n            .select_related(\n                \"user\",\n                \"reply_parent\",\n                \"review__book\",\n                \"comment__book\",\n                \"quotation__book\",\n            )\n            .prefetch_related(\n                \"mention_books\",\n                \"mention_users\",\n                \"attachments\",\n            )\n        )\n\n        paginated = Paginator(activities, PAGE_LENGTH)\n        goal = models.AnnualGoal.objects.filter(\n            user=user, year=timezone.now().year\n        ).first()\n        if goal:\n            try:\n                goal.raise_visible_to_user(request.user)\n            except Http404:\n                goal = None\n\n        data = {\n            \"user\": user,\n            \"is_self\": is_self,\n            \"shelves\": shelf_preview,\n            \"shelf_count\": shelves.count(),\n            \"activities\": paginated.get_page(request.GET.get(\"page\", 1)),\n            \"goal\": goal,\n        }\n\n        return TemplateResponse(request, \"user/user.html\", data)\n\n\nclass Followers(View):\n    \"\"\"list of followers view\"\"\"\n\n    def get(self, request, username):\n        \"\"\"list of followers\"\"\"\n        user = get_user_from_username(request.user, username)\n\n        if is_api_request(request):\n            return ActivitypubResponse(user.to_followers_activity(**request.GET))\n\n        if user.hide_follows and user != request.user:\n            raise PermissionDenied()\n\n        followers = annotate_if_follows(request.user, user.followers)\n        paginated = Paginator(followers.all(), PAGE_LENGTH)\n        data = {\n            \"user\": user,\n            \"is_self\": request.user.id == user.id,\n            \"follow_list\": paginated.get_page(request.GET.get(\"page\")),\n        }\n        return TemplateResponse(request, \"user/relationships/followers.html\", data)\n\n\nclass Following(View):\n    \"\"\"list of following view\"\"\"\n\n    def get(self, request, username):\n        \"\"\"list of followers\"\"\"\n        user = get_user_from_username(request.user, username)\n\n        if is_api_request(request):\n            return ActivitypubResponse(user.to_following_activity(**request.GET))\n\n        if user.hide_follows and user != request.user:\n            raise PermissionDenied()\n\n        following = annotate_if_follows(request.user, user.following)\n        paginated = Paginator(following.all(), PAGE_LENGTH)\n        data = {\n            \"user\": user,\n            \"is_self\": request.user.id == user.id,\n            \"follow_list\": paginated.get_page(request.GET.get(\"page\")),\n        }\n        return TemplateResponse(request, \"user/relationships/following.html\", data)\n\n\ndef annotate_if_follows(user, queryset):\n    \"\"\"Sort a list of users by if you follow them\"\"\"\n    if not user.is_authenticated:\n        return queryset.order_by(\"-created_date\")\n\n    return queryset.annotate(\n        request_user_follows=Count(\"followers\", filter=Q(followers=user))\n    ).order_by(\"-request_user_follows\", \"-created_date\")\n\n\n@require_POST\n@login_required\ndef hide_suggestions(request):\n    \"\"\"not everyone wants user suggestions\"\"\"\n    request.user.show_suggested_users = False\n    request.user.save(broadcast=False, update_fields=[\"show_suggested_users\"])\n    return redirect(request.headers.get(\"Referer\", \"/\"))\n\n\n# pylint: disable=unused-argument\ndef user_redirect(request, username):\n    \"\"\"redirect to a user's feed\"\"\"\n    return redirect(\"user-feed\", username=username)\n", "path": "bookwyrm/views/user.py"}]}