fix: close platform access re-review findings

backend/api/internal/logic/platform/task4_resources.go

@@ -190,19 +190,29 @@ func isCreatedResponseField(key string) bool {
 func protectPreciseLocation(ctx *gin.Context, model, value any) any {
 	maskPersonalName := reflect.TypeOf(model) == reflect.TypeOf(&models.UserAccount{}) ||
 		reflect.TypeOf(model) == reflect.TypeOf(&models.StaffAccount{})
-	protectPublicFields(value, maskPersonalName, hasPreciseLocationScope(ctx))
+	maskDisplayName := reflect.TypeOf(model) == reflect.TypeOf(&models.PlatfromAccount{})
+	protectPublicFields(value, maskPersonalName, maskDisplayName, hasPreciseLocationScope(ctx))
 	return value
 }
 
-func protectPublicFields(value any, maskPersonalName, retainCoordinates bool) {
+var sensitiveResponseFields = map[string]bool{
+	"avatar": true, "address": true, "credential_no": true,
+	"evidence_uri": true, "evidence_url": true, "file_uri": true,
+	"attachment_uri": true, "attachment_url": true,
+	"certificate_uri": true, "certificate_url": true,
+	"credential_uri": true, "credential_url": true,
+}
+
+func protectPublicFields(value any, maskPersonalName, maskDisplayName, retainCoordinates bool) {
 	switch data := value.(type) {
 	case map[string]any:
 		if phone, ok := data["phone"].(string); ok && phone != "" {
 			data["phone_masked"] = maskPhone(phone)
 		}
 		delete(data, "phone")
-		delete(data, "avatar")
-		delete(data, "address")
+		for key := range sensitiveResponseFields {
+			delete(data, key)
+		}
 		if maskPersonalName {
 			if name, ok := data["name"].(string); ok && name != "" {
 				data["name_masked"] = maskPersonalNameValue(name)
@@ -213,16 +223,22 @@ func protectPublicFields(value any, maskPersonalName, retainCoordinates bool) {
 			}
 			delete(data, "real_name")
 		}
+		if maskDisplayName {
+			if name, ok := data["display_name"].(string); ok && name != "" {
+				data["display_name_masked"] = maskPersonalNameValue(name)
+			}
+			delete(data, "display_name")
+		}
 		if !retainCoordinates {
 			delete(data, "longitude")
 			delete(data, "latitude")
 		}
 		for _, item := range data {
-			protectPublicFields(item, maskPersonalName, retainCoordinates)
+			protectPublicFields(item, maskPersonalName, maskDisplayName, retainCoordinates)
 		}
 	case []any:
 		for _, item := range data {
-			protectPublicFields(item, maskPersonalName, retainCoordinates)
+			protectPublicFields(item, maskPersonalName, maskDisplayName, retainCoordinates)
 		}
 	}
 }