From 4d3435a275d9455dec6fa4804572c0a836e07867 Mon Sep 17 00:00:00 2001
From: NiallJoeMaher <nialljoemaher@gmail.com>
Date: Wed, 12 Aug 2026 08:24:38 +0100
Subject: [PATCH] fix(admin): move the moderation preview off the public reader
 routes
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Follow-up to #1340. Review of that change found the approach itself was
the problem, not just details of it.

#1340 let admins resolve in_review/rejected posts at their public URLs.
That put the public reader — vote, bookmark and comment controls — on a
post that may be about to be rejected, and `post.vote` has no status
guard, so one misclick writes a vote and author reputation points onto
content the moderator is in the middle of declining. It also stopped
admins seeing the public site the way readers do, so checking whether a
takedown took effect gave a 200 where everyone else gets a 404. And the
rejected-post banner still promised authors "This post is not visible to
anyone else", which that change had quietly made untrue.

Preview now lives at /admin/moderation/preview/{id}: read-only, no
engagement controls, inside the admin gate. The public reader routes and
`postVisibilityFilter` go back to what they were, so the only people who
can reach an unpublished post there are its author, as before.

Two things this also fixes:

- A link submission is judged on the member's own title, excerpt and
  body as much as on its destination. #1340 sent Preview straight
  off-site, so the Codú-side copy — where a spammer would put the
  payload — was never shown. The preview page renders both.
- That off-site href skipped `safeExternalHref` and rel, so an
  externalUrl that never passed `httpUrl()` validation would run as a
  `javascript:` URL inside the authenticated admin session, and the
  destination received the admin surface as its referrer. Both are now
  handled the way every other external-href site in the repo does it.

Body rendering moves to a shared `PostBody`, so the preview and the
public reader cannot drift apart.
---
 app/(admin)/admin/moderation/_client.tsx      |  50 ++----
 .../moderation/preview/[postId]/page.tsx      | 150 ++++++++++++++++++
 app/(app)/[username]/[slug]/page.tsx          |  35 ++--
 app/(app)/d/[slug]/page.tsx                   |  33 ++--
 components/ContentDetail/PostBody.tsx         |  90 +++++++++++
 components/ContentDetail/PostReader.tsx       |  81 +---------
 server/api/router/admin.ts                    |   8 +-
 server/lib/postVisibility.test.ts             |  62 --------
 server/lib/postVisibility.ts                  |  38 -----
 9 files changed, 302 insertions(+), 245 deletions(-)
 create mode 100644 app/(admin)/admin/moderation/preview/[postId]/page.tsx
 create mode 100644 components/ContentDetail/PostBody.tsx
 delete mode 100644 server/lib/postVisibility.test.ts
 delete mode 100644 server/lib/postVisibility.ts

diff --git a/app/(admin)/admin/moderation/_client.tsx b/app/(admin)/admin/moderation/_client.tsx
index b6a2592a..285bcc28 100644
--- a/app/(admin)/admin/moderation/_client.tsx
+++ b/app/(admin)/admin/moderation/_client.tsx
@@ -40,39 +40,21 @@ const reasonLabels: Record<ReportReason, string> = {
 const chipBase =
   "rounded-full px-2 py-0.5 font-mono text-xs uppercase tracking-label";
 
-type PreviewablePost = {
-  type: string | null;
-  slug: string | null;
-  externalUrl: string | null;
-  authorUsername: string | null;
-};
-
-// Where to send a moderator to actually read the thing they're judging.
-// Discussions and questions live under /d/; a shared link IS its destination,
-// so it points off-site; everything else renders at /{username}/{slug}, where
-// the reader grants admins the same bypass the author has — so an in_review
-// post previews exactly as readers would eventually see it.
-function postPreviewHref(post: PreviewablePost): string | null {
-  if (post.type === "link") return post.externalUrl;
-  if (!post.slug) return null;
-  if (post.type === "discussion" || post.type === "question") {
-    return `/d/${post.slug}`;
-  }
-  if (!post.authorUsername) return null;
-  return `/${post.authorUsername}/${post.slug}`;
-}
-
-const PreviewLink = ({ post }: { post: PreviewablePost }) => {
-  const href = postPreviewHref(post);
-  if (!href) return null;
-
-  return (
-    <Link href={href} target="_blank" className="secondary-button">
-      <ArrowTopRightOnSquareIcon className="h-4 w-4" />
-      Preview
-    </Link>
-  );
-};
+// Read the submission before deciding on it. The preview is an admin-side,
+// read-only render (see app/(admin)/admin/moderation/preview/[postId]) rather
+// than the public URL: an unapproved post has no public URL yet, and the public
+// reader would put vote/bookmark/comment controls on a post that may be about
+// to be rejected. Keyed by id, so it is available for every queued post.
+const PreviewLink = ({ postId }: { postId: string }) => (
+  <Link
+    href={`/admin/moderation/preview/${postId}`}
+    target="_blank"
+    className="secondary-button"
+  >
+    <ArrowTopRightOnSquareIcon className="h-4 w-4" />
+    Preview
+  </Link>
+);
 
 // datetime-local is in the moderator's LOCAL time, so shift the `min` boundary
 // by the tz offset before slicing to "YYYY-MM-DDTHH:mm".
@@ -310,7 +292,7 @@ const ModerationQueue = () => {
                   )}
                 </div>
                 <div className="flex shrink-0 flex-wrap gap-2">
-                  <PreviewLink post={post} />
+                  <PreviewLink postId={post.id} />
                   <button
                     className="primary-button"
                     disabled={isModerating}
diff --git a/app/(admin)/admin/moderation/preview/[postId]/page.tsx b/app/(admin)/admin/moderation/preview/[postId]/page.tsx
new file mode 100644
index 00000000..3c2caf36
--- /dev/null
+++ b/app/(admin)/admin/moderation/preview/[postId]/page.tsx
@@ -0,0 +1,150 @@
+import Link from "next/link";
+import { notFound } from "next/navigation";
+import { ArrowLeftIcon } from "@heroicons/react/24/outline";
+import { eq } from "drizzle-orm";
+import { db } from "@/server/db";
+import { posts, user, post_tags, tag } from "@/server/db/schema";
+import { PostBody, renderPostBody } from "@/components/ContentDetail/PostBody";
+import { getCamelCaseFromLower } from "@/utils/utils";
+import { safeExternalHref } from "@/utils/url";
+
+export const metadata = {
+  title: "Preview - Codú Admin",
+  description: "Read a submission before approving or declining it",
+  robots: { index: false, follow: false },
+};
+
+type Props = { params: Promise<{ postId: string }> };
+
+// Read-only preview of a submission, for deciding whether it belongs on the
+// site. It deliberately lives inside `(admin)` rather than exposing unpublished
+// posts on the public reader routes: moderators need to READ a post, not vote,
+// bookmark or comment on one that may be about to be rejected — and admins
+// should still see the public site exactly as readers do.
+//
+// The body renders through the same `PostBody` the reader uses, so what a
+// moderator approves is what readers will get.
+//
+// Admin-role gate is enforced in app/(admin)/layout.tsx.
+export default async function Page({ params }: Props) {
+  const { postId } = await params;
+
+  const [record] = await db
+    .select({
+      id: posts.id,
+      title: posts.title,
+      body: posts.body,
+      excerpt: posts.excerpt,
+      type: posts.type,
+      status: posts.status,
+      slug: posts.slug,
+      externalUrl: posts.externalUrl,
+      coverImage: posts.coverImage,
+      readingTime: posts.readingTime,
+      createdAt: posts.createdAt,
+      moderationNote: posts.moderationNote,
+      authorName: user.name,
+      authorUsername: user.username,
+    })
+    .from(posts)
+    .leftJoin(user, eq(posts.authorId, user.id))
+    .where(eq(posts.id, postId))
+    .limit(1);
+
+  if (!record) notFound();
+
+  const renderedBody = renderPostBody(record.body);
+  const externalHref = safeExternalHref(record.externalUrl);
+
+  const tags = await db
+    .select({ title: tag.title, slug: tag.slug })
+    .from(post_tags)
+    .innerJoin(tag, eq(post_tags.tagId, tag.id))
+    .where(eq(post_tags.postId, record.id));
+
+  return (
+    <div className="mx-auto max-w-3xl px-0 py-4 sm:px-4 sm:py-8">
+      <div className="mb-6 flex items-center gap-4">
+        <Link
+          href="/admin/moderation"
+          className="rounded-lg p-2 text-muted transition-colors hover:bg-elevated hover:text-fg"
+        >
+          <ArrowLeftIcon className="h-5 w-5" />
+        </Link>
+        <div className="min-w-0">
+          <p className="eyebrow">
+            <span className="slash">{"// "}</span>preview
+          </p>
+          <h1 className="mt-1 font-display text-2xl font-extrabold tracking-tight text-fg">
+            {record.title || "Untitled"}
+          </h1>
+          <p className="mt-1 font-mono text-xs text-faint">
+            {record.type} · {record.status} · @
+            {record.authorUsername ?? "unknown"}
+            {record.readingTime ? ` · ${record.readingTime} min read` : ""}
+          </p>
+        </div>
+      </div>
+
+      {record.moderationNote && (
+        <p className="mb-6 rounded-lg border border-hairline bg-inset p-3 text-sm text-muted">
+          <span className="font-medium text-fg">Flagged:</span>{" "}
+          {record.moderationNote}
+        </p>
+      )}
+
+      {record.excerpt && (
+        <p className="mb-6 text-base text-muted">{record.excerpt}</p>
+      )}
+
+      {/* A link submission is judged on both halves: the member's own framing
+          above, and the destination. rel/noreferrer keep the admin surface out
+          of the referrer of a page that is under review precisely because it
+          may be hostile. */}
+      {record.type === "link" &&
+        (externalHref ? (
+          <p className="mb-6 break-all font-mono text-sm">
+            <span className="text-faint">{"// destination "}</span>
+            <a
+              href={externalHref}
+              target="_blank"
+              rel="noopener noreferrer nofollow"
+              className="text-accent underline"
+            >
+              {externalHref}
+            </a>
+          </p>
+        ) : (
+          <p className="mb-6 font-mono text-sm text-danger">
+            {"// destination missing or not a http(s) URL: "}
+            {record.externalUrl ?? "none"}
+          </p>
+        ))}
+
+      {tags.length > 0 && (
+        <div className="mb-6 flex flex-wrap gap-2">
+          {tags.map((t) => (
+            <span
+              key={t.title}
+              className="rounded-sm border border-hairline px-2.5 py-0.5 font-mono text-xs text-muted"
+            >
+              {getCamelCaseFromLower(t.title)}
+            </span>
+          ))}
+        </div>
+      )}
+
+      {record.body ? (
+        <article className="prose max-w-none dark:prose-invert">
+          <PostBody {...renderedBody} />
+        </article>
+      ) : (
+        <p className="font-mono text-sm text-faint">{"// no body submitted"}</p>
+      )}
+
+      <p className="mt-8 font-mono text-xs text-faint">
+        {"// read-only — approve or decline from the queue"}
+      </p>
+    </div>
+  );
+}
diff --git a/app/(app)/[username]/[slug]/page.tsx b/app/(app)/[username]/[slug]/page.tsx
index 3b1a622a..b6e6f8e8 100644
--- a/app/(app)/[username]/[slug]/page.tsx
+++ b/app/(app)/[username]/[slug]/page.tsx
@@ -6,11 +6,10 @@ import { type Metadata } from "next";
 import { SITE_ORIGIN } from "@/config/site";
 import { db } from "@/server/db";
 import { posts, user, feed_sources, post_tags, tag } from "@/server/db/schema";
-import { eq, and, lte, inArray, sql } from "drizzle-orm";
+import { eq, and, lte, inArray, or, sql } from "drizzle-orm";
 import UserLinkDetail from "./_userLinkDetail";
 import PostReader from "@/components/ContentDetail/PostReader";
 import { parseUrlId, canonicalMismatch } from "@/server/lib/content-url";
-import { postVisibilityFilter } from "@/server/lib/postVisibility";
 import { serverApi } from "@/server/trpc/caller";
 import { JsonLd } from "@/components/JsonLd";
 import { getArticleSchema, getBreadcrumbSchema } from "@/lib/structured-data";
@@ -32,7 +31,6 @@ async function getUserPostUncached(
   username: string,
   postSlug: string,
   viewerId?: string | null,
-  viewerIsAdmin = false,
 ) {
   // Case-insensitive handle resolution (GitHub-style), matching the profile page.
   const userRecord = await db.query.user.findFirst({
@@ -42,7 +40,22 @@ async function getUserPostUncached(
 
   if (!userRecord) return null;
 
-  const visibilityFilter = postVisibilityFilter({ viewerId, viewerIsAdmin });
+  // Owner bypass: the author may view their own in_review/rejected post;
+  // everyone else only sees published posts whose publish time has passed.
+  const isAuthor = !!viewerId && viewerId === userRecord.id;
+
+  const visibilityFilter = isAuthor
+    ? or(
+        and(
+          eq(posts.status, "published"),
+          lte(posts.publishedAt, new Date().toISOString()),
+        ),
+        inArray(posts.status, ["in_review", "rejected"]),
+      )
+    : and(
+        eq(posts.status, "published"),
+        lte(posts.publishedAt, new Date().toISOString()),
+      );
 
   const postResults = await db
     .select({
@@ -363,12 +376,7 @@ export async function generateMetadata(props: Props): Promise<Metadata> {
 
   // Same viewerId as the page body so the cache()d resolver runs once per request.
   const session = await getServerAuthSession();
-  const userPost = await getUserPost(
-    username,
-    slug,
-    session?.user?.id,
-    session?.user?.role === "ADMIN",
-  );
+  const userPost = await getUserPost(username, slug, session?.user?.id);
   if (userPost) {
     // Discussions/questions canonicalize to /d/{slug}; redirect before metadata.
     if (isDiscussionKind(userPost.type)) {
@@ -525,12 +533,7 @@ const UnifiedPostPage = async (props: Props) => {
 
   const host = (await headers()).get("host") || "";
 
-  const userPost = await getUserPost(
-    username,
-    slug,
-    session?.user?.id,
-    session?.user?.role === "ADMIN",
-  );
+  const userPost = await getUserPost(username, slug, session?.user?.id);
 
   if (userPost) {
     // Discussions/questions live under /d/{slug} — redirect before rendering.
diff --git a/app/(app)/d/[slug]/page.tsx b/app/(app)/d/[slug]/page.tsx
index cbb5f55e..a7bddbc3 100644
--- a/app/(app)/d/[slug]/page.tsx
+++ b/app/(app)/d/[slug]/page.tsx
@@ -7,12 +7,11 @@ import { ogPostImage } from "@/lib/og/url";
 import { getServerAuthSession } from "@/server/auth";
 import { db } from "@/server/db";
 import { posts, user, post_tags, tag, comments } from "@/server/db/schema";
-import { eq, and, inArray, or, isNull, asc, type SQL } from "drizzle-orm";
+import { eq, and, lte, inArray, or, isNull, asc, type SQL } from "drizzle-orm";
 import PostReader, {
   type ReaderPost,
 } from "@/components/ContentDetail/PostReader";
 import { parseUrlId, canonicalMismatch } from "@/server/lib/content-url";
-import { postVisibilityFilter } from "@/server/lib/postVisibility";
 import { JsonLd } from "@/components/JsonLd";
 import {
   getDiscussionForumPostingSchema,
@@ -27,7 +26,6 @@ type Props = { params: Promise<{ slug: string }> };
 async function getDiscussionPostUncached(
   slug: string,
   viewerId?: string | null,
-  viewerIsAdmin = false,
 ): Promise<ReaderPost | null> {
   const urlId = parseUrlId(slug);
   if (!urlId) return null;
@@ -39,6 +37,13 @@ async function getDiscussionPostUncached(
       ? eq(posts.urlId, urlId)
       : or(eq(posts.urlId, urlId), eq(posts.slug, slug))!;
 
+  const publicFilter = and(
+    eq(posts.status, "published"),
+    lte(posts.publishedAt, new Date().toISOString()),
+  );
+
+  // Owner bypass: the author may view their own in_review/rejected discussion;
+  // everyone else only sees published.
   const [row] = await db
     .select({
       id: posts.id,
@@ -68,7 +73,15 @@ async function getDiscussionPostUncached(
       and(
         idMatch,
         inArray(posts.type, ["discussion", "question"]),
-        postVisibilityFilter({ viewerId, viewerIsAdmin }),
+        viewerId
+          ? or(
+              publicFilter,
+              and(
+                eq(posts.authorId, viewerId),
+                inArray(posts.status, ["in_review", "rejected"]),
+              ),
+            )
+          : publicFilter,
       ),
     )
     .limit(1);
@@ -147,11 +160,7 @@ export async function generateMetadata(props: Props): Promise<Metadata> {
   const { slug } = await props.params;
   // Same viewerId as the page body so the cache()d resolver runs once per request.
   const session = await getServerAuthSession();
-  const post = await getDiscussionPost(
-    slug,
-    session?.user?.id,
-    session?.user?.role === "ADMIN",
-  );
+  const post = await getDiscussionPost(slug, session?.user?.id);
 
   if (!post) {
     return { title: "Discussion Not Found" };
@@ -201,11 +210,7 @@ const DiscussionPage = async (props: Props) => {
   const { slug } = await props.params;
   const session = await getServerAuthSession();
 
-  const post = await getDiscussionPost(
-    slug,
-    session?.user?.id,
-    session?.user?.role === "ADMIN",
-  );
+  const post = await getDiscussionPost(slug, session?.user?.id);
 
   if (!post) return notFound();
 
diff --git a/components/ContentDetail/PostBody.tsx b/components/ContentDetail/PostBody.tsx
new file mode 100644
index 00000000..d7b5798a
--- /dev/null
+++ b/components/ContentDetail/PostBody.tsx
@@ -0,0 +1,90 @@
+import React from "react";
+import Markdoc, { type RenderableTreeNode } from "@markdoc/markdoc";
+import type { JSONContent } from "@tiptap/core";
+import { generateHTML } from "@tiptap/core";
+import sanitizeHtml from "sanitize-html";
+import { markdocComponents } from "@/markdoc/components";
+import { config } from "@/markdoc/config";
+import NotFound from "@/components/NotFound/NotFound";
+import { RenderExtensions } from "@/components/editor/editor/extensions/render-extensions";
+
+// A post body is either tiptap JSON (newer editor) or markdoc source. Both the
+// public reader and the admin moderation preview render it through here, so a
+// moderator approving a post is looking at the same output readers will get.
+
+const parseJSON = (str: string): JSONContent | null => {
+  try {
+    return JSON.parse(str);
+  } catch {
+    return null;
+  }
+};
+
+const renderSanitizedTiptapContent = (jsonContent: JSONContent) => {
+  const rawHtml = generateHTML(jsonContent, [...RenderExtensions]);
+  return sanitizeHtml(rawHtml, {
+    allowedTags: sanitizeHtml.defaults.allowedTags.concat([
+      "img",
+      "iframe",
+      "h1",
+      "h2",
+    ]),
+    allowedAttributes: {
+      ...sanitizeHtml.defaults.allowedAttributes,
+      img: ["src", "alt", "title", "width", "height", "class"],
+      iframe: ["src", "width", "height", "frameborder", "allowfullscreen"],
+      "*": ["class", "id", "style"],
+    },
+    allowedIframeHostnames: [
+      "www.youtube.com",
+      "youtube.com",
+      "www.youtube-nocookie.com",
+    ],
+  });
+};
+
+export function renderPostBody(body: string | null): {
+  isTiptap: boolean;
+  content: string | RenderableTreeNode;
+} {
+  const source = body ?? "";
+  const parsed = parseJSON(source);
+
+  if (parsed?.type === "doc") {
+    return { isTiptap: true, content: renderSanitizedTiptapContent(parsed) };
+  }
+
+  return {
+    isTiptap: false,
+    content: Markdoc.transform(Markdoc.parse(source), config),
+  };
+}
+
+/**
+ * The rendered body only. The heading is the caller's business: the reader
+ * prints the title above markdoc bodies (tiptap bodies carry their own H1),
+ * and the admin preview always shows its own header.
+ */
+export const PostBody = ({
+  isTiptap,
+  content,
+}: ReturnType<typeof renderPostBody>) => {
+  if (isTiptap) {
+    return content ? (
+      <div
+        dangerouslySetInnerHTML={{ __html: content as string }}
+        className="tiptap-content"
+      />
+    ) : (
+      <NotFound />
+    );
+  }
+
+  return (
+    <div>
+      {Markdoc.renderers.react(content, React, {
+        components: markdocComponents,
+      })}
+    </div>
+  );
+};
diff --git a/components/ContentDetail/PostReader.tsx b/components/ContentDetail/PostReader.tsx
index 8b123783..378c6b84 100644
--- a/components/ContentDetail/PostReader.tsx
+++ b/components/ContentDetail/PostReader.tsx
@@ -1,20 +1,12 @@
 import React from "react";
-import type { RenderableTreeNode } from "@markdoc/markdoc";
-import Markdoc from "@markdoc/markdoc";
 import Link from "next/link";
-import type { JSONContent } from "@tiptap/core";
-import { generateHTML } from "@tiptap/core";
-import sanitizeHtml from "sanitize-html";
-import { markdocComponents } from "@/markdoc/components";
-import { config } from "@/markdoc/config";
 import DiscussionArea from "@/components/Discussion/DiscussionArea";
 import { ArticleActionBarWrapper } from "@/components/ArticleActionBar";
 import InlineAuthorBio from "@/components/ContentDetail/InlineAuthorBio";
+import { PostBody, renderPostBody } from "@/components/ContentDetail/PostBody";
 import ArticleAdminPanel from "@/components/ArticleAdminPanel/ArticleAdminPanel";
-import NotFound from "@/components/NotFound/NotFound";
 import { JsonLd } from "@/components/JsonLd";
 import { getCamelCaseFromLower, slugifyTag } from "@/utils/utils";
-import { RenderExtensions } from "@/components/editor/editor/extensions/render-extensions";
 import { getArticleSchema, getBreadcrumbSchema } from "@/lib/structured-data";
 import { db } from "@/server/db";
 import { comments } from "@/server/db/schema";
@@ -52,37 +44,6 @@ export interface ReaderPost {
 
 type ReaderSession = Session | null;
 
-const parseJSON = (str: string): JSONContent | null => {
-  try {
-    return JSON.parse(str);
-  } catch {
-    return null;
-  }
-};
-
-const renderSanitizedTiptapContent = (jsonContent: JSONContent) => {
-  const rawHtml = generateHTML(jsonContent, [...RenderExtensions]);
-  return sanitizeHtml(rawHtml, {
-    allowedTags: sanitizeHtml.defaults.allowedTags.concat([
-      "img",
-      "iframe",
-      "h1",
-      "h2",
-    ]),
-    allowedAttributes: {
-      ...sanitizeHtml.defaults.allowedAttributes,
-      img: ["src", "alt", "title", "width", "height", "class"],
-      iframe: ["src", "width", "height", "frameborder", "allowfullscreen"],
-      "*": ["class", "id", "style"],
-    },
-    allowedIframeHostnames: [
-      "www.youtube.com",
-      "youtube.com",
-      "www.youtube-nocookie.com",
-    ],
-  });
-};
-
 // Mirrors discussion.getContentDiscussionCount so the reader renders the same
 // "Discussion {N}" heading as the source-content reader.
 async function getDiscussionCount(contentId: string) {
@@ -120,25 +81,12 @@ const PostReader = async ({
   commentsDisabledLabel = "post",
   emitArticleSchema = true,
 }: PostReaderProps) => {
-  // Only reachable by the author or an admin (the resolvers only return
-  // non-published posts when viewerId matches the author's id, or the viewer is
-  // an admin previewing from the moderation queue).
+  // Only reachable by the author (the resolver only returns non-published posts
+  // when viewerId matches the author's id).
   const isAwaitingReview = post.status === "in_review";
   const isRejected = post.status === "rejected";
-  const bodyContent = post.body ?? "";
-  const parsedBody = parseJSON(bodyContent);
-  const isTiptapContent = parsedBody?.type === "doc";
-
-  // Tiptap branch: sanitized HTML string. Markdoc branch: the transformed tree,
-  // rendered to React exactly once at the render site below.
-  let renderedContent: string | RenderableTreeNode;
-
-  if (isTiptapContent && parsedBody) {
-    renderedContent = renderSanitizedTiptapContent(parsedBody);
-  } else {
-    const ast = Markdoc.parse(bodyContent);
-    renderedContent = Markdoc.transform(ast, config);
-  }
+  const renderedBody = renderPostBody(post.body);
+  const isTiptapContent = renderedBody.isTiptap;
 
   const articleSchema = emitArticleSchema
     ? getArticleSchema({
@@ -257,24 +205,7 @@ const PostReader = async ({
           <div className="prose mx-auto max-w-none dark:prose-invert lg:prose-lg">
             {!isTiptapContent && <h1>{post.title}</h1>}
 
-            {isTiptapContent ? (
-              renderedContent ? (
-                <div
-                  dangerouslySetInnerHTML={{
-                    __html: renderedContent as string,
-                  }}
-                  className="tiptap-content"
-                />
-              ) : (
-                <NotFound />
-              )
-            ) : (
-              <div>
-                {Markdoc.renderers.react(renderedContent, React, {
-                  components: markdocComponents,
-                })}
-              </div>
-            )}
+            <PostBody {...renderedBody} />
           </div>
 
           {post.tags.length > 0 && (
diff --git a/server/api/router/admin.ts b/server/api/router/admin.ts
index 5431f0f3..13e77f94 100644
--- a/server/api/router/admin.ts
+++ b/server/api/router/admin.ts
@@ -205,19 +205,15 @@ export const adminRouter = createTRPCRouter({
 
   // Auto-moderation queue: posts awaiting human review (status `in_review`).
   // `moderationNote` surfaces WHY a post was flagged (auto-mod reason, etc.).
-  // `excerpt` gives a moderator a first impression in the queue itself, while
-  // `type` and `externalUrl` decide where its Preview link points: /d/{slug}
-  // for discussions and questions, the linked page for shared links, and
-  // /{user}/{slug} for everything the site renders itself.
+  // `excerpt` gives a moderator a first impression in the queue itself; the
+  // full read happens on the preview page, which loads the post by id.
   listInReview: adminOnlyProcedure.query(async ({ ctx }) => {
     const rows = await ctx.db
       .select({
         id: posts.id,
         title: posts.title,
         slug: posts.slug,
-        type: posts.type,
         excerpt: posts.excerpt,
-        externalUrl: posts.externalUrl,
         authorId: posts.authorId,
         authorUsername: user.username,
         authorName: user.name,
diff --git a/server/lib/postVisibility.test.ts b/server/lib/postVisibility.test.ts
deleted file mode 100644
index fb699d22..00000000
--- a/server/lib/postVisibility.test.ts
+++ /dev/null
@@ -1,62 +0,0 @@
-import { describe, expect, it } from "vitest";
-import { PgDialect } from "drizzle-orm/pg-core";
-import { postVisibilityFilter } from "./postVisibility";
-
-const dialect = new PgDialect();
-
-// Statuses and ids are bound as parameters, so the interesting assertions are
-// about which values a viewer's filter binds, not the SQL text.
-const render = (viewer: Parameters<typeof postVisibilityFilter>[0]) => {
-  const { sql, params } = dialect.sqlToQuery(postVisibilityFilter(viewer));
-  return {
-    sql,
-    params,
-    scopesToAuthor: sql.includes('"author_id" = '),
-    allowsUnpublished:
-      params.includes("in_review") && params.includes("rejected"),
-  };
-};
-
-describe("postVisibilityFilter", () => {
-  it("shows an anonymous viewer only live posts", () => {
-    const filter = render({});
-
-    expect(filter.params).toContain("published");
-    expect(filter.sql).toContain('"published_at" <= ');
-    expect(filter.allowsUnpublished).toBe(false);
-  });
-
-  it("lets a signed-in viewer see unpublished posts only when they wrote them", () => {
-    const filter = render({ viewerId: "viewer-1" });
-
-    expect(filter.allowsUnpublished).toBe(true);
-    // The author predicate is what stops one member reading another's drafts.
-    expect(filter.scopesToAuthor).toBe(true);
-    expect(filter.params).toContain("viewer-1");
-  });
-
-  it("lets an admin see unpublished posts by any author", () => {
-    const filter = render({ viewerId: "admin-1", viewerIsAdmin: true });
-
-    expect(filter.allowsUnpublished).toBe(true);
-    expect(filter.scopesToAuthor).toBe(false);
-  });
-
-  it("does not grant the admin bypass on a plain signed-in session", () => {
-    const admin = render({ viewerId: "admin-1", viewerIsAdmin: true });
-    const member = render({ viewerId: "admin-1" });
-
-    expect(member.sql).not.toEqual(admin.sql);
-    expect(member.scopesToAuthor).toBe(true);
-  });
-
-  it("never exposes drafts, whoever is looking", () => {
-    for (const viewer of [
-      {},
-      { viewerId: "viewer-1" },
-      { viewerId: "admin-1", viewerIsAdmin: true },
-    ]) {
-      expect(render(viewer).params).not.toContain("draft");
-    }
-  });
-});
diff --git a/server/lib/postVisibility.ts b/server/lib/postVisibility.ts
deleted file mode 100644
index 55b4d72f..00000000
--- a/server/lib/postVisibility.ts
+++ /dev/null
@@ -1,38 +0,0 @@
-import { and, eq, inArray, lte, or, type SQL } from "drizzle-orm";
-import { posts } from "@/server/db/schema";
-
-/**
- * Who is allowed to see a post that is not live yet.
- *
- * Every reader resolver applies the same rule, so it lives here rather than
- * being restated per route: a post is visible when it is published and its
- * publish time has passed, OR it is awaiting/failed review and the viewer is
- * either its author or an admin. Admins get the author's view so the moderation
- * queue can link straight to a full preview of a post it is asking them to
- * approve.
- *
- * Callers that already pin an author in their WHERE (the /{username}/{slug}
- * resolvers) still get the right answer: the extra authorId predicate here is
- * simply redundant with theirs.
- */
-export function postVisibilityFilter(viewer: {
-  viewerId?: string | null;
-  viewerIsAdmin?: boolean;
-}): SQL {
-  const live = and(
-    eq(posts.status, "published"),
-    lte(posts.publishedAt, new Date().toISOString()),
-  )!;
-
-  const notLiveYet = inArray(posts.status, ["in_review", "rejected"]);
-
-  if (viewer.viewerIsAdmin) {
-    return or(live, notLiveYet)!;
-  }
-
-  if (viewer.viewerId) {
-    return or(live, and(notLiveYet, eq(posts.authorId, viewer.viewerId)))!;
-  }
-
-  return live;
-}