fix: issue user's private fields such as password were returned

backend/routes/users/find.js

@@ -16,7 +16,7 @@ module.exports = function (sequelize) {
 
       try {
         const user = await User.findByPk(userId, {
-          attributes: ['id', 'username', 'role', 'avatarPath'],
+          attributes: ['id', 'email', 'username', 'role', 'avatarPath'],
         });
         if (!user) {
           return res.status(404).send('User not found');

backend/routes/users/index.js

@@ -9,7 +9,9 @@ module.exports = function (sequelize) {
 
   router.get('/', verifySignedIn, verifyAdmin, async (req, res) => {
     try {
-      const users = await User.findAll();
+      const users = await User.findAll({
+        attributes: ['id', 'email', 'username', 'role', 'avatarPath'],
+      });
       res.json(users);
     } catch (error) {
       console.error(error);

backend/routes/users/search.js

@@ -31,6 +31,7 @@ module.exports = function (sequelize) {
 
       const users = await User.findAll({
         where,
+        attributes: ['id', 'email', 'username', 'role', 'avatarPath'],
         limit: 7,
       });
       res.json(users);