Merge branch 'hotfix/0.149.8'

CenterForOpenScience · Jul 30, 2018 · c149bb1 · c149bb1
2 parents 633726c + 81c1500
commit c149bb1
Show file tree

Hide file tree

Showing 2 changed files with 15 additions and 5 deletions.
diff --git a/api/nodes/serializers.py b/api/nodes/serializers.py
@@ -906,7 +906,7 @@ class NodeContributorsCreateSerializer(NodeContributorsSerializer):
 
     id = IDField(source='_id', required=False, allow_null=True)
     full_name = ser.CharField(required=False)
-    email = ser.EmailField(required=False, source='user.email')
+    email = ser.EmailField(required=False, source='user.email', write_only=True)
     index = ser.IntegerField(required=False, source='_order')
 
     users = RelationshipField(

diff --git a/api_tests/nodes/views/test_node_contributors_list.py b/api_tests/nodes/views/test_node_contributors_list.py
@@ -596,6 +596,16 @@ def test_contributor_create_invalid_data(
         assert res.status_code == 400
         assert res.json['errors'][0]['detail'] == exceptions.ParseError.default_detail
 
+    def test_add_contributor_dont_expose_email(
+            self, app, user, user_two, project_public, data_user_two, url_public):
+
+        res = app.post_json_api(
+            url_public,
+            data_user_two,
+            auth=user.auth)
+        assert res.status_code == 201
+        assert res.json['data']['attributes'].get('email') is None
+
     def test_add_contributor_is_visible_by_default(
             self, app, user, user_two, project_public,
             data_user_two, url_public):
@@ -952,7 +962,7 @@ def test_add_unregistered_contributor_with_fullname(
             project_public.reload()
             assert res.status_code == 201
             assert res.json['data']['attributes']['unregistered_contributor'] == 'John Doe'
-            assert res.json['data']['attributes']['email'] is None
+            assert res.json['data']['attributes'].get('email') is None
             assert res.json['data']['embeds']['users']['data']['id'] in project_public.contributors.values_list(
                 'guids___id', flat=True)
 
@@ -972,7 +982,7 @@ def test_add_contributor_with_fullname_and_email_unregistered_user(
             project_public.reload()
             assert res.status_code == 201
             assert res.json['data']['attributes']['unregistered_contributor'] == 'John Doe'
-            assert res.json['data']['attributes']['email'] == 'john@doe.com'
+            assert res.json['data']['attributes'].get('email') is None
             assert res.json['data']['attributes']['bibliographic'] is True
             assert res.json['data']['attributes']['permission'] == permissions.WRITE
             assert res.json['data']['embeds']['users']['data']['id'] in project_public.contributors.values_list(
@@ -996,7 +1006,7 @@ def test_add_contributor_with_fullname_and_email_unregistered_user_set_attribute
             project_public.reload()
             assert res.status_code == 201
             assert res.json['data']['attributes']['unregistered_contributor'] == 'John Doe'
-            assert res.json['data']['attributes']['email'] == 'john@doe.com'
+            assert res.json['data']['attributes'].get('email') is None
             assert res.json['data']['attributes']['bibliographic'] is False
             assert res.json['data']['attributes']['permission'] == permissions.READ
             assert res.json['data']['embeds']['users']['data']['id'] in project_public.contributors.values_list(
@@ -1019,7 +1029,7 @@ def test_add_contributor_with_fullname_and_email_registered_user(
             project_public.reload()
             assert res.status_code == 201
             assert res.json['data']['attributes']['unregistered_contributor'] is None
-            assert res.json['data']['attributes']['email'] == user_contrib.username
+            assert res.json['data']['attributes'].get('email') is None
             assert res.json['data']['embeds']['users']['data']['id'] in project_public.contributors.values_list(
                 'guids___id', flat=True)