🔒 fix exposing user in channel.recipients

src/models/Channel.ts

@@ -1,7 +1,7 @@
 import { Schema, model, Types, Document } from "mongoose";
 import db from "../util/Database";
 import toBigInt from "../util/toBigInt";
-import { UserModel } from "./User";
+import { PublicUserProjection, UserModel } from "./User";
 
 // @ts-ignore
 export interface AnyChannel extends Channel, DMChannel, TextChannel, VoiceChannel {
@@ -42,7 +42,7 @@ ChannelSchema.virtual("recipients", {
 	localField: "recipient_ids",
 	foreignField: "id",
 	justOne: false,
-	autopopulate: true,
+	autopopulate: { select: PublicUserProjection },
 });
 
 ChannelSchema.set("removeResponse", ["recipient_ids"]);

src/models/Invite.ts

@@ -1,7 +1,7 @@
 import { Schema, Document, Types } from "mongoose";
 import db from "../util/Database";
 import { ChannelModel } from "./Channel";
-import { UserModel } from "./User";
+import { PublicUserProjection, UserModel } from "./User";
 import { GuildModel } from "./Guild";
 
 export interface Invite {
@@ -60,13 +60,7 @@ InviteSchema.virtual("inviter", {
 	foreignField: "id",
 	justOne: true,
 	autopopulate: {
-		select: {
-			id: true,
-			username: true,
-			avatar: true,
-			discriminater: true,
-			public_flags: true,
-		},
+		select: PublicUserProjection,
 	},
 });