Repository: CSCfi/rems (clojure)

Issue:
Hide invitation tokens from also handers, commenters etc.
Currently `:invitation/token` is exposed to some users because they are censored in `rems.application.model/hide-sensitive-information` (which is called for applicants) instead of `rems.application.model/hide-non-public-information` (which is called for all users).

Pull request description:
fixes #1224

Patch:
diff --git a/src/clj/rems/application/model.clj b/src/clj/rems/application/model.clj
index 84d9255aaf..1b35ae710c 100644
--- a/src/clj/rems/application/model.clj
+++ b/src/clj/rems/application/model.clj
@@ -526,40 +526,29 @@
 
 ;;;; Authorization
 
-(defmulti ^:private hide-sensitive-event-content
-  (fn [event] (:event/type event)))
-
-(defmethod hide-sensitive-event-content :default
-  [event]
-  event)
-
-(defmethod hide-sensitive-event-content :application.event/member-invited
-  [event]
-  (dissoc event :invitation/token))
-
-(defmethod hide-sensitive-event-content :application.event/member-joined
-  [event]
-  (dissoc event :invitation/token))
-
 (defn hide-sensitive-events [events]
   (->> events
        (remove (comp #{:application.event/comment-requested
                        :application.event/commented
                        :application.event/decided
                        :application.event/decision-requested}
-                     :event/type))
-       (mapv hide-sensitive-event-content)))
+                     :event/type))))
 
 (defn- hide-sensitive-information [application]
   (-> application
       (update :application/events hide-sensitive-events)
       (update :application/workflow dissoc :workflow.dynamic/handlers)))
 
-(defn- hide-non-public-information [application]
+(defn- hide-invitation-tokens [application]
   (-> application
-      ;; the keys are invitation tokens and must be kept secret
+      ;; the keys of the invitation-tokens map are secret
       (dissoc :application/invitation-tokens)
       (assoc :application/invited-members (set (vals (:application/invitation-tokens application))))
+      (update :application/events (partial mapv #(dissoc % :invitation/token)))))
+
+(defn- hide-non-public-information [application]
+  (-> application
+      hide-invitation-tokens
       ;; these are not used by the UI, so no need to expose them (especially the user IDs)
       (dissoc ::latest-comment-request-by-user ::latest-decision-request-by-user)
       (dissoc :application/past-members)))


Test patch:
diff --git a/test/clj/rems/application/test_model.clj b/test/clj/rems/application/test_model.clj
index 18406db017..3baa2cc6b9 100644
--- a/test/clj/rems/application/test_model.clj
+++ b/test/clj/rems/application/test_model.clj
@@ -837,6 +837,7 @@
                                                                                   :email "member@example.com"}
                                                              :invitation/token "secret"})]
         (testing "- original"
+          (is (= #{"secret" nil} (set (map :invitation/token (:application/events application)))))
           (is (= {"secret" {:name "member"
                             :email "member@example.com"}}
                  (:application/invitation-tokens application)))
@@ -845,6 +846,7 @@
         (doseq [user-id ["applicant" "handler"]]
           (testing (str "- as user " user-id)
             (let [application (model/apply-user-permissions application user-id)]
+              (is (= #{nil} (set (map :invitation/token (:application/events application)))))
               (is (= nil
                      (:application/invitation-tokens application)))
               (is (= #{{:name "member"