We need to change this assumption and correct the db calls:

I can take this task unless somebody else planned to work on it. I see 2 approaches we can apply here.

Approach 1: Normal users don't see the Users tab

1. Site: Hide the Users tab
2. Backend: check user permissions while accessing Users API and Groups API.

Approach 2: Leave Groups sub-tab

1. Site: Leave the Users tab, but hide the sub-tab Users.
2. Site: Remove the Users column (avatars) from the Groups sub-tab. Theoretically, you can use this information to figure out who is the admin.
3. Backend: check user permissions while accessing Users API.
4. Backend: remove user references (avatar, login, email) from the Groups API.

@sharkymark Which approach do you think will be more convenient for customers? From a security perspective, it depends if there can be secret groups, which should be hidden the same way as users.

Side issue: Groups API and User API return email addresses. I have a feeling that we should limit this behavior...

We are running IT workshops on coder (#5058) and on every workshop start I have to talk with the participants about leaking there eMails addresses or may use fake addresses to register.

Would be good to know if and how this behaviour will be changed in future. May we have to use 'synthetic' emails addresses for every user, but this is a more or less ugly workaround.

With other words, a solution from coder would be very nice.

Just want to add if we remove the read permission from User resource, we should also do something about the organization-member role.

I wonder if this is something orgs can do. Preventing users from seeing members in different organizations.

@sharkymark Should we always hide groups? Should there be public and private groups? Should we show private groups if you are a member? Should we hide all users always to other members?

Should we always hide groups?

Let's only show user what groups they are in, perhaps in the account dropdown as pills.

Should we hide all users always to other members?

would users be able to join public groups? is that how it works? I don't think we need to do this immediately

Should we hide all users always to other members?

yes

Should we show private groups if you are a member?

Let's only show user what groups they are in, perhaps in the account dropdown as pills.