Bug: comments, ratings and tags expose other users' email and role #22

New issue

Closed

opened 2026-09-27 18:41:31 +00:00 by araemer · 1 comment

araemer commented

2026-09-27 18:41:31 +00:00

Owner

Problem

Several DTOs embed the full UserDto of another user, which includes their email and role. Everyone who can see the resource receives that data:

DTO	Field	File
`CommentDto`	`createdByUser`	`api-contract/src/comments.ts`
`RatingDto`	`createdByUser`	`api-contract/src/ratings.ts`
`TagDto`	`createdByUser`	`api-contract/src/tags.ts`
`MealPlanShareDto`	`sharedWithUser`	`api-contract/src/meal-plans.ts` (tracked in recipe-app#46)

Anyone reading a recipe's comments or ratings can see the commenter's email address.

Fix

Switch these fields to CompactUserDto (id, user name, first and last name, avatar; no email, no role), introduced with spec 001. This follows the new convention in docs/api-conventions.md, "Other users are exposed as CompactUserDto".

This is a contract change: recipe-backend has to map to CompactUserDto, and recipe-app has to stop relying on email/role from these fields (check where they are displayed).

The meal plan share part is also covered by recipe-app#46; whichever is done first should do it, and the other just verifies.

Found during the cross-cutting architecture discussion of spec 001.

## Problem Several DTOs embed the full `UserDto` of *another* user, which includes their **email and role**. Everyone who can see the resource receives that data: | DTO | Field | File | |---|---|---| | `CommentDto` | `createdByUser` | `api-contract/src/comments.ts` | | `RatingDto` | `createdByUser` | `api-contract/src/ratings.ts` | | `TagDto` | `createdByUser` | `api-contract/src/tags.ts` | | `MealPlanShareDto` | `sharedWithUser` | `api-contract/src/meal-plans.ts` (tracked in recipe-app#46) | Anyone reading a recipe's comments or ratings can see the commenter's email address. ## Fix Switch these fields to `CompactUserDto` (id, user name, first and last name, avatar; no email, no role), introduced with spec 001. This follows the new convention in `docs/api-conventions.md`, "Other users are exposed as CompactUserDto". This is a contract change: recipe-backend has to map to `CompactUserDto`, and recipe-app has to stop relying on email/role from these fields (check where they are displayed). The meal plan share part is also covered by recipe-app#46; whichever is done first should do it, and the other just verifies. Found during the cross-cutting architecture discussion of spec 001.

araemer referenced this issue

2026-09-27 19:09:04 +00:00

feat(contract) #001 Shopping lists: epic E01, spec A and contract #20

araemer referenced this issue

2026-10-04 06:39:56 +00:00

docs(features) #003 Spec: no email or role of other users in comments, ratings, tags and meal plan shares #45

araemer referenced this issue

2026-10-04 06:39:58 +00:00

feat(contract) #003 Embedded users as CompactUserDto in comments, ratings, tags and meal plan shares #46

araemer commented

2026-10-11 06:18:03 +00:00

Author