restrict tracked content to permitted users

apps/api/views.py

@@ -498,6 +498,17 @@ class TrackedContent_ListView(generics.ListCreateAPIView):
 
         return self.read_serializer_class
 
+    def get_queryset(self):
+        if self.request.user.is_superuser:
+            return TrackedContent.objects.all()
+
+        saved_guilds = SavedGuilds.objects.filter(added_by=self.request.user)
+        guild_ids = [guild.guild_id for guild in saved_guilds]
+
+        return TrackedContent.objects.filter(subscription__guild_id__in=guild_ids)
+
+        # return GuildSettings.objects.filter(guild_id__in=guild_ids)
+
     def post(self, request):
         serializer = self.get_serializer(data=request.data)
         serializer.is_valid(raise_exception=True)