fix(#131): co_parent en réponse parents + masquage secrets user

Contrat API fiche parent : co_parent peuplé (déjà chargé), sans password
ni tokens sur user/co_parent. Doc tmp front→back.

Co-authored-by: Cursor <cursoragent@cursor.com>

backend/src/common/utils/sanitize-user-for-api.spec.ts

@@ -0,0 +1,32 @@
+import { sanitizeUserForApi } from './sanitize-user-for-api';
+import { RoleType, StatutUtilisateurType, Users } from '../../entities/users.entity';
+
+describe('sanitizeUserForApi', () => {
+  const base: Users = {
+    id: 'u1',
+    email: 'a@b.fr',
+    prenom: 'Paul',
+    nom: 'Parent',
+    role: RoleType.PARENT,
+    statut: StatutUtilisateurType.ACTIF,
+    password: 'hash',
+    token_creation_mdp: 'tok',
+    token_creation_mdp_expire_le: new Date(),
+    password_reset_token: 'rst',
+    password_reset_expires: new Date(),
+  } as Users;
+
+  it('retire password et tokens', () => {
+    const out = sanitizeUserForApi(base)!;
+    expect(out.prenom).toBe('Paul');
+    expect(out.nom).toBe('Parent');
+    expect(out.password).toBeUndefined();
+    expect(out.token_creation_mdp).toBeUndefined();
+    expect(out.password_reset_token).toBeUndefined();
+  });
+
+  it('retourne undefined si user absent', () => {
+    expect(sanitizeUserForApi(null)).toBeUndefined();
+    expect(sanitizeUserForApi(undefined)).toBeUndefined();
+  });
+});

backend/src/common/utils/sanitize-user-for-api.ts

@@ -0,0 +1,23 @@
+import { Users } from 'src/entities/users.entity';
+
+/** Champs sensibles exclus des réponses API (ticket #131 — user / co_parent). */
+const SENSITIVE_USER_KEYS: (keyof Users)[] = [
+  'password',
+  'token_creation_mdp',
+  'token_creation_mdp_expire_le',
+  'password_reset_token',
+  'password_reset_expires',
+];
+
+/**
+ * Retourne une copie utilisateur sans secrets (hash MDP, tokens).
+ * Utilisé pour `user` et `co_parent` dans les réponses Parents.
+ */
+export function sanitizeUserForApi(user?: Users | null): Users | undefined {
+  if (!user) return undefined;
+  const safe = { ...user } as Users;
+  for (const key of SENSITIVE_USER_KEYS) {
+    delete safe[key];
+  }
+  return safe;
+}