fix: enforce platform role menu access

backend/api/internal/logic/platform/task4_resources.go

@@ -188,37 +188,61 @@ func isCreatedResponseField(key string) bool {
 }
 
 func protectPreciseLocation(ctx *gin.Context, model, value any) any {
-	if reflect.TypeOf(model) != reflect.TypeOf(&models.DeliveryTrackPoint{}) || hasPreciseLocationScope(ctx) {
-		return value
-	}
-	clearCoordinateFields(value)
+	maskPersonalName := reflect.TypeOf(model) == reflect.TypeOf(&models.UserAccount{}) ||
+		reflect.TypeOf(model) == reflect.TypeOf(&models.StaffAccount{})
+	protectPublicFields(value, maskPersonalName, hasPreciseLocationScope(ctx))
 	return value
 }
 
+func protectPublicFields(value any, maskPersonalName, retainCoordinates bool) {
+	switch data := value.(type) {
+	case map[string]any:
+		if phone, ok := data["phone"].(string); ok && phone != "" {
+			data["phone_masked"] = maskPhone(phone)
+		}
+		delete(data, "phone")
+		delete(data, "avatar")
+		delete(data, "address")
+		if maskPersonalName {
+			if name, ok := data["name"].(string); ok && name != "" {
+				data["name_masked"] = maskPersonalNameValue(name)
+			}
+			delete(data, "name")
+			if name, ok := data["real_name"].(string); ok && name != "" {
+				data["real_name_masked"] = maskPersonalNameValue(name)
+			}
+			delete(data, "real_name")
+		}
+		if !retainCoordinates {
+			delete(data, "longitude")
+			delete(data, "latitude")
+		}
+		for _, item := range data {
+			protectPublicFields(item, maskPersonalName, retainCoordinates)
+		}
+	case []any:
+		for _, item := range data {
+			protectPublicFields(item, maskPersonalName, retainCoordinates)
+		}
+	}
+}
+
+func maskPersonalNameValue(name string) string {
+	runes := []rune(name)
+	if len(runes) == 0 {
+		return ""
+	}
+	if len(runes) == 1 {
+		return "*"
+	}
+	return string(runes[0]) + strings.Repeat("*", len(runes)-1)
+}
+
 func hasPreciseLocationScope(ctx *gin.Context) bool {
 	claims, err := middleware.ParseAuth(ctx)
 	return err == nil && claims.Extend["location_scope"] == "precise"
 }
 
-func clearCoordinateFields(value any) {
-	switch data := value.(type) {
-	case map[string]any:
-		if _, ok := data["longitude"]; ok {
-			data["longitude"] = ""
-		}
-		if _, ok := data["latitude"]; ok {
-			data["latitude"] = ""
-		}
-		for _, item := range data {
-			clearCoordinateFields(item)
-		}
-	case []any:
-		for _, item := range data {
-			clearCoordinateFields(item)
-		}
-	}
-}
-
 func updateResource(ctx *gin.Context, model any, allowedFields []string, relations []ResourceRelation) {
 	var input map[string]any
 	if err := ctx.ShouldBindJSON(&input); err != nil {