From 41dfcc6fd162d37b55c6a2e3a996dffa1e85c08a Mon Sep 17 00:00:00 2001 From: Tanuj Date: Tue, 11 Aug 2026 14:45:31 +1000 Subject: [PATCH 1/2] Omit password and emailHash in getUserById response --- application/backend/src/controllers/UsersController.ts | 1 + 1 file changed, 1 insertion(+) diff --git a/application/backend/src/controllers/UsersController.ts b/application/backend/src/controllers/UsersController.ts index 733e5598..aa2c2369 100644 --- a/application/backend/src/controllers/UsersController.ts +++ b/application/backend/src/controllers/UsersController.ts @@ -151,6 +151,7 @@ export class UsersController extends Controller { const user: UserResponse | null = await this.userRepo.findUnique({ where: { id: userId }, include: { adminOfStudies: { select: { name: true, id: true } } }, + omit: { password: true, emailHash: true }, }) if (!user) { const errorMessage: string = `User with ID: ${userId} not found` From dfd3bab7b13d9bc3c2a5526bb9b551ab26afdd82 Mon Sep 17 00:00:00 2001 From: Tanuj Date: Tue, 11 Aug 2026 14:45:55 +1000 Subject: [PATCH 2/2] Fix GET /users/:id tests to hit the correct endpoint --- .../src/controllers/UsersController.test.ts | 14 ++++++++------ 1 file changed, 8 insertions(+), 6 deletions(-) diff --git a/application/backend/src/controllers/UsersController.test.ts b/application/backend/src/controllers/UsersController.test.ts index 0b321735..6f4fd650 100644 --- a/application/backend/src/controllers/UsersController.test.ts +++ b/application/backend/src/controllers/UsersController.test.ts @@ -155,25 +155,27 @@ describe('UsersController', () => { }) it('should not return user password', async () => { + const userId = TestUsers.PARTICIPANT_UNANSWERED.id const response = await request(app) - .get('/users') + .get(`/users/${userId}`) .set({ Authorization: `Bearer ${orgAdminToken}` }) expect(response.status).toBe(200) - const body: GetAllUsersResponse = response.body + const body: GetUserByIdResponse = response.body expect(body).toHaveProperty('data') - expect(body.data[0]).not.toHaveProperty('password') + expect(body.data).not.toHaveProperty('password') }) it('should not return user emailHash', async () => { + const userId = TestUsers.PARTICIPANT_UNANSWERED.id const response = await request(app) - .get('/users') + .get(`/users/${userId}`) .set({ Authorization: `Bearer ${orgAdminToken}` }) expect(response.status).toBe(200) - const body: GetAllUsersResponse = response.body + const body: GetUserByIdResponse = response.body expect(body).toHaveProperty('data') - expect(body.data[0]).not.toHaveProperty('emailHash') + expect(body.data).not.toHaveProperty('emailHash') }) })