Repository navigation
fix(users): stop leaking password digests and SSO tokens - #461
Merged
Merged
Conversation
/users/metadata/search, create and update rendered the raw Model::User, whose default JSON includes password_digest, access_token and refresh_token. Render the public / admin views instead: admin and support users get the admin view on search and create, and on update so does the user editing their own profile. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Align index and show with search: admin and support users get the admin view (sys_admin, support, misc, ...), everyone else the public view. Cross-authority listing remains admin-only. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
github-actions
Bot
added
type: bug
The view structs omit nil fields, so login_name and card_number were missing from the admin view of the fixture users. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
github-actions
Bot
added
type: bug
This was referenced Nov 12, 2026
stakach
added a commit
that referenced
this pull request
Nov 12, 2026
* fix(group_users): stop leaking password digests and SSO tokens The group_users index hydrates each row with its user so the frontend can render a member list without an N+1 fetch. It embedded the raw `Model::User`, whose default JSON includes `password_digest`, `access_token`, `refresh_token`, `expires_at` and `expires`. Any group manager (not only admins) could read them for every member. Embed `User::PublicResponse` (`to_public_struct`) instead, matching what #461 did for the users controller. OPENAPI_DOC.yml is regenerated: `GroupUser.user` now references `PlaceOS.Model.User.PublicResponse`, and it also picks up the /users response schema changes from #461, which were never regenerated. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix: stop leaking chats, OAuth secrets, pending mail and API key owners - chatgpt: show, destroy and websocket resume only resolve the caller's own chat; anyone else's is a 404 (resume is checked before the upgrade) - oauth_apps: index returns a secret-free view to non-admins - flux: refuse guest tokens, any signed in user can still query - emails: index and show are support / admin only - api_keys: embed the owner as User::AdminResponse instead of the raw model, which serialised the password digest and SSO tokens Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> --------- Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com> Co-authored-by: Stephen von Takach <steve@place.technology>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
GET /api/engine/v2/users/metadata/searchreturned rawModel::Userrecords. Their default JSON includespassword_digestand the Microsoftaccess_token/refresh_token, plus admin-only fields such assys_admin, and every authenticated user received all of it.POST /usersandPATCH/PUT /users/:idhad the same leak.user_details(user, admin_view)helper rendersto_admin_struct/to_public_struct. Neither includes secrets.user_support?), public view for everyone elseuser_support?user_support?or a user editing themselves (matching/current)user_support?for the admin view, so support users seesys_adminetc. consistently. Listing users in other authorities stays admin-only.Tests
New specs in
spec/controllers/users_spec.cr:include_metadata) as non-admin, support and admin: right view, no secretsCompanion models PR adds the model-level serialisation specs.
🤖 Generated with Claude Code