[devin-ai-integration]

Summary

Fixes code-scan finding sfind-7448b8546f40422ea9dbab8d3889cb65 (high): GET /api/user/all and GET /api/appointment/all serialized the User entity directly, so [REDACTED SECRET]s got every customer's BCrypt hash, full recipientList (payee name/email/phone/account number), and account numbers.

Admin endpoints now return DTOs (UserFront/.../resource/dto/) containing only what the AdminPortal renders:

/api/user/all        -> [AdminUserView{userId, username, firstName, lastName, email, phone, enabled,
                                        primaryAccount{accountBalance}, savingsAccount{accountBalance}}]
/api/appointment/all -> [AdminAppointmentView{id, date, location, description, confirmed, user{username}}]

The JSON shape the AdminPortal reads (user.primaryAccount.accountBalance, appointment.user.username, ...) is unchanged, so no frontend change is needed. Dropped from the responses: password, recipientList, authorities/accountNonExpired/etc., account id/accountNumber, and everything on the embedded appointment user except username.

Entity defense-in-depth (in case a User/Appointment gets serialized somewhere else later):

• User.getPassword() -> @JsonIgnore (still readable by Spring Security and Thymeleaf; no endpoint deserializes User from JSON)
• User.recipientList -> @JsonIgnore (same as the existing appointmentList/userRoles)
• Appointment.user -> @JsonIgnore
• User.toString() no longer prints password. I also removed appointmentList/recipientList/userRoles from it: printing them triggers lazy loads and would dump recipient PII.

Tests: new AdminResourceSerializationTest (MockMvc standalone + Jackson) checks that both endpoints and both entities leave out the hash, password, recipientList and recipient account number, while keeping the fields the portal uses. It's 5/5 failing on master and 5/5 passing on this branch.

Verification note: Boot 1.5.4 and its plugins aren't in the offline Maven cache, so I compiled and ran the tests with javac + JUnitCore. The stand-in classpath was Boot 1.5.8 (Spring 4.3.12, Jackson 2.8.10), not a mvn test run of the real pom.

Duplicate notice: this overlaps open PRs #116 and #123 (both add @JsonIgnore on password and edit toString), and #341/#364 (@JsonIgnore recipientList). It was opened as a new PR under the one-PR-per-ticket rule. Only one of these should land.

Devin-Org: engineering

Link to Devin session: https://devin-gtm.devinenterprise.com/sessions/45e3d51148204f80a4e822b766f71bda
Open in Devin Desktop: https://devin-gtm.devinenterprise.com/desktop/session/45e3d51148204f80a4e822b766f71bda?variant=devin

---

Devin Review

Status	Commit
⚪ Not started	—

Run Devin Review

Enable auto-review to review your pull requests automatically.

---

[devin-ai-integration]

I'll fix CI failures and address comments from users with write access. I'll skip comments containing "(aside)".

• Disable automatic comment, CI, and merge conflict monitoring

[devin-ai-integration]

✅ Devin Review: No Issues Found

Devin Review analyzed this PR and found no bugs or issues to report.