Make sure to check that they are friends.

src/routes/users/find_mutual.rs

@@ -12,8 +12,8 @@ pub async fn req(user: User, target: Ref) -> Result<JsonValue> {
         .find(
             doc! {
                 "$and": [
-                    { "relations._id": &user.id },
-                    { "relations._id": &target.id }
+                    { "relations._id": &user.id, "relations.status": "Friend" },
+                    { "relations._id": &target.id, "relations.status": "Friend" }
                 ]
             },
             FindOptions::builder().projection(doc! { "_id": 1 }).build(),