feat: redact sensitive information for unauthenticated requests

program/serializers.py

@@ -114,6 +114,12 @@ class CBASerializer(serializers.ModelSerializer):
             "user_token",
         ) + read_only_fields
 
+    def to_representation(self, instance):
+        if not self.parent.context.get("request").user.is_authenticated:
+            return None
+
+        return super().to_representation(instance)
+
 
 class UserSerializer(serializers.ModelSerializer):
     is_privileged = serializers.SerializerMethodField()
@@ -401,6 +407,14 @@ class ProfileSerializer(serializers.ModelSerializer):
             "owner_ids",
         ) + read_only_fields
 
+    def to_representation(self, instance):
+        representation = super().to_representation(instance)
+
+        if not self.context.get("request").user.is_authenticated:
+            del representation["email"]
+
+        return representation
+
     def create(self, validated_data):
         """
         Create and return a new Profile instance, given the validated data.
@@ -633,6 +647,14 @@ class ShowSerializer(serializers.HyperlinkedModelSerializer):
 
         return super().to_internal_value(data)
 
+    def to_representation(self, instance):
+        representation = super().to_representation(instance)
+
+        if not self.context.get("request").user.is_authenticated:
+            del representation["email"]
+
+        return representation
+
     def create(self, validated_data):
         """
         Create and return a new Show instance, given the validated data.
@@ -995,6 +1017,14 @@ class TimeSlotSerializer(serializers.ModelSerializer):
     def get_end(obj) -> datetime:
         return obj.end.astimezone(tz=ZoneInfo(settings.TIME_ZONE))
 
+    def to_representation(self, instance):
+        representation = super().to_representation(instance)
+
+        if not self.context.get("request").user.is_authenticated:
+            del representation["memo"]
+
+        return representation
+
     def update(self, instance, validated_data):
         """Update and return an existing Show instance, given the validated data."""