AMOENG-2407 - Use FullUserProfileSerializer for the lookup API endpoint

Author: bakulf

docs/topics/api/accounts.rst

@@ -110,15 +110,15 @@ Account Lookup
 .. note::
     This API requires :doc:`authentication <auth>` and ``Users:Lookup`` permission.
 
-This endpoint looks up one or more accounts by email address and returns their full details.
+This endpoint looks up one or more accounts by email address.
 Since multiple accounts can share the same email address, the response is always a list.
 Deleted accounts are excluded from results.
 
 .. http:get:: /api/v5/accounts/account/lookup/
 
     :query string email: The email address to look up.
 
-    Returns a list of :ref:`account objects <account-object-self>`.
+    Returns a list of :ref:`account objects <account-object>`.
 
     :statuscode 200: account(s) found.
     :statuscode 400: ``email`` query parameter is missing.

src/olympia/accounts/tests/test_views.py

@@ -1409,8 +1409,9 @@ def test_lookup_by_email(self):
         response = self.get(self.url, data={'email': self.target_user.email})
         assert response.status_code == 200
         assert len(response.data) == 1
-        assert response.data[0]['email'] == self.target_user.email
         assert response.data[0]['id'] == self.target_user.pk
+        assert 'email' not in response.data[0]
+        assert 'last_login_ip' not in response.data[0]
 
     def test_lookup_multiple_users_same_email(self):
         # Multiple accounts can share the same email (no unique constraint).

src/olympia/accounts/views.py

@@ -559,7 +559,7 @@ def lookup(self, request):
         )
         if not users.exists():
             raise exceptions.NotFound()
-        serializer = SelfUserProfileSerializer(
+        serializer = FullUserProfileSerializer(
             users, many=True, context={'request': request}
         )
         return Response(serializer.data)