isra el 8b635a2344 fix(api): keep push token and serial out of the device list ...

getDevicesForUser did find({ user }) with no projection, so the device
list endpoint returned the full document, including the fcmToken push
credential and the hardware serial, straight to the browser. Neither is
used by the dashboard or the Android client.

The query now projects both fields out with '-fcmToken -serial'. Only the
user-facing list is narrowed; getDeviceById, which feeds the guards and
internal logic, is untouched.

Guarded by the existing getDevicesForUser test, rewritten to assert the
projection and seen to fail against the pre-change single-argument call.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

2026-07-19 18:37:40 +03:00

..

src

fix(api): keep push token and serial out of the device list

2026-07-19 18:37:40 +03:00

test

…

.dockerignore

…

.env.example

…

.eslintrc.js

…

.gitignore

…

.prettierrc

…

Dockerfile

…

nest-cli.json

…

package.json

…

pnpm-lock.yaml

…

Procfile

…

tsconfig.build.json

…

tsconfig.json

…