[NoiceHax]

Description

When a shared list is made public, the public page only showed bookmarks belonging to the list owner. Anything a collaborator had added was missing, even though the item count at the top of the page was correct.

The cause is in List.getPublicListContents. It collected every bookmark id in the list and handed them to Bookmark.loadMulti as ids. That query path filters on bookmarks.userId, so bookmarks owned by a collaborator were dropped. The count came from a separate query with no such filter, which is why the number and the visible bookmarks disagreed. I changed it to pass listId instead. That is the same path the logged-in list view already uses, it drives off bookmarksInLists and does not filter by owner. Access control is unchanged, getPublicList has already proven the list is public or that the RSS token matched before this runs, and asset URLs are signed with each bookmark's own user id so a collaborator's assets get the right signature. The count now comes from getSize() since the full id list is no longer needed. Smart lists behave as before because loadMulti still resolves them to ids internally.

There is one supporting change in buildImpersonatingAuthedContext. It reached for the module-level db directly, so a test could not drive the real public endpoint against the in-memory test database. It now takes an optional db and getPublicListContents passes the one from the request context. Existing callers are untouched and fall back to the default.

Fixes #2594

How Has This Been Tested?

• New test in packages/trpc/routers/sharedLists.test.ts: the owner creates a manual list and adds a bookmark, an editor collaborator adds their own bookmark, the owner marks the list public, then the unauthenticated caller hits publicBookmarks.getPublicBookmarksInList and must get both bookmarks with numItems of 2. It fails on main, returning only the owner's bookmark while still reporting 2 items, and passes with this change.
• Full trpc package suite: pnpm --filter @karakeep/trpc exec vitest run, 449 tests passing. Typecheck, lint and format are clean.

Screenshots (if appropriate)

No visual change. The public list page now renders the bookmarks it was already counting.

Checklist:

• I have carefully read CONTRIBUTING.md
• I have performed a self-review of my own code
• I have made corresponding changes to the documentation if applicable
• I have no unrelated changes in the PR.
• I have confirmed that any new dependencies are strictly necessary.
• I have written tests for new code (if applicable)

Please describe to which degree, if any, an LLM was used in creating this pull request.

I used Claude Code for this one. It traced the owner filter through the list and bookmark models, wrote the fix and the test, and ran the suite. I read the diff myself and checked that the test really fails without the source change before opening this.

[greptile-apps]

Greptile Summary

The PR fixes public manual lists so bookmarks contributed by collaborators are returned alongside owner bookmarks while preserving existing public-list authorization and pagination.

• Loads public list contents through the list-membership query rather than the owner-scoped bookmark-ID query.
• Computes the public item count through the list model’s existing getSize() implementation.
• Allows impersonated contexts to use the request database and adds regression coverage for collaborator-owned bookmarks.

Confidence Score: 5/5

The PR appears safe to merge with no actionable correctness or security issues identified.

The updated query follows existing list-membership semantics, preserves the established public-list authorization boundary, signs assets for each bookmark’s actual owner, and keeps smart lists on their prior resolution path.

Important Files Changed

Filename	Overview
packages/trpc/lib/impersonate.ts	Adds an optional database parameter and consistently uses it for the impersonated user lookup and returned context while preserving the global default.
packages/trpc/models/lists.ts	Switches public manual-list loading to list membership so collaborator bookmarks and the reported count remain aligned.
packages/trpc/routers/sharedLists.test.ts	Adds focused endpoint-level regression coverage proving an unauthenticated public view returns bookmarks from both the owner and an editor collaborator.

_{Reviews (1): Last reviewed commit: "fix(trpc): show collaborator bookmarks i..." | Re-trigger Greptile}

[MohamedBassem]

Thanks for the PR!