@Claude_Bot log this so it can be investigated and fixed.

I'm experiencing some issues which I want to point out- hopefully there is a way for you to solve those:

1. Despite not being logged-in flarum I can open and read the Group Discussions. Flarum permissions are set to allow only logged-in users to see discussions, so I would expect that to be congruent. I actually get an error when I open a Group '{"errors":[{"status":"401","code":"not_authenticated"}]}' but it still renders the full discussion. (I'm on macOS with Safari)
2. I can not reply to any group posts '{"data":[],"included":[],"meta":{"page":{"total":0,"offset":0,"limit":20}},"links":[],"jsonapi":{"version":"1.1"}}'
3. I do not see the TextEditor-controls Composer-footer, so I can not format any posts within Groups.

Thanks for the detailed report — and glad you're enjoying the extension! These are good catches. Let me make sure they get logged properly, but I can't confirm whether they're definitive bugs or planned changes — I'll flag them for the team to confirm.

To help them reproduce, could you share a few details:

1. Social Groups version (and the exact version, e.g. from composer show ernestdefoe/social-groups)
2. Flarum version
3. Whether you have flarum/realtime and fof/upload installed
4. The exact steps to reproduce each issue (you've described them well — just confirm: logged-out, navigating directly to a group URL vs. via a link?)

A couple of quick notes on what you've described:

• Issue 1 (logged-out users can read private/restricted group content): This sounds like a visibility/permission concern worth a closer look. The 401 you're seeing on the group endpoint suggests the API is enforcing auth, but the discussion still rendering points to a possible client-side render path. Definitely flagging this for review.
• Issues 2 & 3 (can't reply / no composer controls when logged out): This may be expected behavior since posting requires authentication — but I'll let the team confirm whether the missing editor footer is intended or a display glitch.

And yes, further debug testing is welcome — browser console errors and your server flarum.log entries when reproducing would be very helpful for the team.

One scheduling note: live support hours are Mon–Thu 7–10pm CT, Fri 3–10pm CT, and all day Sat/Sun (US Central Time). The team will follow up to confirm during those hours.

Flarum 2.0.0-rc.3

Social Groups v2.3.66

when trying to reply to a group post, i get the error: "You do not have permission to do that" and in Safari Web Inspector:

[Error] Failed to load resource: the server responded with a status of 403 () (social-group-posts, line 0)

My Permissions for Social Groups in Admin settings are:

Create Social Groups: Members

Edit & delete any social group: Admins

I see no further permission settins in the Admin > Permissions table for the Social Groups extension. All Discussions replies work as expected. (saved, show the composer).

loading the /groups url loads the site, despite not being logged in and everything is restricted for members only. I get a browser log: [Error] Failed to load resource: the server responded with a status of 401 () (social-group-members, line 0) - but the site still loads and shows all posts within groups.

@"flavour1"#p415 Social Groups v2.3.66

when trying to reply to a group post, i get the error: "You do not have permission to do that" and in Safari Web Inspector:

[Error] Failed to load resource: the server responded with a status of 403 () (social-group-posts, line 0)

My Permissions for Social Groups in Admin settings are:

Create Social Groups: Members

Edit & delete any social group: Admins

I see no further permission settins in the Admin > Permissions table for the Social Groups extension. All Discussions replies work as expected. (saved, show the composer).

@"flavour1"#p416 loading the /groups url loads the site, despite not being logged in and everything is restricted for members only. I get a browser log: [Error] Failed to load resource: the server responded with a status of 401 () (social-group-members, line 0) - but the site still loads and shows all posts within groups.

@Claude_Bot add these to be investigated and fixed.

Thanks for the detailed report — this is really helpful. I've noted these for the team to investigate. Let me make sure I've captured everything correctly:

Environment (please confirm so the team has full detail):

• Social Groups version?
• Flarum version?
• Browser/OS: macOS + Safari ✅

Issues logged:

1. Private group content visible when logged out — Group discussions still render even though Flarum permissions restrict viewing to logged-in users. Console shows a 401 not_authenticated (social-group-members), but the content displays anyway.
2. Cannot reply to group posts — reply attempt returns an empty data payload ({"data":[],...}); another user reported a 403 "You do not have permission to do that" on the same action.
3. Missing composer formatting controls — the TextEditor footer controls don't appear in the Groups composer, so posts can't be formatted.

A couple of things that would help the team narrow this down:

• The exact steps to reproduce for #2 (e.g., public vs. private group, your role in the group).
• Your Social Groups permission settings under Admin → Permissions (one earlier report showed only "Create Social Groups" and "Edit & delete any social group" with no reply-specific permission).

I can't confirm whether these are bugs or whether/when fixes will ship — flagging this for the team to confirm. Live support runs Mon–Thu 7–10pm, Fri 3–10pm, and all day Sat/Sun (US Central Time), and they'll follow up then.

social-groups v2.3.67

What's Changed

• Enforce the core viewForum permission in group visibility — fixes group discussions/posts leaking to actors who lack viewForum on login-restricted forums (and the 401-while-content-shows inconsistency) (#5)
• Document why 5 migrations intentionally stay raw (audit #1 — not a defect)

Full Changelog: https://github.com/ernestdefoe/social-groups/compare/v2.3.66...v2.3.67

View release on GitHub

Social Groups version v2.3.67

Flarum version 2.0.0-rc.3

restricted permission for non logged-in visitors now works as expected. when trying to open the /groups/… url, I get a error message: "Failed to load group." and still an error modal "The requested resource was not found." which could be removed, as it is no error, but intended).

---

Unfortuantely there are still some bugs that prevent the extension from being usable:

- The SGFeed-composer area is not dynamic, so when i paste some content that fills up the space, I can not edit it anymore.

- I still see no composer formatting controls, except the buttons from fof/upload and fof/polls

- I can not reply to posts: [Error] Failed to load resource: the server responded with a status of 403 () (social-group-posts, line 0) and error modal: "You do not have permission to do that." (reactions do work by the way)

- When I type anything that should get embeded, like image links or urls, the embedd is not rendered when posting. Only a website reload displays it correctly.

- I can not edit posts as an admin, only delete the (whole?) discussion

- uploaded images (voa fof/upload) do not show in the SGMedia tab.

- SGMedia-lightboxAuthor link opens a auto-generated discussion named gallery (gallery) – interestingly in there the FormControl SGThread-editTextarea works dynamically but editing and replying do not work: "Failed to save edit." "Error" "You do not have permission to do that."

@"flavour1"#p424 Will look at this this weekend. Sorry for the delay. On the issue of embedded items I didn't include this in the build but will look into adding it. I'll try to get this update done this weekend.

@"Claude_Bot"#10 add these issues to be looked into please.

Social Groups version v2.3.67

Flarum version 2.0.0-rc.3

restricted permission for non logged-in visitors now works as expected. when trying to open the /groups/… url, I get a error message: "Failed to load group." and still an error modal "The requested resource was not found." which could be removed, as it is no error, but intended).

---

Unfortuantely there are still some bugs that prevent the extension from being usable:

- The SGFeed-composer area is not dynamic, so when i paste some content that fills up the space, I can not edit it anymore.

- I still see no composer formatting controls, except the buttons from fof/upload and fof/polls

- I can not reply to posts: [Error] Failed to load resource: the server responded with a status of 403 () (social-group-posts, line 0) and error modal: "You do not have permission to do that." (reactions do work by the way)

- When I type anything that should get embeded, like image links or urls, the embedd is not rendered when posting. Only a website reload displays it correctly.

- I can not edit posts as an admin, only delete the (whole?) discussion

- uploaded images (voa fof/upload) do not show in the SGMedia tab.

- SGMedia-lightboxAuthor link opens a auto-generated discussion named gallery (gallery) – interestingly in there the FormControl SGThread-editTextarea works dynamically but editing and replying do not work: "Failed to save edit." "Error" "You do not have permission to do that."

Thanks for the detailed report — that's really helpful. I can't fix code or guarantee fixes myself, but I'll log these clearly for the team to investigate:

Logged for review (Social Groups v2.3.66, Flarum 2.0.0-rc.3):

1. Reply returns 403 "You do not have permission to do that" — posting to social-group-posts fails even though regular Flarum discussion replies work. Current permissions: Create Social Groups = Members, Edit & delete any social group = Admins; no other Social Groups permission rows appear in Admin → Permissions.

2. Non-logged-in visitors can still load /groups and view group content — a 401 is logged for social-group-members, but the page still renders all posts despite forum-wide member-only restrictions.

A few things that'll help the team reproduce and confirm:

• Are you a group member (or admin) of the group where the reply fails? Some actions depend on group membership rather than only forum permissions.
• Exact steps: which group (public/private), and the precise click sequence before the 403.
• Whether flarum/realtime and fof/upload are installed.

I'll flag both items for the team to confirm whether they're bugs and how to resolve them. Live support runs Mon–Thu 7–10pm, Fri 3–10pm, Sat–Sun all day (US Central Time) — they'll follow up during those hours.

social-groups v2.3.68

Fixes reported by flavour1 (ernestdefoe.online/d/8): the group-feed composer no longer becomes uneditable after a large paste (it now grows to 40vh then scrolls), and opening an unknown/private group renders an inline 'not found' message instead of a spurious global error modal.

View release on GitHub

social-groups v2.3.69

Fixes the 403 'You do not have permission to do that' when an admin or global moderator (who isn't a member of the group) tries to reply to a group post — the post-create hook now grants the same admin/moderator bypass the React/Delete/Pin policies already have.

View release on GitHub

@flavour1 try this new update and see if your issues are fixed please. Report back what isn't working as it should so it can be fixed. Thank you for reporting the problems you were having. Sorry the fix took so long to get done.

social-groups v2.4.0

Fixes 5 issues reported on the support forum (d/8, by flavour1) and adds a markdown formatting toolbar.

Fixed

• Embeds/formatting now render immediately after posting in the feed (previously the new card showed only the bare title until a page reload).
• Admins can edit posts again — the Edit action is now exposed in the feed and thread for admins, matching the edit policy.
• Images shared in the feed now appear in the Media tab (only the hidden gallery archive was scanned before; inline emoji are excluded).
• The Media lightbox no longer links gallery uploads to the hidden container discussion where edit/reply returned 403 — the "View post" jump is shown only for real feed posts.
• Replies by admins/global moderators in any group without joining first (carried over from the prior 403 fix).

Added

• Markdown formatting toolbar (bold, italic, strikethrough, link, quote, list, inline code) on the feed and thread composers and the post editors.

Update:

php flarum cache:clear```

[View release on GitHub](https://github.com/ernestdefoe/social-groups/releases/tag/v2.4.0)

Thank you for working on the extension!

I updated to v2.4.0 but still experiencing major issues.

reply and search are still not working and resulting in a permission error message.

I even encoutered this at https://shatteredpact.com/groups/shattered-pact-raid-group - just opening the site gives me the error:

I'm on macOS 15.7.7 with Safari 26.5.2

Maybe you can give me some hints on how to best debug this?

@"flavour1"#p449 Tell me what all issues you are having? I'm not sure why you are getting that error on Shattered Pact that is a public group. Tell me what it says when you go into the Mac version of Console. It's like option, command, and I or something like that. If I was at my Mac i could tell you.

Yes, it is really weird.

I open (view) the social group and it loads the site with the error message:

[Error] Failed to load resource: the server responded with a status of 401 () (social-group-members, line 0)

Do you have a chance to test with a WebKit-based browser?

@"flavour1"#p451 I'm not near my Mac now so no I don't have access to a Webkit based browser.

social-groups v2.4.1

Bug fixes

• Guests can now view members of public groups. GET /api/social-group-members was returning 401 for guests on public groups because the resource scope called assertRegistered() before the visibility check. Registration is no longer required to list a public group's members; private groups still return 403 for non-members.
• Group avatar color disc now only paints behind the initial-letter fallback, never behind an uploaded icon image (previously the disc could bleed through transparent-PNG logos).

Full Changelog: https://github.com/ernestdefoe/social-groups/compare/v2.4.0...v2.4.1

View release on GitHub

Interesting… https://shatteredpact.com/groups/shattered-pact-raid-group loads without an error now!

But when I update to v2.4.1 on my forum (flarum2.0.0-rc.4) i still get the error when i want to reply to a post within a group.

[Error] Failed to load resource: the server responded with a status of 403 () (social-group-posts, line 0)

@"flavour1"#p454 that's odd. But replying is different than viewing as a guest. I will ask Claude to look into the issue you just posted.

social-groups v2.4.2

Bug fix

• Fixed a 403 when replying in a group you can see but haven't joined. The thread UI showed a reply composer to any logged-in user, but the backend only accepts replies from active group members (and admins/global moderators). A logged-in non-member viewing a public group therefore got a composer that returned 403 (social-group-posts) on submit.

The discussion API now exposes a canReply capability that mirrors the backend write gate exactly, and the composer + per-post reply buttons are gated on it. Non-members see a "Join this group to reply" hint instead of a failing composer. Reported by flavour1.

Full Changelog: https://github.com/ernestdefoe/social-groups/compare/v2.4.1...v2.4.2

View release on GitHub

Logged. Consolidating everything reported by @flavour1 and Ernest across this thread into one tracked issue list for Social Groups (against Social Groups v2.3.67 / Flarum 2.0.0-rc.3):

Permissions / access

1. Guest access leak — non-logged-in visitors could open and read group discussions even with view restricted to members; the API correctly returned 401 not_authenticated but the client still rendered the content. Reported fixed in v2.3.67 — restriction now enforced. Remaining polish: opening a /groups/… URL as a guest now shows "Failed to load group." plus a "The requested resource was not found." error modal — this is expected behavior, so the modal should be suppressed rather than surfaced as an error.
2. Cannot reply to group posts — POST social-group-posts returns 403 / "You do not have permission to do that." with permissions set to Create Social Groups: Members, Edit & delete any: Admins. No reply-level permission is exposed in Admin → Permissions, and normal discussion replies work fine — points to a missing/incorrect policy check on the post-create endpoint.
3. Cannot edit posts as admin — only deletion of the whole discussion is available; per-post edit is missing.

Composer / editor

4. No formatting controls — the group composer footer shows no TextEditor controls; only third-party buttons (fof/upload, fof/polls) appear.
5. SGFeed composer not dynamic — the input area doesn't grow with content, so once pasted content fills the space it can no longer be edited.
6. Embeds not rendered on submit — image links / URLs only render after a full page reload, not immediately on post.

Media

7. Uploads missing from SGMedia — images uploaded via fof/upload don't appear in the SGMedia tab.
8. SGMedia lightbox author link opens an auto-generated discussion named "gallery"; inside it, editing and replying both fail with "Failed to save edit." / "You do not have permission to do that." (reactions do work).

I've captured all of the above so nothing is lost. @flavour1 — thanks for the thorough repro steps and browser-console details; that's exactly what makes these fixable. Ernest has noted he'll work through these; I'll leave the roadmap/timeline and any fix confirmations to @ernestdefoe.

@flavour1 I released a new version that should fix the the reply to post function. It was essentially the same issue as viewing groups.

social-groups v2.4.3

Bug fix

• Fixed the 403 when replying to or editing group posts — for everyone, not just non-members. The social-group-posts resource declared discussionId, content, linkPreview and parentPostId as read-only fields while the create/update hooks consumed them from the request body. Flarum 2 rejects any request whose body contains a declared-but-unwritable field (403 — Field [discussionId] is not writable), so every reply and post edit failed regardless of membership or permissions. The fields are now writable with no-op setters, keeping the lifecycle hooks as the single writers so the membership gate, reply flattening and link-preview sanitization still apply. Reported by flavour1 — thank you for the persistence, this was the real cause behind the earlier reports.
• Fixed the v2.4.2 composer gate. The thread read canReply as a method on a plain object (a TypeError) and the client-side projection never included the attribute. Members now correctly get the composer; non-members get the "Join this group to reply" hint; admins and global moderators can also comment from the feed without joining.

Update:

php flarum cache:clear```

**Full Changelog**: https://github.com/ernestdefoe/social-groups/compare/v2.4.2...v2.4.3

[View release on GitHub](https://github.com/ernestdefoe/social-groups/releases/tag/v2.4.3)