PM-4010: Let Talent Manager copilots see member emails

[jmgasper]

Jira: PM-4010

What was broken

Users who have the Talent Manager role and also the copilot role could not see a member's email on the member profile, even though Talent Managers are allowed to see it. Phone numbers were still shown.

The bug only showed up for some of these users. For example, hentry_copilot could see mess's email but sathyajan9 could not, even with the exact same roles.

Root cause

copilotEmailAccess.shouldLimitCopilotEmailAccess limits email access for any caller with the copilot role unless they are an admin. Talent Manager was not exempt, so a TM who is also a copilot was treated like a plain copilot. They could only see the email of members who share a challenge resource with them.

getMember then removed the email that omitMemberAttributes had already allowed for the Talent Manager role. That explains why results differed between users with the same roles: it depended on which challenges each one had copiloted. The same rule also applied to member search.

What was changed

• shouldLimitCopilotEmailAccess now skips the copilot restriction for any sensitive data role. It uses helper.hasSensitiveDataRole (admin, administrator, Talent Manager) instead of helper.hasAdminRole. This matches the role check omitMemberAttributes already uses for email and phones.
• Added JSDoc for shouldLimitCopilotEmailAccess.
• Copilots without the admin or Talent Manager role are unchanged: they still only see emails of members they share a challenge with.

No UI change is needed. The profiles app already shows the email to Talent Managers whenever the API returns it.

Added/updated tests

New test/unit/CopilotEmailAccess.test.js, which stubs the resources Prisma client:

• a plain copilot is still limited;
• a Talent Manager + copilot (the role set from the ticket) is not limited and keeps member emails in both canCopilotAccessMemberEmail and stripUnauthorizedCopilotEmails;
• an administrator + copilot is not limited.

The Talent Manager case fails without this fix.

Unit suite with placeholder DB env vars: 195 passing, 4 failing. Clean develop gives 192 passing, 4 failing. The 4 failures are the same in both: the before all/after all hooks of the MemberService and MemberTraitService suites, which need a live Postgres (Can't reach database server at 127.0.0.1:5432). Lint (eslint on *.ts, src/**/*.ts, prisma/**/*.ts) and nest build both pass.

🤖 Generated with Claude Code