Filter sensitive user data out of user list response

powerhome · Dec 19, 2024 · 82b2039 · 82b2039
1 parent b5a7f72
commit 82b2039
Show file tree

Hide file tree

Showing 4 changed files with 4 additions and 4 deletions.
diff --git a/audiences/app/controllers/audiences/contexts_controller.rb b/audiences/app/controllers/audiences/contexts_controller.rb
@@ -17,7 +17,7 @@ def users
                                limit: params[:limit],
                                offset: params[:offset])
 
-      render json: search
+      render json: search, only: %w[id externalId displayName photos]
     end
 
   private

diff --git a/audiences/app/models/audiences/external_user.rb b/audiences/app/models/audiences/external_user.rb
@@ -29,7 +29,7 @@ def self.wrap(resources)
     end
 
     def as_json(*)
-      data.as_json
+      data.as_json(*)
     end
   end
 end
diff --git a/audiences/app/models/audiences/users_search.rb b/audiences/app/models/audiences/users_search.rb
@@ -13,7 +13,7 @@ def initialize(query:, limit: nil, offset: 0, scope: ExternalUser)
 
     def as_json(*)
       {
-        users: users,
+        users: users.as_json(*),
         count: count,
       }
     end

diff --git a/audiences/spec/controllers/contexts_controller_spec.rb b/audiences/spec/controllers/contexts_controller_spec.rb
@@ -158,7 +158,7 @@
       criterion.users.create!([
                                 { user_id: 1, data: { "externalId" => 1, "displayName" => "John" } },
                                 { user_id: 2, data: { "externalId" => 2, "displayName" => "Jose" } },
-                                { user_id: 3, data: { "externalId" => 3, "displayName" => "Nelson" } },
+                                { user_id: 3, data: { "externalId" => 3, "displayName" => "Nelson", "confidential" => "data" } },
                               ])
 
       get :users, params: { key: example_context.signed_key, criterion_id: criterion.id }