Candidate sync exclude hidden

crates/graze-api/src/config.rs

@@ -118,6 +118,8 @@ pub struct Config {
     pub special_posts_source: String,
     /// API base URL when special_posts_source is remote.
     pub special_posts_api_base: String,
+    /// Bearer token for authenticating with the special posts API.
+    pub special_posts_api_token: String,
 
     // ═══════════════════════════════════════════════════════════════════════════════
     // Feed Access Sync Configuration
@@ -334,6 +336,10 @@ impl Config {
             )
             .trim()
             .to_string(),
+            special_posts_api_token: std::env::var("SPECIAL_POSTS_API_TOKEN")
+                .unwrap_or_default()
+                .trim()
+                .to_string(),
 
             // Feed Access Sync
             feed_access_sync_enabled: parse_bool_env("FEED_ACCESS_SYNC_ENABLED", true),

crates/graze-api/src/main.rs

@@ -97,6 +97,7 @@ async fn main() -> anyhow::Result<()> {
     } else {
         SpecialPostsSource::Remote {
             api_base_url: config.special_posts_api_base.clone(),
+            api_token: config.special_posts_api_token.clone(),
         }
     };
     let special_posts = Arc::new(SpecialPostsClient::new(redis.clone(), special_posts_source));

crates/graze-common/src/clickhouse/reader.rs

@@ -32,7 +32,8 @@ pub struct CandidateQueryParams {
 
 /// ClickHouse-backed candidate source.
 ///
-/// Use when `CANDIDATE_SOURCE=clickhouse`. Queries `algorithm_posts_v2`.
+/// Use when `CANDIDATE_SOURCE=clickhouse`. Queries `algorithm_posts_v2` and
+/// excludes posts marked hidden in `hidden_status` (same semantics as feed queries).
 pub struct ClickHouseCandidateSource {
     http_client: Client,
     config: Arc<ClickHouseConfig>,
@@ -69,13 +70,19 @@ impl ClickHouseCandidateSource {
         );
 
         let query = r#"
-            SELECT uri
-            FROM {database:Identifier}.algorithm_posts_v2
-            WHERE algo_id = {algo_id:Int32}
-              AND bluesky_created_at >= {min_time:DateTime}
-              AND bluesky_created_at <= created_at + INTERVAL 1 HOUR
-              AND bluesky_created_at <= now()
-            ORDER BY bluesky_created_at DESC
+            SELECT p.uri
+            FROM {database:Identifier}.algorithm_posts_v2 p
+            LEFT JOIN (
+                SELECT uri, hidden
+                FROM {database:Identifier}.hidden_status
+                WHERE algo_id = {algo_id:Int32}
+            ) h ON p.uri = h.uri
+            WHERE p.algo_id = {algo_id:Int32}
+              AND COALESCE(h.hidden, false) = false
+              AND p.bluesky_created_at >= {min_time:DateTime}
+              AND p.bluesky_created_at <= p.created_at + INTERVAL 1 HOUR
+              AND p.bluesky_created_at <= now()
+            ORDER BY p.bluesky_created_at DESC
             LIMIT {limit:Int32}
             FORMAT JSONCompact
         "#;

crates/graze-common/src/services/special_posts.rs

@@ -28,6 +28,8 @@ pub enum SpecialPostsSource {
     Remote {
         /// Base URL (e.g. "https://api.graze.social/app/my_feeds").
         api_base_url: String,
+        /// Bearer token for authenticating with the special posts API.
+        api_token: String,
     },
 }
 
@@ -136,9 +138,12 @@ impl SpecialPostsClient {
                 debug!(algo_id, "special_posts_local_miss");
                 Ok(SpecialPostsResponse::empty(algo_id))
             }
-            SpecialPostsSource::Remote { api_base_url } => {
+            SpecialPostsSource::Remote {
+                api_base_url,
+                api_token,
+            } => {
                 debug!(algo_id, "special_posts_cache_miss");
-                let response = self.fetch_from_api(algo_id, api_base_url).await;
+                let response = self.fetch_from_api(algo_id, api_base_url, api_token).await;
 
                 self.store_in_cache(&cache_key, &response).await;
 
@@ -180,11 +185,22 @@ impl SpecialPostsClient {
     }
 
     /// Fetch special posts from the external API.
-    async fn fetch_from_api(&self, algo_id: i32, api_base_url: &str) -> SpecialPostsResponse {
+    async fn fetch_from_api(
+        &self,
+        algo_id: i32,
+        api_base_url: &str,
+        api_token: &str,
+    ) -> SpecialPostsResponse {
         let url = format!("{}/{}/special-posts", api_base_url, algo_id);
         let start = std::time::Instant::now();
 
-        match self.http_client.get(&url).send().await {
+        match self
+            .http_client
+            .get(&url)
+            .bearer_auth(api_token)
+            .send()
+            .await
+        {
             Ok(response) => {
                 let fetch_time_ms = start.elapsed().as_millis();