From 7cafca93c3fecf6e15732f723b5ea28cbbd8830f Mon Sep 17 00:00:00 2001
From: Takeshi Kimata <117462761+kimatata@users.noreply.github.com>
Date: Thu, 18 Jul 2024 10:47:34 +0900
Subject: [PATCH] fix: issue user's private fields such as password were
 returned

---
 backend/routes/users/find.js   | 2 +-
 backend/routes/users/index.js  | 4 +++-
 backend/routes/users/search.js | 1 +
 3 files changed, 5 insertions(+), 2 deletions(-)

diff --git a/backend/routes/users/find.js b/backend/routes/users/find.js
index c3dc2c9..f404455 100644
--- a/backend/routes/users/find.js
+++ b/backend/routes/users/find.js
@@ -16,7 +16,7 @@ module.exports = function (sequelize) {
 
       try {
         const user = await User.findByPk(userId, {
-          attributes: ['id', 'username', 'role', 'avatarPath'],
+          attributes: ['id', 'email', 'username', 'role', 'avatarPath'],
         });
         if (!user) {
           return res.status(404).send('User not found');
diff --git a/backend/routes/users/index.js b/backend/routes/users/index.js
index 75d5c92..4f0fd95 100644
--- a/backend/routes/users/index.js
+++ b/backend/routes/users/index.js
@@ -9,7 +9,9 @@ module.exports = function (sequelize) {
 
   router.get('/', verifySignedIn, verifyAdmin, async (req, res) => {
     try {
-      const users = await User.findAll();
+      const users = await User.findAll({
+        attributes: ['id', 'email', 'username', 'role', 'avatarPath'],
+      });
       res.json(users);
     } catch (error) {
       console.error(error);
diff --git a/backend/routes/users/search.js b/backend/routes/users/search.js
index c936d61..84ba3f1 100644
--- a/backend/routes/users/search.js
+++ b/backend/routes/users/search.js
@@ -31,6 +31,7 @@ module.exports = function (sequelize) {
 
       const users = await User.findAll({
         where,
+        attributes: ['id', 'email', 'username', 'role', 'avatarPath'],
         limit: 7,
       });
       res.json(users);