Summary

A recent penetration test identified that the /api/v1/user endpoint exposes sensitive internal user data, including:

• Password hashes
• Okta authentication IDs
• Internal database identifiers (_id)
• Other fields not intended for the UI

Root Cause

The API response was serializing raw user objects directly from the database, without filtering or transforming the fields. A previous fix attempt (#741) tried to exclude the password field using:

collection.find(query, { password: 0 }).toArray();

However, this projection syntax is no longer valid in MongoDB Node.js Driver v5, where the second argument to find() must be an explicit FindOptions object. As a result, the fix was ineffective, and sensitive fields continued to be returned.

Fix

This PR addresses the issue on two levels:

1. Corrects the MongoDB projection syntax so that password fields are properly excluded:

collection.find(query).project({ password: 0 }).toArray();

2. Introduces a public-facing serialisation object to explicitly control which user fields are returned to the UI. Instead of returning raw database user objects, each user is now mapped to a PublicUser shape that includes only the fields required by the frontend. All internal and sensitive fields are explicitly excluded by design.