We are currently solving the following issue within our repository. Here is the issue text:
--- BEGIN ISSUE ---
should be able to see logged-in user's following/followers
**Describe the bug**
if i click on the following users (https://ziurkes.group.lt/user/athinkingmeat/following) - i get 403 page, which is not expected. i would expect to see my own following/follower users.

**To Reproduce**
Steps to reproduce the behavior:
just click on following/followers on logged-in user's profile page

**Expected behavior**
should see a list of following users

**Screenshots**
<img width="552" alt="image" src="https://user-images.githubusercontent.com/81133/169102523-1891c406-aab5-485f-9c9b-d9caa9ca3c6f.png">

**Instance**
https://ziurkes.group.lt



--- END ISSUE ---

Below are some code segments, each from a relevant file. One or more of these files may contain bugs.
--- BEGIN FILES ---
Path: `bookwyrm/views/user.py`
Content:
```
1 """ non-interactive pages """
2 from django.contrib.auth.decorators import login_required
3 from django.core.exceptions import PermissionDenied
4 from django.core.paginator import Paginator
5 from django.db.models import Q, Count
6 from django.http import Http404
7 from django.shortcuts import redirect
8 from django.template.response import TemplateResponse
9 from django.utils import timezone
10 from django.views import View
11 from django.views.decorators.http import require_POST
12 
13 from bookwyrm import models
14 from bookwyrm.activitypub import ActivitypubResponse
15 from bookwyrm.settings import PAGE_LENGTH
16 from .helpers import get_user_from_username, is_api_request
17 
18 
19 # pylint: disable=no-self-use
20 class User(View):
21     """user profile page"""
22 
23     def get(self, request, username):
24         """profile page for a user"""
25         user = get_user_from_username(request.user, username)
26 
27         if is_api_request(request):
28             # we have a json request
29             return ActivitypubResponse(user.to_activity())
30         # otherwise we're at a UI view
31 
32         shelf_preview = []
33 
34         # only show shelves that should be visible
35         is_self = request.user.id == user.id
36         if not is_self:
37             shelves = (
38                 models.Shelf.privacy_filter(
39                     request.user, privacy_levels=["public", "followers"]
40                 )
41                 .filter(user=user, books__isnull=False)
42                 .distinct()
43             )
44         else:
45             shelves = user.shelf_set.filter(books__isnull=False).distinct()
46 
47         for user_shelf in shelves.all()[:3]:
48             shelf_preview.append(
49                 {
50                     "name": user_shelf.name,
51                     "local_path": user_shelf.local_path,
52                     "books": user_shelf.books.all()[:3],
53                     "size": user_shelf.books.count(),
54                 }
55             )
56 
57         # user's posts
58         activities = (
59             models.Status.privacy_filter(
60                 request.user,
61             )
62             .filter(user=user)
63             .select_related(
64                 "user",
65                 "reply_parent",
66                 "review__book",
67                 "comment__book",
68                 "quotation__book",
69             )
70             .prefetch_related(
71                 "mention_books",
72                 "mention_users",
73                 "attachments",
74             )
75         )
76 
77         paginated = Paginator(activities, PAGE_LENGTH)
78         goal = models.AnnualGoal.objects.filter(
79             user=user, year=timezone.now().year
80         ).first()
81         if goal:
82             try:
83                 goal.raise_visible_to_user(request.user)
84             except Http404:
85                 goal = None
86 
87         data = {
88             "user": user,
89             "is_self": is_self,
90             "shelves": shelf_preview,
91             "shelf_count": shelves.count(),
92             "activities": paginated.get_page(request.GET.get("page", 1)),
93             "goal": goal,
94         }
95 
96         return TemplateResponse(request, "user/user.html", data)
97 
98 
99 class Followers(View):
100     """list of followers view"""
101 
102     def get(self, request, username):
103         """list of followers"""
104         user = get_user_from_username(request.user, username)
105 
106         if is_api_request(request):
107             return ActivitypubResponse(user.to_followers_activity(**request.GET))
108 
109         if user.hide_follows:
110             raise PermissionDenied()
111 
112         followers = annotate_if_follows(request.user, user.followers)
113         paginated = Paginator(followers.all(), PAGE_LENGTH)
114         data = {
115             "user": user,
116             "is_self": request.user.id == user.id,
117             "follow_list": paginated.get_page(request.GET.get("page")),
118         }
119         return TemplateResponse(request, "user/relationships/followers.html", data)
120 
121 
122 class Following(View):
123     """list of following view"""
124 
125     def get(self, request, username):
126         """list of followers"""
127         user = get_user_from_username(request.user, username)
128 
129         if is_api_request(request):
130             return ActivitypubResponse(user.to_following_activity(**request.GET))
131 
132         if user.hide_follows:
133             raise PermissionDenied()
134 
135         following = annotate_if_follows(request.user, user.following)
136         paginated = Paginator(following.all(), PAGE_LENGTH)
137         data = {
138             "user": user,
139             "is_self": request.user.id == user.id,
140             "follow_list": paginated.get_page(request.GET.get("page")),
141         }
142         return TemplateResponse(request, "user/relationships/following.html", data)
143 
144 
145 def annotate_if_follows(user, queryset):
146     """Sort a list of users by if you follow them"""
147     if not user.is_authenticated:
148         return queryset.order_by("-created_date")
149 
150     return queryset.annotate(
151         request_user_follows=Count("followers", filter=Q(followers=user))
152     ).order_by("-request_user_follows", "-created_date")
153 
154 
155 @require_POST
156 @login_required
157 def hide_suggestions(request):
158     """not everyone wants user suggestions"""
159     request.user.show_suggested_users = False
160     request.user.save(broadcast=False, update_fields=["show_suggested_users"])
161     return redirect(request.headers.get("Referer", "/"))
162 
163 
164 # pylint: disable=unused-argument
165 def user_redirect(request, username):
166     """redirect to a user's feed"""
167     return redirect("user-feed", username=username)
168
```
--- END FILES ---

Please first localize the bug based on the issue statement, and then generate a patch according to the `git diff` format fenced by three backticks.

Here is an example:

```diff
diff --git a/examples/server_async.py b/examples/server_async.py
--- a/examples/server_async.py
+++ b/examples/server_async.py
@@ -313,4 +313,4 @@
 
 
 if __name__ == "__main__":
-    asyncio.run(run_async_server("."), debug=True)
+    asyncio.run(run_async_server(), debug=True)
diff --git a/examples/server_sync.py b/examples/server_sync.py
--- a/examples/server_sync.py
+++ b/examples/server_sync.py
@@ -313,5 +313,5 @@
 
 
 if __name__ == "__main__":
-    server = run_sync_server(".")
+    server = run_sync_server()
     server.shutdown()

```

diff --git a/bookwyrm/views/user.py b/bookwyrm/views/user.py
--- a/bookwyrm/views/user.py
+++ b/bookwyrm/views/user.py
@@ -106,7 +106,7 @@
         if is_api_request(request):
             return ActivitypubResponse(user.to_followers_activity(**request.GET))
 
-        if user.hide_follows:
+        if user.hide_follows and user != request.user:
             raise PermissionDenied()
 
         followers = annotate_if_follows(request.user, user.followers)
@@ -129,7 +129,7 @@
         if is_api_request(request):
             return ActivitypubResponse(user.to_following_activity(**request.GET))
 
-        if user.hide_follows:
+        if user.hide_follows and user != request.user:
             raise PermissionDenied()
 
         following = annotate_if_follows(request.user, user.following)

{"golden_diff": "diff --git a/bookwyrm/views/user.py b/bookwyrm/views/user.py\n--- a/bookwyrm/views/user.py\n+++ b/bookwyrm/views/user.py\n@@ -106,7 +106,7 @@\n         if is_api_request(request):\n             return ActivitypubResponse(user.to_followers_activity(**request.GET))\n \n-        if user.hide_follows:\n+        if user.hide_follows and user != request.user:\n             raise PermissionDenied()\n \n         followers = annotate_if_follows(request.user, user.followers)\n@@ -129,7 +129,7 @@\n         if is_api_request(request):\n             return ActivitypubResponse(user.to_following_activity(**request.GET))\n \n-        if user.hide_follows:\n+        if user.hide_follows and user != request.user:\n             raise PermissionDenied()\n \n         following = annotate_if_follows(request.user, user.following)\n", "issue": "should be able to see logged-in user's following/followers\n**Describe the bug**\r\nif i click on the following users (https://ziurkes.group.lt/user/athinkingmeat/following) - i get 403 page, which is not expected. i would expect to see my own following/follower users.\r\n\r\n**To Reproduce**\r\nSteps to reproduce the behavior:\r\njust click on following/followers on logged-in user's profile page\r\n\r\n**Expected behavior**\r\nshould see a list of following users\r\n\r\n**Screenshots**\r\n<img width=\"552\" alt=\"image\" src=\"https://user-images.githubusercontent.com/81133/169102523-1891c406-aab5-485f-9c9b-d9caa9ca3c6f.png\">\r\n\r\n**Instance**\r\nhttps://ziurkes.group.lt\r\n\r\n\n", "before_files": [{"content": "\"\"\" non-interactive pages \"\"\"\nfrom django.contrib.auth.decorators import login_required\nfrom django.core.exceptions import PermissionDenied\nfrom django.core.paginator import Paginator\nfrom django.db.models import Q, Count\nfrom django.http import Http404\nfrom django.shortcuts import redirect\nfrom django.template.response import TemplateResponse\nfrom django.utils import timezone\nfrom django.views import View\nfrom django.views.decorators.http import require_POST\n\nfrom bookwyrm import models\nfrom bookwyrm.activitypub import ActivitypubResponse\nfrom bookwyrm.settings import PAGE_LENGTH\nfrom .helpers import get_user_from_username, is_api_request\n\n\n# pylint: disable=no-self-use\nclass User(View):\n    \"\"\"user profile page\"\"\"\n\n    def get(self, request, username):\n        \"\"\"profile page for a user\"\"\"\n        user = get_user_from_username(request.user, username)\n\n        if is_api_request(request):\n            # we have a json request\n            return ActivitypubResponse(user.to_activity())\n        # otherwise we're at a UI view\n\n        shelf_preview = []\n\n        # only show shelves that should be visible\n        is_self = request.user.id == user.id\n        if not is_self:\n            shelves = (\n                models.Shelf.privacy_filter(\n                    request.user, privacy_levels=[\"public\", \"followers\"]\n                )\n                .filter(user=user, books__isnull=False)\n                .distinct()\n            )\n        else:\n            shelves = user.shelf_set.filter(books__isnull=False).distinct()\n\n        for user_shelf in shelves.all()[:3]:\n            shelf_preview.append(\n                {\n                    \"name\": user_shelf.name,\n                    \"local_path\": user_shelf.local_path,\n                    \"books\": user_shelf.books.all()[:3],\n                    \"size\": user_shelf.books.count(),\n                }\n            )\n\n        # user's posts\n        activities = (\n            models.Status.privacy_filter(\n                request.user,\n            )\n            .filter(user=user)\n            .select_related(\n                \"user\",\n                \"reply_parent\",\n                \"review__book\",\n                \"comment__book\",\n                \"quotation__book\",\n            )\n            .prefetch_related(\n                \"mention_books\",\n                \"mention_users\",\n                \"attachments\",\n            )\n        )\n\n        paginated = Paginator(activities, PAGE_LENGTH)\n        goal = models.AnnualGoal.objects.filter(\n            user=user, year=timezone.now().year\n        ).first()\n        if goal:\n            try:\n                goal.raise_visible_to_user(request.user)\n            except Http404:\n                goal = None\n\n        data = {\n            \"user\": user,\n            \"is_self\": is_self,\n            \"shelves\": shelf_preview,\n            \"shelf_count\": shelves.count(),\n            \"activities\": paginated.get_page(request.GET.get(\"page\", 1)),\n            \"goal\": goal,\n        }\n\n        return TemplateResponse(request, \"user/user.html\", data)\n\n\nclass Followers(View):\n    \"\"\"list of followers view\"\"\"\n\n    def get(self, request, username):\n        \"\"\"list of followers\"\"\"\n        user = get_user_from_username(request.user, username)\n\n        if is_api_request(request):\n            return ActivitypubResponse(user.to_followers_activity(**request.GET))\n\n        if user.hide_follows:\n            raise PermissionDenied()\n\n        followers = annotate_if_follows(request.user, user.followers)\n        paginated = Paginator(followers.all(), PAGE_LENGTH)\n        data = {\n            \"user\": user,\n            \"is_self\": request.user.id == user.id,\n            \"follow_list\": paginated.get_page(request.GET.get(\"page\")),\n        }\n        return TemplateResponse(request, \"user/relationships/followers.html\", data)\n\n\nclass Following(View):\n    \"\"\"list of following view\"\"\"\n\n    def get(self, request, username):\n        \"\"\"list of followers\"\"\"\n        user = get_user_from_username(request.user, username)\n\n        if is_api_request(request):\n            return ActivitypubResponse(user.to_following_activity(**request.GET))\n\n        if user.hide_follows:\n            raise PermissionDenied()\n\n        following = annotate_if_follows(request.user, user.following)\n        paginated = Paginator(following.all(), PAGE_LENGTH)\n        data = {\n            \"user\": user,\n            \"is_self\": request.user.id == user.id,\n            \"follow_list\": paginated.get_page(request.GET.get(\"page\")),\n        }\n        return TemplateResponse(request, \"user/relationships/following.html\", data)\n\n\ndef annotate_if_follows(user, queryset):\n    \"\"\"Sort a list of users by if you follow them\"\"\"\n    if not user.is_authenticated:\n        return queryset.order_by(\"-created_date\")\n\n    return queryset.annotate(\n        request_user_follows=Count(\"followers\", filter=Q(followers=user))\n    ).order_by(\"-request_user_follows\", \"-created_date\")\n\n\n@require_POST\n@login_required\ndef hide_suggestions(request):\n    \"\"\"not everyone wants user suggestions\"\"\"\n    request.user.show_suggested_users = False\n    request.user.save(broadcast=False, update_fields=[\"show_suggested_users\"])\n    return redirect(request.headers.get(\"Referer\", \"/\"))\n\n\n# pylint: disable=unused-argument\ndef user_redirect(request, username):\n    \"\"\"redirect to a user's feed\"\"\"\n    return redirect(\"user-feed\", username=username)\n", "path": "bookwyrm/views/user.py"}], "after_files": [{"content": "\"\"\" non-interactive pages \"\"\"\nfrom django.contrib.auth.decorators import login_required\nfrom django.core.exceptions import PermissionDenied\nfrom django.core.paginator import Paginator\nfrom django.db.models import Q, Count\nfrom django.http import Http404\nfrom django.shortcuts import redirect\nfrom django.template.response import TemplateResponse\nfrom django.utils import timezone\nfrom django.views import View\nfrom django.views.decorators.http import require_POST\n\nfrom bookwyrm import models\nfrom bookwyrm.activitypub import ActivitypubResponse\nfrom bookwyrm.settings import PAGE_LENGTH\nfrom .helpers import get_user_from_username, is_api_request\n\n\n# pylint: disable=no-self-use\nclass User(View):\n    \"\"\"user profile page\"\"\"\n\n    def get(self, request, username):\n        \"\"\"profile page for a user\"\"\"\n        user = get_user_from_username(request.user, username)\n\n        if is_api_request(request):\n            # we have a json request\n            return ActivitypubResponse(user.to_activity())\n        # otherwise we're at a UI view\n\n        shelf_preview = []\n\n        # only show shelves that should be visible\n        is_self = request.user.id == user.id\n        if not is_self:\n            shelves = (\n                models.Shelf.privacy_filter(\n                    request.user, privacy_levels=[\"public\", \"followers\"]\n                )\n                .filter(user=user, books__isnull=False)\n                .distinct()\n            )\n        else:\n            shelves = user.shelf_set.filter(books__isnull=False).distinct()\n\n        for user_shelf in shelves.all()[:3]:\n            shelf_preview.append(\n                {\n                    \"name\": user_shelf.name,\n                    \"local_path\": user_shelf.local_path,\n                    \"books\": user_shelf.books.all()[:3],\n                    \"size\": user_shelf.books.count(),\n                }\n            )\n\n        # user's posts\n        activities = (\n            models.Status.privacy_filter(\n                request.user,\n            )\n            .filter(user=user)\n            .select_related(\n                \"user\",\n                \"reply_parent\",\n                \"review__book\",\n                \"comment__book\",\n                \"quotation__book\",\n            )\n            .prefetch_related(\n                \"mention_books\",\n                \"mention_users\",\n                \"attachments\",\n            )\n        )\n\n        paginated = Paginator(activities, PAGE_LENGTH)\n        goal = models.AnnualGoal.objects.filter(\n            user=user, year=timezone.now().year\n        ).first()\n        if goal:\n            try:\n                goal.raise_visible_to_user(request.user)\n            except Http404:\n                goal = None\n\n        data = {\n            \"user\": user,\n            \"is_self\": is_self,\n            \"shelves\": shelf_preview,\n            \"shelf_count\": shelves.count(),\n            \"activities\": paginated.get_page(request.GET.get(\"page\", 1)),\n            \"goal\": goal,\n        }\n\n        return TemplateResponse(request, \"user/user.html\", data)\n\n\nclass Followers(View):\n    \"\"\"list of followers view\"\"\"\n\n    def get(self, request, username):\n        \"\"\"list of followers\"\"\"\n        user = get_user_from_username(request.user, username)\n\n        if is_api_request(request):\n            return ActivitypubResponse(user.to_followers_activity(**request.GET))\n\n        if user.hide_follows and user != request.user:\n            raise PermissionDenied()\n\n        followers = annotate_if_follows(request.user, user.followers)\n        paginated = Paginator(followers.all(), PAGE_LENGTH)\n        data = {\n            \"user\": user,\n            \"is_self\": request.user.id == user.id,\n            \"follow_list\": paginated.get_page(request.GET.get(\"page\")),\n        }\n        return TemplateResponse(request, \"user/relationships/followers.html\", data)\n\n\nclass Following(View):\n    \"\"\"list of following view\"\"\"\n\n    def get(self, request, username):\n        \"\"\"list of followers\"\"\"\n        user = get_user_from_username(request.user, username)\n\n        if is_api_request(request):\n            return ActivitypubResponse(user.to_following_activity(**request.GET))\n\n        if user.hide_follows and user != request.user:\n            raise PermissionDenied()\n\n        following = annotate_if_follows(request.user, user.following)\n        paginated = Paginator(following.all(), PAGE_LENGTH)\n        data = {\n            \"user\": user,\n            \"is_self\": request.user.id == user.id,\n            \"follow_list\": paginated.get_page(request.GET.get(\"page\")),\n        }\n        return TemplateResponse(request, \"user/relationships/following.html\", data)\n\n\ndef annotate_if_follows(user, queryset):\n    \"\"\"Sort a list of users by if you follow them\"\"\"\n    if not user.is_authenticated:\n        return queryset.order_by(\"-created_date\")\n\n    return queryset.annotate(\n        request_user_follows=Count(\"followers\", filter=Q(followers=user))\n    ).order_by(\"-request_user_follows\", \"-created_date\")\n\n\n@require_POST\n@login_required\ndef hide_suggestions(request):\n    \"\"\"not everyone wants user suggestions\"\"\"\n    request.user.show_suggested_users = False\n    request.user.save(broadcast=False, update_fields=[\"show_suggested_users\"])\n    return redirect(request.headers.get(\"Referer\", \"/\"))\n\n\n# pylint: disable=unused-argument\ndef user_redirect(request, username):\n    \"\"\"redirect to a user's feed\"\"\"\n    return redirect(\"user-feed\", username=username)\n", "path": "bookwyrm/views/user.py"}]}