make email a write-only field for NodeContributorsCreateSerializer

CenterForOpenScience · Jul 30, 2018 · 7372fd6 · 7372fd6
1 parent 633726c
commit 7372fd6
Show file tree

Hide file tree

Showing 2 changed files with 10 additions and 1 deletion.
diff --git a/api/nodes/serializers.py b/api/nodes/serializers.py
@@ -906,7 +906,7 @@ class NodeContributorsCreateSerializer(NodeContributorsSerializer):
 
     id = IDField(source='_id', required=False, allow_null=True)
     full_name = ser.CharField(required=False)
-    email = ser.EmailField(required=False, source='user.email')
+    email = ser.EmailField(required=False, source='user.email', write_only=True)
     index = ser.IntegerField(required=False, source='_order')
 
     users = RelationshipField(

diff --git a/api_tests/nodes/views/test_node_contributors_list.py b/api_tests/nodes/views/test_node_contributors_list.py
@@ -596,6 +596,15 @@ def test_contributor_create_invalid_data(
         assert res.status_code == 400
         assert res.json['errors'][0]['detail'] == exceptions.ParseError.default_detail
 
+    def test_add_contributor_dont_expose_email( self, app, user, user_two, project_public, data_user_two, url_public):
+
+        res = app.post_json_api(
+            url_public,
+            data_user_two,
+            auth=user.auth)
+        assert res.status_code == 201
+        assert res.json['data']['attributes'].get('email') is None
+
     def test_add_contributor_is_visible_by_default(
             self, app, user, user_two, project_public,
             data_user_two, url_public):