audiences 1.5.1 → 1.5.2

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: cc9cb9024b5cab607920dd047795f19189182930353a83858b1b79f6bb22504a
-  data.tar.gz: 7e80900217731f751536eb792272c44645aaf6bc35458ed705c4c39d7e0f3fc1
+  metadata.gz: e3e108ec8748bbea76aff846fb5232ab13593d490088aae9b17a24ce560f39e4
+  data.tar.gz: 921b1c6811c056876b8947f8a3b10147dc065f60e3ef4645c1c8da76b6b51971
 SHA512:
-  metadata.gz: f922b463a9edcf52d3d91492c753415185cd2813f87eb03def29c1b59c9ca7d1a63ac456b274550b974e7b5b62f9451a8848e0e74984cfa865ae869ac69ad67c
-  data.tar.gz: 11edb03700fc296188521adb6f3a77587b8491ed1786fe20ff1f3ad9a3e95b2fb2d6f1a8f5ef557096fec2acfa2d286edacba37c53de293298ebc60c5d743754
+  metadata.gz: b6884ec82566eef0ebb1d9d24d3f7015b704da6a053a0f58690ab1c6b05c85aa73916fbf2a8c17cd2715cb73b3e82c855c27f630018561f17c916e33acf0cb3e
+  data.tar.gz: 4624020381b721223e7255da62502505bcc6816305ba3c4b8e8c92af611967004649f8aa424701870ae53e3463732f7ff215f24685c70ab6e5d7247bc4f3c385

data/app/controllers/audiences/contexts_controller.rb

@@ -17,7 +17,7 @@ module Audiences
                                limit: params[:limit],
                                offset: params[:offset])
 
-      render json: search
+      render json: search, only: Audiences.exposed_user_attributes
     end
 
   private
@@ -33,11 +33,14 @@ module Audiences
     end
 
     def render_context(context)
-      render json: context.as_json(
-        only: %i[match_all extra_users],
+      json_setting = {
+        only: %i[match_all],
         methods: %i[count],
-        include: { criteria: { only: %i[id groups], methods: %i[count] } }
-      )
+        include: { criteria: { only: %i[id groups], methods: %i[count] } },
+      }
+      extra_users = context.extra_users.as_json(only: Audiences.exposed_user_attributes)
+
+      render json: { extra_users: extra_users, **context.as_json(json_setting) }
     end
 
     def context_params

data/app/controllers/audiences/scim_proxy_controller.rb

@@ -7,7 +7,7 @@ module Audiences
                                  .query(
                                    filter: "displayName co \"#{params[:filter]}\"",
                                    startIndex: params[:startIndex], count: params[:count],
-                                   attributes: "id,externalId,displayName,photos"
+                                   attributes: Audiences.exposed_user_attributes.join(",")
                                  )
 
       render json: resources, except: %w[schemas meta]

data/app/models/audiences/external_user.rb

@@ -28,8 +28,8 @@ module Audiences
       where(user_id: attrs.pluck(:user_id))
     end
 
-    def as_json(*)
-      data.as_json
+    def as_json(...)
+      data.as_json(...)
     end
   end
 end

data/app/models/audiences/users_search.rb

@@ -11,9 +11,9 @@ module Audiences
       @offset = offset
     end
 
-    def as_json(*)
+    def as_json(...)
       {
-        users: users,
+        users: users.as_json(...),
         count: count,
       }
     end

data/docs/CHANGELOG.md

@@ -1,5 +1,9 @@
 # Unreleased
 
+# Version 1.5.2 (2024-12-19)
+
+- Filter sensitive user data out of user list response [#473](https://github.com/powerhome/audiences/pull/473)
+
 # Version 1.5.1 (2024-12-12)
 
 - Fix SCIM proxy attributes format [#462](https://github.com/powerhome/audiences/pull/462)

data/lib/audiences/configuration.rb

@@ -5,6 +5,13 @@ module Audiences
 
   # Configuration options
 
+  # These are the user attributes that will be exposed in the audiences endpoints.
+  # They're required by the UI to display the user information.
+  #
+  config_accessor :exposed_user_attributes do
+    %w[id externalId displayName photos]
+  end
+
   #
   # Authentication configuration. This defaults to true, meaning that the audiences
   # endpoints are open to the public.

data/lib/audiences/version.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
 
 module Audiences
-  VERSION = "1.5.1"
+  VERSION = "1.5.2"
 end

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: audiences
 version: !ruby/object:Gem::Version
-  version: 1.5.1
+  version: 1.5.2
 platform: ruby
 authors:
 - Carlos Palhares
 autorequire:
 bindir: bin
 cert_chain: []
-date: 2024-12-12 00:00:00.000000000 Z
+date: 2024-12-20 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: rails