Refactor user show view to display API tokens conditionally and remov…

[fujiwara-e]

概要

ユーザ詳細画面で，ログインしていないユーザの画面にログインしているユーザの API キーが表示されるようになっていた．

変更点

• UsersController で表示中のユーザがログインユーザと同じ場合のみトークンを取得．
• 表示中のユーザがログインユーザと同じ場合のみ API トークンのセクションを表示するように変更．

[Copilot]

Pull request overview

Fixes a data-leak issue where a logged-in user’s API token(s) could appear on another user’s detail page.

Changes:

• Restricts UsersController#show to load API tokens only when the shown user is the current user.
• Updates the user show view to render the API token section only for the current user.
• Removes self-referential links from the name and screen name fields on the user show page.

Reviewed changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated 4 comments.

File	Description
app/controllers/users_controller.rb	Conditionally loads @api_tokens only for the current user to prevent cross-user exposure.
app/views/users/show.html.erb	Conditionally renders the API token section only when viewing your own profile; adjusts name/screen name display.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.