Julien Martin
ce474797c4
Contrat API fiche parent : co_parent peuplé (déjà chargé), sans password ni tokens sur user/co_parent. Doc tmp front→back. Co-authored-by: Cursor <cursoragent@cursor.com>
24 lines
687 B
TypeScript
24 lines
687 B
TypeScript
import { Users } from 'src/entities/users.entity';
|
|
|
|
/** Champs sensibles exclus des réponses API (ticket #131 — user / co_parent). */
|
|
const SENSITIVE_USER_KEYS: (keyof Users)[] = [
|
|
'password',
|
|
'token_creation_mdp',
|
|
'token_creation_mdp_expire_le',
|
|
'password_reset_token',
|
|
'password_reset_expires',
|
|
];
|
|
|
|
/**
|
|
* Retourne une copie utilisateur sans secrets (hash MDP, tokens).
|
|
* Utilisé pour `user` et `co_parent` dans les réponses Parents.
|
|
*/
|
|
export function sanitizeUserForApi(user?: Users | null): Users | undefined {
|
|
if (!user) return undefined;
|
|
const safe = { ...user } as Users;
|
|
for (const key of SENSITIVE_USER_KEYS) {
|
|
delete safe[key];
|
|
}
|
|
return safe;
|
|
}
|