Skip to content

fix(users): mask PII in search endpoint response#1062

Open
boalambo wants to merge 1 commit into
rinafcode:mainfrom
boalambo:feat/pii-mask-user-search-879
Open

fix(users): mask PII in search endpoint response#1062
boalambo wants to merge 1 commit into
rinafcode:mainfrom
boalambo:feat/pii-mask-user-search-879

Conversation

@boalambo

Copy link
Copy Markdown
Contributor
  • Add UserPublicDto exposing only id, displayName, avatarUrl, role
  • Add UserAdminDto (extends UserPublicDto) for admin-scoped results with email, status, isEmailVerified
  • Add UsersController with GET /users search endpoint, role-gated DTO selection
  • Add UsersService.searchUsers with query builder, fix role relation join and search predicate
  • Register UsersModule in AppModule
  • Add unit tests verifying email/refreshToken/passwordHistory absence for non-admin results and presence of admin fields for admin results

Closes #879

- Add UserPublicDto exposing only id, displayName, avatarUrl, role
- Add UserAdminDto (extends UserPublicDto) for admin-scoped results with email, status, isEmailVerified
- Add UsersController with GET /users search endpoint, role-gated DTO selection
- Add UsersService.searchUsers with query builder, fix role relation join and search predicate
- Register UsersModule in AppModule
- Add unit tests verifying email/refreshToken/passwordHistory absence for non-admin results and presence of admin fields for admin results

Closes rinafcode#879
@drips-wave

drips-wave Bot commented Jul 23, 2026

Copy link
Copy Markdown

@boalambo Great news! 🎉 Based on an automated assessment of this PR, the linked Wave issue(s) no longer count against your application limits.

You can now already apply to more issues while waiting for a review of this PR. Keep up the great work! 🚀

Learn more about application limits

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

Add PII field masking in user search endpoint response to prevent data exposure

1 participant