fix(server): only return workspace user fields (#10700)

close CLOUD-164

packages/backend/server/src/models/common/user.ts

@@ -5,3 +5,10 @@ export const publicUserSelect = {
   name: true,
   avatarUrl: true,
 } satisfies Prisma.UserSelect;
+
+export const workspaceUserSelect = {
+  id: true,
+  name: true,
+  email: true,
+  avatarUrl: true,
+} satisfies Prisma.UserSelect;

packages/backend/server/src/models/user.ts

@@ -11,21 +11,9 @@ import {
   WrongSignInMethod,
 } from '../base';
 import { BaseModel } from './base';
-import { WorkspaceRole } from './common';
+import { publicUserSelect, WorkspaceRole, workspaceUserSelect } from './common';
 import type { Workspace } from './workspace';
 
-const publicUserSelect = {
-  id: true,
-  name: true,
-  avatarUrl: true,
-} satisfies Prisma.UserSelect;
-const workspaceUserSelect = {
-  id: true,
-  name: true,
-  email: true,
-  avatarUrl: true,
-} satisfies Prisma.UserSelect;
-
 type CreateUserInput = Omit<Prisma.UserCreateInput, 'name'> & { name?: string };
 type UpdateUserInput = Omit<Partial<Prisma.UserCreateInput>, 'id'>;
 

packages/backend/server/src/models/workspace-user.ts

@@ -5,7 +5,7 @@ import { groupBy } from 'lodash-es';
 
 import { EventBus, PaginationInput } from '../base';
 import { BaseModel } from './base';
-import { WorkspaceRole } from './common';
+import { WorkspaceRole, workspaceUserSelect } from './common';
 
 export { WorkspaceMemberStatus };
 
@@ -236,7 +236,9 @@ export class WorkspaceUserModel extends BaseModel {
   async getOwner(workspaceId: string) {
     const role = await this.db.workspaceUserRole.findFirst({
       include: {
-        user: true,
+        user: {
+          select: workspaceUserSelect,
+        },
       },
       where: {
         workspaceId,
@@ -254,7 +256,9 @@ export class WorkspaceUserModel extends BaseModel {
   async getAdmins(workspaceId: string) {
     const list = await this.db.workspaceUserRole.findMany({
       include: {
-        user: true,
+        user: {
+          select: workspaceUserSelect,
+        },
       },
       where: {
         workspaceId,
@@ -291,7 +295,9 @@ export class WorkspaceUserModel extends BaseModel {
     return await Promise.all([
       this.db.workspaceUserRole.findMany({
         include: {
-          user: true,
+          user: {
+            select: workspaceUserSelect,
+          },
         },
         where: {
           workspaceId,
@@ -317,7 +323,7 @@ export class WorkspaceUserModel extends BaseModel {
     pagination: PaginationInput
   ) {
     return await this.db.workspaceUserRole.findMany({
-      include: { user: true },
+      include: { user: { select: workspaceUserSelect } },
       where: {
         workspaceId,
         status: WorkspaceMemberStatus.Accepted,