Overview
src/users/users.controller.ts exposes a search endpoint that returns User entities. If the serialization layer does not strip sensitive fields, PII such as email addresses, phone numbers, and hashed tokens are returned to any authenticated user performing a search, violating the principle of least privilege.
Specifications
Features:
- Search results must only return non-sensitive fields:
id, displayName, avatarUrl, role.
- Admin-only search endpoints may return additional fields.
Tasks:
- Create a
UserPublicDto containing only safe fields.
- Apply
@Exclude() to sensitive fields in the response serialization for the search endpoint.
- Add a dedicated
UserAdminDto for admin-scoped search results.
- Add unit tests verifying email is absent from non-admin search results.
Impacted Files:
src/users/users.controller.tssrc/users/dto/user-public.dto.ts (new)
Acceptance Criteria
- Non-admin search results do not include
email, refreshToken, or passwordHistory.
- Admin search results include additional fields per the
UserAdminDto.
- Unit tests verify field absence by role.
Overview
src/users/users.controller.tsexposes a search endpoint that returnsUserentities. If the serialization layer does not strip sensitive fields, PII such as email addresses, phone numbers, and hashed tokens are returned to any authenticated user performing a search, violating the principle of least privilege.Specifications
Features:
id,displayName,avatarUrl,role.Tasks:
UserPublicDtocontaining only safe fields.@Exclude()to sensitive fields in the response serialization for the search endpoint.UserAdminDtofor admin-scoped search results.Impacted Files:
src/users/users.controller.tssrc/users/dto/user-public.dto.ts(new)Acceptance Criteria
email,refreshToken, orpasswordHistory.UserAdminDto.