Repository navigation
fix(api): hide staff comment fields on public reads - #951
Merged
Merged
Conversation
Item reads matched by id only, so a comment could be read through another model's public view, with its staff fields. - Match Item reads on _schemaName as well as _id. - Return only an allow-list of comment fields on public reads (COMMENT_PUBLIC_FIELDS). The author stays hidden on anonymous comments. - Public comment routes and the public Item path return a comment only when its period is readable. A comment with no period, or whose period is gone, is hidden. - Limit public comment sortBy to commentId and dateAdded, so hidden fields cannot leak through sort order. - Log ids and counts only.
danieltruong
requested review from
Ckoelewyn,
tolkamps1 and
tom0827
as code owners
October 14, 2026 01:32
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Item reads matched by id only, so a comment could be read through another model's public view, along with its staff fields.
Changes:
_schemaNameas well as_id.COMMENT_PUBLIC_FIELDSinapi/helpers/constants.js). The author stays hidden on anonymous comments.sortByaccepts onlycommentIdanddateAdded, so hidden fields cannot leak through sort order.Tests: unit and DB tests added for the schema match, the field allow-list, the period gate and the sort limit.