User.status/is_enabled: make explicit opt in override implicit profile opt-outs

...like Bluesky's hide from logged in views. fixes #1052

models.py

@@ -368,7 +368,7 @@ class User(StringIdModel, metaclass=ProtocolUserMeta):
         if self.manual_opt_out:
             return 'opt-out'
 
-        if not self.obj or not self.obj.as1:
+        if self.enabled_protocols or not self.obj or not self.obj.as1:
             return None
 
         if self.REQUIRES_AVATAR and not self.obj.as1.get('image'):
@@ -392,7 +392,7 @@ class User(StringIdModel, metaclass=ProtocolUserMeta):
                 if tag in text:
                     return 'opt-out'
 
-    def is_enabled(self, to_proto):
+    def is_enabled(self, to_proto, explicit=False):
         """Returns True if this user can be bridged to a given protocol.
 
         Reasons this might return False:
@@ -400,9 +400,12 @@ class User(StringIdModel, metaclass=ProtocolUserMeta):
         * The user is opted out or blocked.
         * The user is on a domain that's opted out or blocked.
         * The from protocol requires opt in, and the user hasn't opted in.
+        * ``explicit`` is True, and this protocol supports ``to_proto`` by
+          default, but the user hasn't explicitly opted into it.
 
         Args:
           to_proto (Protocol subclass)
+          explicit (bool)
 
         Returns:
           bool:
@@ -433,7 +436,7 @@ class User(StringIdModel, metaclass=ProtocolUserMeta):
         elif self.status:
             return False
 
-        elif to_label in self.DEFAULT_ENABLED_PROTOCOLS:
+        elif to_label in self.DEFAULT_ENABLED_PROTOCOLS and not explicit:
             return True
 
         return False

tests/test_models.py

@@ -12,6 +12,7 @@ from cryptography.hazmat.primitives import serialization
 from flask import g
 from google.cloud import ndb
 from google.cloud.tasks_v2.types import Task
+from granary.bluesky import NO_AUTHENTICATED_LABEL
 from granary.tests.test_bluesky import ACTOR_AS, ACTOR_PROFILE_BSKY
 from multiformats import CID
 from oauth_dropins.webutil.appengine_config import tasks_client
@@ -363,14 +364,40 @@ class UserTest(TestCase):
         self.assertFalse(ExplicitEnableFake(id='').is_enabled(Fake))
         self.assertFalse(ExplicitEnableFake(id='').is_enabled(Web))
 
+    def test_is_enabled_default_enabled_protocols_explicit(self):
+        self.user.enabled_protocols = ['atproto']
+        self.assertTrue(self.user.is_enabled(ATProto, explicit=True))
+
+        assert 'activitypub' in Web.DEFAULT_ENABLED_PROTOCOLS
+        self.assertFalse(self.user.is_enabled(ActivityPub, explicit=True))
+
     def test_is_enabled_enabled_protocols_overrides_bio_opt_out(self):
         user = self.make_user('eefake:user', cls=ExplicitEnableFake,
                               obj_as1={'summary': '#nobridge'})
         self.assertFalse(user.is_enabled(Web))
+        self.assertEqual('opt-out', user.status)
 
         user.enabled_protocols = ['web']
         user.put()
         self.assertTrue(user.is_enabled(Web))
+        self.assertIsNone(user.status)
+
+    def test_is_enabled_enabled_protocols_overrides_non_public_profile_opt_out(self):
+        self.store_object(id='did:plc:user', raw=DID_DOC)
+        user = self.make_user('did:plc:user', cls=ATProto,
+                              obj_bsky={
+                                  **ACTOR_PROFILE_BSKY,
+                                  'labels': {
+                                      'values': [{'val': NO_AUTHENTICATED_LABEL}],
+                                  },
+                              })
+        self.assertFalse(user.is_enabled(Web))
+        self.assertEqual('opt-out', user.status)
+
+        user.enabled_protocols = ['web']
+        user.put()
+        self.assertTrue(user.is_enabled(Web))
+        self.assertIsNone(user.status)
 
     def test_is_enabled_manual_opt_out(self):
         user = self.make_user('user.com', cls=Web)