security: separate Campaign reader and operator data

2026-07-21 17:55:54 +02:00
parent af833ca38c
commit 9a709b1264
6 changed files with 128 additions and 35 deletions
--- a/src/govoplan_campaign/backend/schemas.py
+++ b/src/govoplan_campaign/backend/schemas.py
@@ -128,8 +128,11 @@ class CampaignVersionResponse(BaseModel):

    @field_validator("validation_summary", "build_summary", mode="before")
    @classmethod
-    def remove_internal_summary_fields(cls, value: Any) -> Any:
-        return public_campaign_payload(value)
+    def remove_internal_summary_fields(cls, value: Any, info: ValidationInfo) -> Any:
+        return public_campaign_payload(
+            value,
+            include_diagnostics=bool((info.context or {}).get("include_diagnostics")),
+        )


 class CampaignVersionDetailResponse(CampaignVersionResponse):