PII: search filters can infer masked values (and free-text PII)

[arturasmckwcz]

Follow-up from the GET PII-masking change.

Masking hides Person/Address in the response, but list endpoints filter on the unmasked DB columns (getAgentWhere street/search, getVolunteerWhere search, getOpportunityWhere, etc.). A non-privileged caller can therefore infer a hidden value by probing search patterns and seeing which (masked) rows match.

Also: PII embedded in free-text (e.g. legacy <|> contact comments, communication notes) isn't reached by entity-level masking.

Proposed: for non-privileged roles, scope/disable the searchable filters (or apply the same visibility scoping to the query WHERE), and consider redacting known free-text PII. // SECURITY: markers added at the filter sites.

🤖 Generated with Claude Code

[arturasmckwcz]

Status update (after the GET PII-masking work landed)

The response-side masking is now in develop:

• Mask PII on GET /opportunity, /volunteer, /agent by role #667 — mask Person/Address on GET /opportunity|/volunteer|/agent by role
• feat(pii): mask accompanying + comments by caller visibility #671 — mask Accompanying scalars + Comment.text by caller visibility

What this changes for this issue:

• The free-text comment sub-point is now partly mitigated — Comment.text is masked in responses unless the caller is authorised. But other free-text PII is still un-redacted: legacy <|> contact comments' structured fields, communication/appreciation notes, and Opportunity.info/infoConfidential.
• The core side-channel is unchanged: list endpoints still filter on the unmasked DB columns (getAgentWhere street/search, getVolunteerWhere search, getOpportunityWhere), so a non-privileged caller can still infer a masked value by probing which rows match. The // SECURITY (#666): markers remain at those filter sites.

Still to do:

1. For non-privileged roles, scope/disable the searchable filters (or apply the same CallerVisibility scoping to the query WHERE).
2. Redact known free-text PII not covered by entity-level masking.

This likely folds into the broader role-matrix / endpoint-auth pass (the parked agent-profile 403 work), since both need a single source of truth for "what a role may see".

🤖 Generated with Claude Code