I don’t think middleware rendering would be the answer here; the cooked post is stored in the database and serialized out over API, so your options begin basically at the serializer (post_serializer.rb) on the way out.
Two potential options:
-
server side: The serializer knows the current user and could manipulate
cookedas it leaves the server. Problems, though: this strikes me as slow as hell, since it’ll have to perform a search-and-possible-replace through every chunk of text that’s getting serialized, which is a lot. It also gets really hairy for live updating, since in that case you’re serializing posts, but you don’t know who they’re going to. -
client side: When cooking the post, you introduce a
secrettag with username attributes, which get deleted from the markup upon hitting the server.
<p data-secret data-reveal-user1 data-reveal-user2>Some secret text</p>
# At some point after the post is rendered, I guess?
$('[data-secret]').not(`[data-reveal-${Discourse.User.current().username}]`).remove()
Unfortunately, someone who’s a bit savvy could still see the cooked text as it comes over in the network request.