fix(security): block role escalation, harden review updates, strip se…

[crackle2k]

…nsitive public profile fields

• Reject business_owner/admin self-registration; role must be granted via claim flow
• Add user_id filter to review UPDATE query as DB-layer defense-in-depth
• Remove subscription_tier from public user profiles
• Mask admin role as customer in public profiles to prevent admin enumeration

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
vantage	Ready	Preview, Comment	Jun 29, 2026 2:45pm

[gemini-code-assist]

Code Review

This pull request introduces several security and privacy improvements, including restricting self-registration for business owners and admins, ensuring users can only update their own reviews by matching the authenticated user ID, hiding admin roles on public profiles, and restricting the subscription tier field to private profiles. The review feedback suggests further hardening user privacy by also stripping detailed user preferences from public profiles when private information is not requested.

Important

The consumer version of Gemini Code Assist on GitHub is being sunset. Starting June 18, 2026, new organization installations will be blocked, and all code review activity will officially cease on July 17, 2026.
For more details on the timeline and next steps, please review the Help Documentation.

[gemini-code-assist]

While removing subscription_tier from public profiles is a great step toward privacy hardening, the public profile still exposes highly detailed user preferences (such as preferences, preferred_categories, preferred_vibes, prefer_independent, price_pref, discovery_mode, and preferences_completed). These fields contain sensitive personal preferences and should be stripped from public profiles when include_private is false.

We can clean these up in the else block of the include_private check to ensure they are never leaked publicly.

    if include_private {
        value["email"] = json!(email);
        value["subscription_tier"] = 
            json!(metadata_str(&user.app_metadata, "subscription_tier").unwrap_or("FREE"));
    } else if let Some(obj) = value.as_object_mut() {
        obj.remove("preferences");
        obj.remove("preferred_categories");
        obj.remove("preferred_vibes");
        obj.remove("prefer_independent");
        obj.remove("price_pref");
        obj.remove("discovery_mode");
        obj.remove("preferences_completed");
    }