Ole-Morten Duesund fbe37109a4 fix(feedback): stop exposing done_by user id in API responses ... Problem: GET /api/feedback (moderator-readable) returned the user id of the admin who marked an entry done. Moderators don't need to triangulate "which admin closed which ticket" — done_at alone is sufficient signal that the entry has been triaged. Keeping the user id in the response made it possible to cross-reference admins with the user list via a second authenticated call. Fix: the `feedback.done_by` column stays in the schema (server-side audit trail is preserved) but the column is no longer SELECTed by the list or update endpoints, and is no longer in the FeedbackEntry wire type. Moderators see only the `done_at` timestamp. Surfaced by /audit security (data exposure lens).		2026-05-25 13:54:07 +02:00
..
crypto.ts	Scaffold Vinterliste — end-to-end encrypted winter activity list	2026-05-25 12:27:14 +02:00
sodium.ts	Scaffold Vinterliste — end-to-end encrypted winter activity list	2026-05-25 12:27:14 +02:00
types.ts	fix(feedback): stop exposing done_by user id in API responses	2026-05-25 13:54:07 +02:00