feat(labrinth): censor user ids if set by moderator

apps/labrinth/src/models/v3/disclosures.rs

@@ -70,16 +70,23 @@ pub struct ProjectDisclosureData {
     pub disclosure: ProjectDisclosure,
     pub set_by_moderator: bool,
     pub updated_at: DateTime<Utc>,
-    pub updated_by: UserId,
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub updated_by: Option<UserId>,
 }
 
-impl From<DBProjectDisclosure> for ProjectDisclosureData {
-    fn from(db: DBProjectDisclosure) -> Self {
+impl ProjectDisclosureData {
+    pub fn from_db(
+        value: DBProjectDisclosure,
+        viewer_is_moderator: bool,
+    ) -> Self {
+        let updated_by = (!value.set_by_moderator || viewer_is_moderator)
+            .then_some(value.updated_by.into());
+
         Self {
-            disclosure: db.disclosure,
-            set_by_moderator: db.set_by_moderator,
-            updated_at: db.updated_at,
-            updated_by: db.updated_by.into()
+            disclosure: value.disclosure,
+            set_by_moderator: value.set_by_moderator,
+            updated_at: value.updated_at,
+            updated_by,
         }
     }
 }

apps/labrinth/src/routes/v3/disclosures.rs

@@ -54,6 +54,9 @@ pub async fn get_project_disclosures(
         return Err(ApiError::NotFound);
     }
 
+    let viewer_is_moderator =
+        user_option.is_some_and(|user| user.role.is_mod());
+
     let disclosures = db_models::DBProjectDisclosure::get_many_for_project(
         project.inner.id,
         &***ro_pool,
@@ -64,7 +67,9 @@ pub async fn get_project_disclosures(
     Ok(web::Json(
         disclosures
             .into_iter()
-            .map(ProjectDisclosureData::from)
+            .map(|disclosure| {
+                ProjectDisclosureData::from_db(disclosure, viewer_is_moderator)
+            })
             .collect(),
     ))
 }