0
0
Fork 0
mirror of https://github.com/discourse/discourse.git synced 2026-08-04 10:39:43 +08:00
discourse/app/serializers/admin_user_serializer.rb
Juan David Martínez Cubillos 54ed0fa270
DEV: External IDs, and hidden groups to admins only. Allow moderators to see SSO when the moderators_view_sso_details site setting is enabled (#41496)
#### Description

Moderators could access admin-only SSO, external identity and hidden
groups data via GET /admin/users/:id.json — the single_sign_on_record
field, external_ids field and hidden groups were serialized
unconditionally for all staff members instead of being restricted to
admins. This PR restricts External IDs, and hidden group to admins only
but allows moderators to see SSO information when the
`moderators_view_sso_details` SiteSetting is enabled

Context: `t/180409`
2026-08-03 11:25:34 -05:00

68 lines
1.3 KiB
Ruby
Vendored

# frozen_string_literal: true
class AdminUserSerializer < AdminUserListSerializer
attributes :name,
:associated_accounts,
:can_send_activation_email,
:can_activate,
:can_deactivate,
:can_approve,
:can_change_trust_level,
:ip_address,
:registration_ip_address,
:include_ip
has_one :single_sign_on_record, serializer: SingleSignOnRecordSerializer, embed: :objects
def include_single_sign_on_record?
scope.can_check_sso_details?(object)
end
def can_approve
scope.can_approve?(object)
end
def include_can_approve?
SiteSetting.must_approve_users
end
def can_send_activation_email
scope.can_send_activation_email?(object)
end
def can_activate
scope.can_activate?(object)
end
def can_deactivate
scope.can_deactivate?(object)
end
def can_change_trust_level
scope.can_change_trust_level?(object)
end
def ip_address
object.ip_address.try(:to_s)
end
def registration_ip_address
object.registration_ip_address.try(:to_s)
end
def include_ip_address?
scope.can_see_ip?
end
def include_registration_ip_address?
scope.can_see_ip?
end
def include_can_be_deleted?
true
end
def include_ip
@options[:include_ip]
end
end