security: separate Campaign reader and operator data

src/govoplan_campaign/backend/response_security.py

@@ -24,20 +24,39 @@ CAMPAIGN_INTERNAL_RESPONSE_KEYS = frozenset(
     }
 )
 
+CAMPAIGN_DIAGNOSTIC_RESPONSE_KEYS = frozenset(
+    {
+        "background_workers_enabled",
+        "build_token",
+        "celery_enabled",
+        "claimed_at",
+        "effective_policy_sha256",
+        "execution_input_sha256",
+        "imap_claimed_at",
+        "imap_transport_revision",
+        "job_manifest_sha256",
+        "smtp_started_at",
+        "smtp_transport_revision",
+    }
+)
 
-def public_campaign_payload(value: Any) -> Any:
+
+def public_campaign_payload(value: Any, *, include_diagnostics: bool = False) -> Any:
     """Return a detached payload without infrastructure-only locators."""
 
     if isinstance(value, dict):
+        blocked_keys = CAMPAIGN_INTERNAL_RESPONSE_KEYS
+        if not include_diagnostics:
+            blocked_keys = blocked_keys | CAMPAIGN_DIAGNOSTIC_RESPONSE_KEYS
         return {
-            key: public_campaign_payload(item)
+            key: public_campaign_payload(item, include_diagnostics=include_diagnostics)
             for key, item in value.items()
-            if key not in CAMPAIGN_INTERNAL_RESPONSE_KEYS
+            if key not in blocked_keys
         }
     if isinstance(value, list):
-        return [public_campaign_payload(item) for item in value]
+        return [public_campaign_payload(item, include_diagnostics=include_diagnostics) for item in value]
     if isinstance(value, tuple):
-        return tuple(public_campaign_payload(item) for item in value)
+        return tuple(public_campaign_payload(item, include_diagnostics=include_diagnostics) for item in value)
     return copy.deepcopy(value)