fix(security): use `PublicUserResponse` on `/users` #57

New issue

Closed

opened 2025-08-12 08:59:57 +00:00 by chartgerink · 0 comments

chartgerink commented

2025-08-12 08:59:57 +00:00

Owner

In #56 I re-introduced the regular UserResponse by oversight. This issue tracks the work to enable the PublicUserResponse instead.

Addressing this requires adding a test for this, which fails if some/all elements in the difference between the responses are present. The regular response returns too much sensitive information:

[
  {
    "id": "3db56428-76c7-11f0-956e-4b8ad17af044",
    "created_at": "2025-08-11T15:24:15",
    "updated_at": "2025-08-11T15:24:15",
    "email": "chris@example.com",
    "password_hash": "fdlksjfdsljaf",
    "email_verified": false,
    "otp_enabled": false,
    "otp_verified": false,
    "otp_base32": null,
    "username": "flkadjsflk",
    "given_name": "dflksajfldksj",
    "surname": "dslkfalfkjsd",
    "avatar_s3": null
  },
  {
    "id": "659e9b18-76a8-11f0-956e-4b8ad17af044",
    "created_at": "2025-08-11T11:43:27",
    "updated_at": "2025-08-11T11:43:27",
    "email": "test@example.com",
    "password_hash": "fdlksjfdsljaf",
    "email_verified": false,
    "otp_enabled": false,
    "otp_verified": false,
    "otp_base32": null,
    "username": "libscie",
    "given_name": "Liberate",
    "surname": "Science",
    "avatar_s3": null
  }
]

In #56 I re-introduced the regular `UserResponse` by oversight. This issue tracks the work to enable the `PublicUserResponse` instead. Addressing this requires adding a test for this, which fails if some/all elements in the difference between the responses are present. The regular response returns too much sensitive information: ```json [ { "id": "3db56428-76c7-11f0-956e-4b8ad17af044", "created_at": "2025-08-11T15:24:15", "updated_at": "2025-08-11T15:24:15", "email": "chris@example.com", "password_hash": "fdlksjfdsljaf", "email_verified": false, "otp_enabled": false, "otp_verified": false, "otp_base32": null, "username": "flkadjsflk", "given_name": "dflksajfldksj", "surname": "dslkfalfkjsd", "avatar_s3": null }, { "id": "659e9b18-76a8-11f0-956e-4b8ad17af044", "created_at": "2025-08-11T11:43:27", "updated_at": "2025-08-11T11:43:27", "email": "test@example.com", "password_hash": "fdlksjfdsljaf", "email_verified": false, "otp_enabled": false, "otp_verified": false, "otp_base32": null, "username": "libscie", "given_name": "Liberate", "surname": "Science", "avatar_s3": null } ] ```