discourse/app/serializers/admin_user_serializer.rb
benj 72e4e53fda
FEATURE: add option to hide IP addresses from moderators (#33682)
# Hide IP Addresses from Moderators When `moderators_view_ips` is
Disabled

## Summary 
Feature Request Link -
https://meta.discourse.org/t/option-to-hide-ip-addresses-from-moderators/207715/51
This PR implements a feature to **hide IP addresses from moderators**
when the `moderators_view_ips` site setting is disabled. Previously,
moderators could view IPs in multiple locations across the admin UI.
This update ensures that IP addresses are visible to moderators when the
setting allows it.

## Changes Implemented  

### Backend Updates
- **Added `moderators_view_ips` site setting** in `site_settings.yml`
- **Updated `CurrentUserSerializer`** to include `can_see_ip` field
based on the user’s role and site setting.
- **Modified `AdminUserSerializer`** to restrict IP address visibility.
- **Updated `UsersController`** to prevent IP addresses from being
included in API responses.
- **Restricted IPs in `ScreenedIpAddressesController`** by throwing
`Discourse::InvalidAccess` if the user lacks permission.

### Frontend Updates
- **Hid "Screened IPs" tab** in `/admin/logs` when `moderators_view_ips`
is disabled.
- **Blocked direct access to `/admin/logs/screened_ip_addresses`** for
unauthorized users.
- **Updated `user-index.hbs` and `logs.hbs`** to conditionally hide IP
fields.

### UI Screenshots

New option for Admins in the Admin Security settings dashboard:
![Screenshot 2025-02-21 at 5 32
00 PM](https://github.com/user-attachments/assets/5b315434-7724-4cb9-a3dc-d88750df00a6)


Moderator's view before:
![Screenshot 2025-02-21 at 5 25
41 PM](https://github.com/user-attachments/assets/0fb269e2-db40-488b-b11d-8bdfbe2a5245)
Moderator's view after:
![Screenshot 2025-02-21 at 5 26
59 PM](https://github.com/user-attachments/assets/efb848b0-1d7f-4ec9-8238-d8ee4eddbbe1)

Moderator's view before:
![Screenshot 2025-02-21 at 5 23
52 PM](https://github.com/user-attachments/assets/226e6d63-df3e-45d0-833f-de52593a086e)
Moderator's view after:
![Screenshot 2025-02-21 at 5 23
15 PM](https://github.com/user-attachments/assets/af313af2-2329-46d1-827d-290243c320e5)

---------

Co-authored-by: Bennett Dungan <bennettdungan@gmail.com>
2025-08-05 10:09:02 -05:00

59 lines
1.1 KiB
Ruby

# frozen_string_literal: true
class AdminUserSerializer < AdminUserListSerializer
attributes :name,
:associated_accounts,
:can_send_activation_email,
:can_activate,
:can_deactivate,
:can_approve,
:ip_address,
:registration_ip_address,
:include_ip
has_one :single_sign_on_record, serializer: SingleSignOnRecordSerializer, embed: :objects
def can_approve
scope.can_approve?(object)
end
def include_can_approve?
SiteSetting.must_approve_users
end
def can_send_activation_email
scope.can_send_activation_email?(object)
end
def can_activate
scope.can_activate?(object)
end
def can_deactivate
scope.can_deactivate?(object)
end
def ip_address
object.ip_address.try(:to_s)
end
def registration_ip_address
object.registration_ip_address.try(:to_s)
end
def include_ip_address?
scope.can_see_ip?
end
def include_registration_ip_address?
scope.can_see_ip?
end
def include_can_be_deleted?
true
end
def include_ip
@options[:include_ip]
end
end