Skip to content

Fix/pii leak distributor dashboard#278

Open
Nareshkumawat-star wants to merge 11 commits into
aditiraj2006:mainfrom
Nareshkumawat-star:fix/pii-leak-distributor-dashboard
Open

Fix/pii leak distributor dashboard#278
Nareshkumawat-star wants to merge 11 commits into
aditiraj2006:mainfrom
Nareshkumawat-star:fix/pii-leak-distributor-dashboard

Conversation

@Nareshkumawat-star
Copy link
Copy Markdown
Contributor

📌 Linked Issue

Closes #236


📝 Summary of Changes

  • Updated the GET /api/users/:id endpoint in server/routes.ts to optionally verify the requesting user's Firebase token.
  • Applied a privacy projection that completely removes the phone field for any user except the farmer themselves or an admin.
  • Masked the location (address) field to only expose the state/city or fallback to a hidden string for distributors, retailers, and unauthenticated users.

🔧 Type of Change

  • 🐛 Bug fix
  • ✨ New feature / enhancement
  • 🧹 Refactor / code cleanup
  • 📄 Documentation update
  • 🧪 Test addition or update
  • ⚙️ Configuration / tooling change

🧪 Testing Steps

  1. Logged in as a Distributor.
  2. Navigated to the "Received Products" or Dashboard views where transaction details are listed.
  3. Verified that the farmer's full contact information (phone and full address) is no longer visible in the application or API response.
  4. Logged in as the farmer who owns the product and verified that full details are still accessible for themselves.

Environment tested on:

  • OS: Windows
  • Browser (if applicable): Chrome / Edge
  • Node version: 20+

🎥 Demo


✅ Checklist

  • My code follows the project's coding style and conventions
  • I have tested my changes locally (npm install + npm run dev)
  • I have linked the relevant issue above
  • I have not introduced any new linting errors or warnings
  • I have updated documentation if needed
  • My branch is up to date with main

🌟 GSSoC Declaration

  • This PR is submitted under GSSoC 2026
  • I have read and followed the Contributing Guidelines
  • I have not plagiarised any content
  • This is my original work

Test User and others added 10 commits June 5, 2026 20:24
- Convert useAuth.ts (plain hook) to useAuth.tsx with AuthProvider + AuthContext
  so all components share a single Firebase auth listener and auth state is
  never re-created on route changes
- Update getStoredLanguage() in useLanguage.tsx to fall back to
  navigator.language when no value is stored in localStorage, so first-time
  visitors get their browser language automatically
- Wrap App.tsx with AuthProvider (outermost) > LanguageProvider, ensuring
  the language context always reads from a stable auth state

Fixes the regression where switching to Hindi (or any non-English language)
was reset to English on every route navigation because LanguageProvider's
user?.language effect was firing from a freshly-initialised useAuth() call.
@github-actions github-actions Bot added the gssoc'26 Contribution for GirlScript Summer of Code 2026 label Jun 7, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

gssoc'26 Contribution for GirlScript Summer of Code 2026

Projects

None yet

Development

Successfully merging this pull request may close these issues.

[Bug] Distributor dashboard shows farmer's private contact details without role check

1 participant