API: Adding secret.text to the user-schema (#12121)

test/api/v3/integration/user/GET-user.test.js

@@ -26,6 +26,7 @@ describe('GET /user', () => {
     expect(returnedUser.auth.local.passwordHashMethod).to.not.exist;
     expect(returnedUser.auth.local.salt).to.not.exist;
     expect(returnedUser.apiToken).to.not.exist;
+    expect(returnedUser.secret).to.not.exist;
   });
 
   it('returns only user properties requested', async () => {
@@ -38,4 +39,11 @@ describe('GET /user', () => {
     expect(returnedUser.notifications).to.exist;
     expect(returnedUser.stats).to.not.exist;
   });
+
+  it('does not return requested private properties', async () => {
+    const returnedUser = await user.get('/user?userFields=apiToken,secret.text');
+
+    expect(returnedUser.apiToken).to.not.exist;
+    expect(returnedUser.secret).to.not.exist;
+  });
 });

test/api/v3/integration/user/GET-user_anonymized.test.js

@@ -12,7 +12,11 @@ describe('GET /user/anonymized', () => {
   const endpoint = '/user/anonymized';
 
   before(async () => {
-    user = await generateUser();
+    user = await generateUser({
+      secret: {
+        text: 'Clark Kent',
+      },
+    });
     await user.update({
       newMessages: ['some', 'new', 'messages'],
       'profile.name': 'profile',
@@ -100,5 +104,7 @@ describe('GET /user/anonymized', () => {
         });
       }
     });
+
+    expect(returnedUser.secret).to.not.exist;
   });
 });

test/api/v3/integration/user/POST-user_reset.test.js

@@ -117,4 +117,24 @@ describe('POST /user/reset', () => {
     expect(userChallengeTask).to.exist;
     expect(syncedGroupTask).to.exist;
   });
+
+  it('does not delete secret', async () => {
+    const admin = await generateUser({
+      contributor: { admin: true },
+    });
+
+    const hero = await generateUser({
+      contributor: { level: 1 },
+      secret: {
+        text: 'Super-Hero',
+      },
+    });
+
+    await hero.post('/user/reset');
+
+    const heroRes = await admin.get(`/hall/heroes/${hero.auth.local.username}`);
+
+    expect(heroRes.secret).to.exist;
+    expect(heroRes.secret.text).to.be.eq('Super-Hero');
+  });
 });

test/api/v3/integration/user/PUT-user.test.js

@@ -107,6 +107,7 @@ describe('PUT /user', () => {
       'customization gem purchases': { 'purchased.background.tavern': true, 'purchased.skin.bear': true },
       notifications: [{ type: 123 }],
       webhooks: { webhooks: [{ url: 'https://foobar.com' }] },
+      secret: { secret: { text: 'Some new text' } },
     };
 
     each(protectedOperations, (data, testName) => {
@@ -129,6 +130,7 @@ describe('PUT /user', () => {
       webhooks: { 'preferences.webhooks': [1, 2, 3] },
       sleep: { 'preferences.sleep': true },
       'disable classes': { 'preferences.disableClasses': true },
+      secret: { secret: { text: 'Some new text' } },
     };
 
     each(protectedOperations, (data, testName) => {