From 8b635a2344238e7da5b856485f5e4af159f5ece2 Mon Sep 17 00:00:00 2001 From: isra el Date: Sun, 19 Jul 2026 18:37:40 +0300 Subject: [PATCH] fix(api): keep push token and serial out of the device list getDevicesForUser did find({ user }) with no projection, so the device list endpoint returned the full document, including the fcmToken push credential and the hardware serial, straight to the browser. Neither is used by the dashboard or the Android client. The query now projects both fields out with '-fcmToken -serial'. Only the user-facing list is narrowed; getDeviceById, which feeds the guards and internal logic, is untouched. Guarded by the existing getDevicesForUser test, rewritten to assert the projection and seen to fail against the pre-change single-argument call. Co-Authored-By: Claude Fable 5 --- api/src/gateway/gateway.service.spec.ts | 9 +++++++-- api/src/gateway/gateway.service.ts | 6 +++++- 2 files changed, 12 insertions(+), 3 deletions(-) diff --git a/api/src/gateway/gateway.service.spec.ts b/api/src/gateway/gateway.service.spec.ts index 45eeb8e..b77e669 100644 --- a/api/src/gateway/gateway.service.spec.ts +++ b/api/src/gateway/gateway.service.spec.ts @@ -279,12 +279,17 @@ describe('GatewayService', () => { { _id: 'device2', model: 'iPhone 13' }, ] - it('should return all devices for a user', async () => { + it('should return a user\'s devices without the push token or serial', async () => { mockDeviceModel.find.mockResolvedValue(mockDevices) const result = await service.getDevicesForUser(mockUser) - expect(mockDeviceModel.find).toHaveBeenCalledWith({ user: mockUser._id }) + const [filter, projection] = mockDeviceModel.find.mock.calls[0] + expect(filter).toEqual({ user: mockUser._id }) + // fcmToken is a push credential and serial is a hardware id; neither + // should be shipped to the browser in the device list. + expect(projection).toContain('-fcmToken') + expect(projection).toContain('-serial') expect(result).toEqual(mockDevices) }) }) diff --git a/api/src/gateway/gateway.service.ts b/api/src/gateway/gateway.service.ts index 139ef1f..b0e2c38 100644 --- a/api/src/gateway/gateway.service.ts +++ b/api/src/gateway/gateway.service.ts @@ -140,7 +140,11 @@ export class GatewayService { } async getDevicesForUser(user: User): Promise { - return await this.deviceModel.find({ user: user._id }) + // Exclude the push credential and hardware serial from the client response. + return await this.deviceModel.find( + { user: user._id }, + '-fcmToken -serial', + ) } async getDeviceById(deviceId: string): Promise {