users: Apply email_address_visibility policy on the users list.

In the emails-hidden case, for non-admins, we should remove the email
field from "Users" list in the organization settings page.

Tweaked by tabbott to correctly handle the bots and deactivated users pages.

static/js/admin.js

@@ -69,6 +69,7 @@ exports.build_page = function () {
         settings_send_digest_emails: page_params.settings_send_digest_emails,
         realm_digest_emails_enabled: page_params.realm_digest_emails_enabled,
         realm_digest_weekday: page_params.realm_digest_weekday,
+        show_email: settings_org.show_email(),
         development: page_params.development_environment,
         plan_includes_wide_organization_logo: page_params.plan_includes_wide_organization_logo,
         upgrade_text_for_wide_organization_logo:

static/js/settings_users.js

@@ -136,7 +136,12 @@ function populate_users(realm_people_data) {
     list_render.create($bots_table, bots, {
         name: "admin_bot_list",
         modifier: function (item) {
-            return render_admin_user_list({ user: item, can_modify: page_params.is_admin });
+            return render_admin_user_list({
+                can_modify: page_params.is_admin,
+                // It's always safe to show the fake email addresses for bot users
+                show_email: true,
+                user: item,
+            });
         },
         filter: {
             element: $bots_table.closest(".settings-section").find(".search"),
@@ -173,9 +178,10 @@ function populate_users(realm_people_data) {
             }
 
             var $row = $(render_admin_user_list({
-                user: item,
                 can_modify: page_params.is_admin,
                 is_current_user: people.is_my_user_id(item.user_id),
+                show_email: settings_org.show_email(),
+                user: item,
             }));
             $row.find(".last_active").append(activity_rendered);
 
@@ -202,7 +208,11 @@ function populate_users(realm_people_data) {
     list_render.create($deactivated_users_table, deactivated_users, {
         name: "deactivated_users_table_list",
         modifier: function (item) {
-            return render_admin_user_list({ user: item, can_modify: page_params.is_admin });
+            return render_admin_user_list({
+                user: item,
+                show_email: settings_org.show_email(),
+                can_modify: page_params.is_admin,
+            });
         },
         filter: {
             element: $deactivated_users_table.closest(".settings-section").find(".search"),

static/templates/admin_user_list.hbs

@@ -4,13 +4,15 @@
         <span class="user_name">{{full_name}}</span>
         <i class="fa fa-ban deactivated-user-icon" title="{{t 'User is deactivated' }}" {{#if is_active}}style="display: none;"{{/if}}></i>
     </td>
+    {{#if ../show_email}}
     <td>
         {{#if ../can_modify}}
         <span class="email">{{delivery_email}}</span>
         {{else}}
         <span class="email">{{email}}</span>
         {{/if}}
     </td>
+    {{/if}}
     {{#unless is_bot}}
     <td>
         <span class="user_role">

static/templates/settings/deactivated_users_admin.hbs

@@ -12,7 +12,9 @@
         <table class="table table-condensed table-striped wrapped-table">
             <thead>
                 <th>{{t "Name" }}</th>
+                {{#if show_email}}
                 <th>{{t "Email" }}</th>
+                {{/if}}
                 <th class="user_role">{{t "Role" }}</th>
                 {{#if is_admin}}
                 <th class="actions">{{t "Actions" }}</th>

static/templates/settings/user_list_admin.hbs

@@ -8,7 +8,9 @@
     <table class="table table-condensed table-striped wrapped-table">
         <thead>
             <th class="wrapped-cell">{{t "Name" }}</th>
+            {{#if show_email}}
             <th>{{t "Email" }}</th>
+            {{/if}}
             <th class="user_role">{{t "Role" }}</th>
             <th class="last_active">{{t "Last active" }}</th>
             {{#if is_admin}}