GET /users/admin returns each admin's adminOfStudies array (with study id and name) in the response, and StudyAdmins can call this endpoint per the security decoration.
Logged in as Emily (StudyAdmin of Short Study only), the response included Jane Smith with adminOfStudies: [{ id: 2, name: "Seed Study" }, { id: 1, name: "Short Study" }]. So Seed Study leaks to Emily via Jane's array, even though GET /studies correctly hides it from her scope.
Filing as a question - is this intended behaviour? Might matter more in multi-tenant deployments since CTRL supports multiple Organisations per instance.
Related to #921.
GET /users/adminreturns each admin'sadminOfStudiesarray (with study id and name) in the response, and StudyAdmins can call this endpoint per the security decoration.Logged in as Emily (StudyAdmin of Short Study only), the response included Jane Smith with
adminOfStudies: [{ id: 2, name: "Seed Study" }, { id: 1, name: "Short Study" }]. So Seed Study leaks to Emily via Jane's array, even thoughGET /studiescorrectly hides it from her scope.Filing as a question - is this intended behaviour? Might matter more in multi-tenant deployments since CTRL supports multiple Organisations per instance.
Related to #921.