fix(users): hide admin users for non admins from user list API [EE-6290] (#10580)

* hide admin users for non admins from user list API

* address review comments

api/http/handler/users/user_list.go

@@ -10,6 +10,13 @@ import (
 	"github.com/portainer/portainer/pkg/libhttp/response"
 )
 
+type User struct {
+	ID       portainer.UserID `json:"Id" example:"1"`
+	Username string           `json:"Username" example:"bob"`
+	// User role (1 for administrator account and 2 for regular account)
+	Role portainer.UserRole `json:"Role" example:"1"`
+}
+
 // @id UserList
 // @summary List users
 // @description List Portainer users.
@@ -40,11 +47,11 @@ func (handler *Handler) userList(w http.ResponseWriter, r *http.Request) *httper
 		return httperror.InternalServerError("Unable to retrieve users from the database", err)
 	}
 
+	availableUsers := security.FilterUsers(users, securityContext)
+
 	endpointID, _ := request.RetrieveNumericQueryParameter(r, "environmentId", true)
 	if endpointID == 0 {
-		if securityContext.IsAdmin {
+		users := sanitizeUsers(availableUsers)
-			sanitizeUsers(users)
-		}
 		return response.JSON(w, users)
 	}
 
@@ -59,14 +66,11 @@ func (handler *Handler) userList(w http.ResponseWriter, r *http.Request) *httper
 		return httperror.InternalServerError("Unable to retrieve environment groups from the database", err)
 	}
 
-	canAccessEndpoint := make([]portainer.User, 0)
+	canAccessEndpoint := make([]User, 0)
-	for _, user := range users {
+	for _, user := range availableUsers {
 		// the users who have the endpoint authorization
 		if _, ok := user.EndpointAuthorizations[endpoint.ID]; ok {
-			if securityContext.IsAdmin {
+			canAccessEndpoint = append(canAccessEndpoint, sanitizeUser(user))
-				sanitizeUser(&user)
-			}
-			canAccessEndpoint = append(canAccessEndpoint, user)
 			continue
 		}
 
@@ -77,27 +81,25 @@ func (handler *Handler) userList(w http.ResponseWriter, r *http.Request) *httper
 		}
 
 		if security.AuthorizedEndpointAccess(endpoint, endpointGroup, user.ID, teamMemberships) {
-			if securityContext.IsAdmin {
+			canAccessEndpoint = append(canAccessEndpoint, sanitizeUser(user))
-				sanitizeUser(&user)
-			}
-			canAccessEndpoint = append(canAccessEndpoint, user)
 		}
 	}
 
 	return response.JSON(w, canAccessEndpoint)
 }
 
-func sanitizeUser(user *portainer.User) {
+func sanitizeUser(user portainer.User) User {
-	user.Password = ""
+	return User{
-	user.EndpointAuthorizations = nil
+		ID:       user.ID,
-	user.ThemeSettings = portainer.UserThemeSettings{}
+		Username: user.Username,
-	user.PortainerAuthorizations = nil
+		Role:     user.Role,
-	user.UserTheme = ""
-	user.TokenIssueAt = 0
-}
-
-func sanitizeUsers(users []portainer.User) {
-	for i := range users {
-		sanitizeUser(&users[i])
 	}
 }
+
+func sanitizeUsers(users []portainer.User) []User {
+	u := make([]User, len(users))
+	for i := range users {
+		u[i] = sanitizeUser(users[i])
+	}
+	return u
+}