diff --git a/models/contact/src/index.ts b/models/contact/src/index.ts index 0cfeacf2dbd..a0291182995 100644 --- a/models/contact/src/index.ts +++ b/models/contact/src/index.ts @@ -14,7 +14,7 @@ // limitations under the License. // -import activity from '@hcengineering/activity' +import activity, { type ActivityMessageControl } from '@hcengineering/activity' import { type Role, type Card } from '@hcengineering/card' import { AvatarType, @@ -340,6 +340,13 @@ export function createModel (builder: Builder): void { preposition: contact.string.For }) + // Prevent leaking private social identifiers (emails, external handles) via activity updates. + builder.createDoc>(activity.class.ActivityMessageControl, core.space.Model, { + objectClass: contact.class.Person, + skip: [], + skipFields: ['socialIds'] + }) + builder.mixin(contact.mixin.Employee, core.class.Class, activity.mixin.ActivityDoc, { preposition: contact.string.For }) diff --git a/plugins/contact-resources/src/components/SocialIdentityPresenter.svelte b/plugins/contact-resources/src/components/SocialIdentityPresenter.svelte index 0d9d88e72e3..65ed3fe7a3e 100644 --- a/plugins/contact-resources/src/components/SocialIdentityPresenter.svelte +++ b/plugins/contact-resources/src/components/SocialIdentityPresenter.svelte @@ -15,7 +15,7 @@ {#if socialIdProvider != null} @@ -46,8 +51,12 @@
-
{value.displayValue ?? value.value}
- {#if shouldShowAvatar} + {#if isOwner} +
{value.displayValue ?? value.value}
+ {#if shouldShowAvatar} +
+ {/if} + {:else}
{/if}