Merge branch 'revert/self-view-signup-email'

internal/rpc/convert_users.go

@@ -13,24 +13,13 @@ func tgSelfUser(u domain.User) *tg.User {
 	if u.Deleted {
 		return &tg.User{ID: u.ID, Deleted: true}
 	}
-	phone := u.Phone
-	if u.SignupEmail != "" {
-		// Self view only: an email-signup account's users.phone is a random,
-		// meaningless "888" display number (see internal/domain/emailphone.go
-		// and cmd/createuser) -- showing the real signup email in its place is
-		// what the account's own My Account / Edit Profile screen should
-		// display. Never do this in tgUser (how *other* viewers see this
-		// account): the phone field there is already privacy-gated, and this
-		// would leak the email past that gate to anyone allowed to see a phone.
-		phone = u.SignupEmail
-	}
 	out := &tg.User{
 		ID:            u.ID,
 		AccessHash:    u.AccessHash,
 		FirstName:     u.FirstName,
 		LastName:      u.LastName,
 		Username:      u.Username,
-		Phone:         phone,
+		Phone:         u.Phone,
 		Self:          true,
 		Verified:      u.Verified,
 		Scam:          u.Scam,

internal/rpc/convert_users_test.go

@@ -1,51 +0,0 @@
-package rpc
-
-import (
-	"testing"
-
-	"telesrv/internal/domain"
-)
-
-// TestTgSelfUserShowsSignupEmailInPlaceOfDisplayPhone locks in that an
-// email-signup account's own "My Account" view shows the real signup email
-// instead of the meaningless random "888" display phone (see
-// internal/domain/emailphone.go, cmd/createuser) -- matching what an
-// official client's Edit Profile screen is expected to display.
-func TestTgSelfUserShowsSignupEmailInPlaceOfDisplayPhone(t *testing.T) {
-	u := domain.User{
-		ID:          42,
-		FirstName:   "Ducky",
-		Phone:       "88890942435",
-		SignupEmail: "ducky@zio.sh",
-	}
-	out := tgSelfUser(u)
-	if out.Phone != "ducky@zio.sh" {
-		t.Fatalf("tgSelfUser.Phone = %q, want signup email %q", out.Phone, "ducky@zio.sh")
-	}
-}
-
-// TestTgSelfUserKeepsPhoneWithoutSignupEmail confirms an ordinary phone
-// account's self view is unaffected.
-func TestTgSelfUserKeepsPhoneWithoutSignupEmail(t *testing.T) {
-	u := domain.User{ID: 42, FirstName: "Real", Phone: "15550001234"}
-	out := tgSelfUser(u)
-	if out.Phone != "15550001234" {
-		t.Fatalf("tgSelfUser.Phone = %q, want unchanged phone %q", out.Phone, "15550001234")
-	}
-}
-
-// TestTgUserNeverLeaksSignupEmail confirms the privacy boundary: how *other*
-// viewers see this account must never substitute the email for the phone --
-// only the account's own self view (tgSelfUser) does that.
-func TestTgUserNeverLeaksSignupEmail(t *testing.T) {
-	u := domain.User{
-		ID:          42,
-		FirstName:   "Ducky",
-		Phone:       "88890942435",
-		SignupEmail: "ducky@zio.sh",
-	}
-	out := tgUser(u)
-	if out.Phone != "88890942435" {
-		t.Fatalf("tgUser.Phone = %q, want raw display phone %q (email must not leak to other viewers)", out.Phone, "88890942435")
-	}
-}