Hide user data in group permissions get user API (#4141)

* Hide user data from group permission user API * test case fix * fix
ToolJet · Sep 29, 2022 · 7879d8a · 7879d8a
1 parent 14ccab3
commit 7879d8a
Show file tree

Hide file tree

Showing 2 changed files with 6 additions and 3 deletions.
diff --git a/server/src/services/group_permissions.service.ts b/server/src/services/group_permissions.service.ts
@@ -303,8 +303,9 @@ export class GroupPermissionsService {
 
   async findUsers(user: User, groupPermissionId: string): Promise<User[]> {
     return createQueryBuilder(User, 'users')
-      .innerJoinAndSelect('users.groupPermissions', 'group_permissions')
-      .innerJoinAndSelect('users.userGroupPermissions', 'user_group_permissions')
+      .select(['users.id', 'users.firstName', 'users.lastName', 'users.email'])
+      .innerJoin('users.groupPermissions', 'group_permissions')
+      .innerJoin('users.userGroupPermissions', 'user_group_permissions')
       .where('group_permissions.id = :groupPermissionId', {
         groupPermissionId,
       })

diff --git a/server/test/controllers/group_permissions.e2e-spec.ts b/server/test/controllers/group_permissions.e2e-spec.ts
@@ -628,8 +628,10 @@ describe('group permissions controller', () => {
       const user = users[0];
 
       expect(users).toHaveLength(1);
-      expect(user.default_organization_id).toBe(organization.id);
+      expect(Object.keys(user).sort()).toEqual(['id', 'email', 'first_name', 'last_name'].sort());
       expect(user.email).toBe('admin@tooljet.io');
+      expect(user.first_name).toBe('test');
+      expect(user.last_name).toBe('test');
     });
   });