fix: restrict user email visibility

Co-Authored-By: gpt-5.6-sol <noreply@openai.com>

src/webapi/apirouter.ts

@@ -15,11 +15,20 @@ import {
   updateuser,
 } from "../schema/validators.js";
 import { authenticate } from "./middleware/authenticate.js";
-import { InvalidAbodeError, NotFoundAbodeError } from "../db/types/errors.js";
+import {
+  InvalidAbodeError,
+  NotAuthorizedAbodeError,
+  NotFoundAbodeError,
+} from "../db/types/errors.js";
 import { isExportable } from "../db/types/ExportImport.js";
 import type { ExportFilter, ExportKind } from "../db/types/ExportImport.js";
 import { intersectExportFilters, isExportKind } from "../db/export/filter.js";
 import { computeForcedExportFilter } from "./exportScope.js";
+import {
+  hasGlobalUserVisibility,
+  hideUserEmail,
+  userForCaller,
+} from "./userVisibility.js";
 
 function parseExportFilter(query: Record<string, unknown>): ExportFilter {
   const list = (v: unknown): string[] | undefined => {
@@ -92,17 +101,32 @@ export function apirouter(db: BackendDbInterface): KoaRouter {
 
   router.use("/users", authenticate(db));
   router.get("/users", async (ctx) => {
-    ctx.body = await db.listUsers();
+    const users = await db.listUsers();
+    ctx.body = users.map((user) =>
+      userForCaller(user, { user: ctx.user!, session: ctx.session! }),
+    );
   });
   router.post("/users", jsonBody({ validate: createuser }), async (ctx) => {
     ctx.body = await db.createUser(ctx.request.body);
   });
   router.get("/users/by-email", async (ctx) => {
     if (typeof ctx.query.email !== "string") throw new InvalidAbodeError();
+    if (
+      !hasGlobalUserVisibility({
+        user: ctx.user!,
+        session: ctx.session!,
+      })
+    ) {
+      throw new NotAuthorizedAbodeError();
+    }
     ctx.body = await db.getUserByEmail(ctx.query.email);
   });
   router.get("/users/:uid", async (ctx) => {
-    ctx.body = await db.getUserById(ctx.params.uid);
+    const user = await db.getUserById(ctx.params.uid);
+    ctx.body = userForCaller(user, {
+      user: ctx.user!,
+      session: ctx.session!,
+    });
   });
   router.patch(
     "/users/:uid",
@@ -176,7 +200,24 @@ export function apirouter(db: BackendDbInterface): KoaRouter {
     ctx.body = await db.listResidentsByAbodeId(ctx.params.aid);
   });
   router.get("/abodes/:aid/users", async (ctx) => {
-    ctx.body = await db.listUsersByAbodeId(ctx.params.aid);
+    const users = await db.listUsersByAbodeId(ctx.params.aid);
+    const globalVisibility = hasGlobalUserVisibility({
+      user: ctx.user!,
+      session: ctx.session!,
+    });
+    const residents = globalVisibility
+      ? []
+      : await db.listResidentsByAbodeId(ctx.params.aid);
+    const abodeAdmin = residents.some(
+      (resident) =>
+        resident.uid === ctx.user!.uid && resident.flags.admin === true,
+    );
+    ctx.body =
+      globalVisibility || abodeAdmin
+        ? users
+        : users.map((user) =>
+            user.uid === ctx.user!.uid ? user : hideUserEmail(user),
+          );
   });
   router.get("/abodes/:aid/notes", async (ctx) => {
     ctx.body = await db.listNotesByAbodeId(ctx.params.aid);