Narrow what the Limited event role can see (#107)

Limited already worked without exact dates of birth or addresses. It now
also works without phone numbers, and without the contact details of the
people around a participant.

- Every phone number is hidden: participant profile and card, the table
  column, the edit form (and its strong params), the scanner modal and
  its lookup JSON, SMS rows in message delivery logs, the phone export
  column, the mobile API payload, and the MCP participant tools.
- Guardian email and phone are hidden on the profile and in the API.
  The guardian edit form and "link guardian" are closed to the role
  outright, since both are nothing but contact details -- and the
  guardians controller had no authorization check at all before this.
- Emergency contacts now appear on the participant profile: first name
  and phone number for Limited, so an incident can be escalated, and the
  full record for roles that already had it on the safeguarding tab.
  Nothing new for Ops.
- The support inbox is closed to the role: a ticket is an SMS or email
  thread keyed by the sender's number or address, so there is no
  redacted version of it to show.
- The change history hides phone changes, and hides email changes on
  guardian and emergency-contact records while keeping the
  participant's own.

An attendee's own email address is deliberately untouched -- the role
searches and works from it every day.

Author: leowilkin

app/controllers/admin/guardians_controller.rb

@@ -3,6 +3,9 @@ class GuardiansController < BaseController
     before_action :require_event_selected
     before_action :set_participant_event
     before_action :set_guardian_participant_event
+    # The form is nothing but a guardian's contact details and address, none of
+    # which PII-restricted roles may see, so they can't open or submit it.
+    before_action :require_contact_details_access
 
     def edit
       @guardian = @guardian_participant_event.guardian
@@ -37,6 +40,13 @@ def update
 
     private
 
+    def require_contact_details_access
+      return if can_view_participant_pii?
+
+      redirect_to admin_event_participant_path(current_event, @participant_event),
+        alert: "Your role cannot edit guardian details, because it cannot see their contact details."
+    end
+
     def set_participant_event
       @participant_event = current_event.participant_events.find(params[:participant_id])
     end

app/controllers/admin/participants_controller.rb

@@ -157,11 +157,21 @@ def show
       @guardian_participant_events = @participant_event.guardian_participant_events.includes(:guardian)
       @notes = @participant_event.notes.includes(:author).order(created_at: :desc)
       @scans = @participant_event.scans.includes(:user, :scan_context).recent.limit(3)
+      @emergency_contacts = emergency_contacts_for_profile
     end
 
     def link_guardian
       authorize @participant_event, :update?
 
+      # A guardian's contact details stay hidden from PII-restricted roles, so
+      # they have no business writing them either. The form is hidden for them;
+      # this stops a hand-crafted POST.
+      unless can_view_participant_pii?
+        redirect_to admin_event_participant_path(current_event, @participant_event),
+          alert: "Your role cannot add guardians, because it cannot see their contact details."
+        return
+      end
+
       guardian_email = params[:guardian_email].to_s.strip.downcase
       participant_email = @participant_event.participant.email.to_s.strip.downcase
 
@@ -937,6 +947,20 @@ def set_participant_event
       @participant_event = current_event.participant_events.find(params[:id])
     end
 
+    # Emergency contacts for the profile page. Safeguarding viewers see them in
+    # full (the same list the safeguarding tab shows); PII-restricted roles get
+    # a first name and a phone number, because running an incident means being
+    # able to call someone. Every other role sees no section at all, which is
+    # what they saw before this block existed.
+    def emergency_contacts_for_profile
+      return nil unless !can_view_participant_pii? || policy(@participant_event).view_safeguarding?
+
+      EmergencyContact.left_joins(:guardian_participant_event).where(
+        "emergency_contacts.participant_event_id = :pe_id OR guardian_participant_events.participant_event_id = :pe_id",
+        pe_id: @participant_event.id
+      ).by_priority
+    end
+
     def set_participant_header_data
       @participant = @participant_event.participant
       @safeguarding_info = @participant_event.safeguarding_info
@@ -948,10 +972,11 @@ def participant_params
         :legal_first_name, :legal_last_name, :preferred_name, :email,
         :date_of_birth, :phone, :pronouns, :tshirt_size, :headshot
       ]
-      # The edit form hides the field for PII-restricted roles; dropping it here
-      # too means a hand-crafted POST can't write (or probe) a date of birth
-      # the same user isn't allowed to read back.
-      permitted.delete(:date_of_birth) unless can_view_participant_pii?
+      # The edit form hides these fields for PII-restricted roles; dropping them
+      # here too means a hand-crafted POST can't write (or probe) a date of
+      # birth or phone number the same user isn't allowed to read back. Email
+      # stays: those roles can see and search on a participant's address.
+      permitted -= [ :date_of_birth, :phone ] unless can_view_participant_pii?
 
       params.require(:participant).permit(*permitted)
     end

app/controllers/admin/scans_controller.rb

@@ -177,7 +177,9 @@ def create
           display_name: participant.display_name,
           full_name: participant.full_name,
           email: participant.email,
-          phone: participant.phone,
+          # The phone is omitted, not blanked, for PII-restricted roles; the
+          # scanner modal hides that row entirely for them.
+          **(can_view_participant_pii? ? { phone: participant.phone } : {}),
           pronouns: participant.pronouns,
           tshirt_size: participant.tshirt_size,
           status: participant_event.status,
@@ -210,6 +212,13 @@ def history
           )
       end
 
+      # The participant profile links here for one person's scans. It filters by
+      # id rather than putting their email in the URL, which roles that can't
+      # see contact details must not be handed.
+      if params[:participant_event_id].present?
+        @scans = @scans.where(participant_event_id: params[:participant_event_id])
+      end
+
       if params[:scan_context_id].present?
         @scans = @scans.where(scan_context_id: params[:scan_context_id])
       end

app/controllers/api/v1/participants_controller.rb

@@ -217,9 +217,10 @@ def participant_json(pe, detailed: false)
           participant_event_id: pe.id,
           display_name: participant.display_name,
           full_name: participant.full_name,
-          # Contact details are omitted, not nulled, for PII-restricted roles —
-          # same contract as date_of_birth and address in #personal_json.
-          **(include_pii? ? { email: participant.email, phone: participant.phone } : {}),
+          email: participant.email,
+          # The phone is omitted, not nulled, for PII-restricted roles — same
+          # contract as date_of_birth and address in #personal_json.
+          **(include_pii? ? { phone: participant.phone } : {}),
           slack_user_id: participant.slack_user_id,
           pronouns: participant.pronouns,
           headshot_url: headshot_url_for(participant),
@@ -528,8 +529,9 @@ def travel_leg_json(leg)
         }
       end
 
-      # Whether this caller gets exact dates of birth, addresses, and contact
-      # details (their own and their guardians'). Memoized
+      # Whether this caller gets exact dates of birth, addresses, phone numbers,
+      # and the people around a participant (guardian and emergency contact
+      # details). A participant's own email address is not gated. Memoized
       # for the same reason as can_view_sensitive_data? below. A nil
       # current_user means an event API key, which never reaches the actions
       # that serve these fields (see API_KEY_ALLOWED_ACTIONS).

app/helpers/admin/audit_logs_helper.rb

@@ -2,15 +2,22 @@ module Admin
   module AuditLogsHelper
     SENSITIVE_FIELD_PATTERNS = /password|token|secret|api_key|otp|access_key/i
 
-    # Columns holding an exact date of birth or a home address, on participants
-    # and guardians alike. PII-restricted roles (see
-    # EventRoleAssignment::PII_RESTRICTED_ROLES) can reach a participant's change
-    # history, and a changeset is just as revealing as the field itself.
+    # Columns holding an exact date of birth, a home address, or a phone number,
+    # on participants, guardians, and emergency contacts alike. PII-restricted
+    # roles (see EventRoleAssignment::PII_RESTRICTED_ROLES) can reach a
+    # participant's change history, and a changeset is just as revealing as the
+    # field itself.
     PII_FIELDS = %w[
       date_of_birth address_line_1 address_line_2 city state postal_code
       country country_of_residence
+      phone phone_number phone_override
     ].freeze
 
+    # The history page mixes in Guardian and EmergencyContact versions. A
+    # participant's own email address is visible to PII-restricted roles; the
+    # people around them still aren't.
+    EMAIL_FIELDS = %w[email invited_via_email].freeze
+
     def audit_field_label(field)
       field.to_s.humanize
     end
@@ -29,13 +36,18 @@ def audit_changed_field_pairs(changed_fields)
 
     # Returns a hash of {field => [old, new]} from a PaperTrail::Version.
     # Hides framework noise so the diff stays human-readable. Pass
-    # `hide_pii: true` to also drop dates of birth and addresses.
+    # `hide_pii: true` to also drop dates of birth, addresses, phone numbers,
+    # and everyone-but-the-participant's email.
     def audit_version_changes(version, hide_pii: false)
       raw = (version.respond_to?(:changeset) ? version.changeset : nil) || {}
       cleaned = raw.except("updated_at", "created_at", "encrypted_password", "remember_created_at",
         "current_sign_in_at", "last_sign_in_at", "current_sign_in_ip", "last_sign_in_ip",
         "sign_in_count", "oidc_claims")
-      hide_pii ? cleaned.except(*PII_FIELDS) : cleaned
+      return cleaned unless hide_pii
+
+      hidden = PII_FIELDS
+      hidden += EMAIL_FIELDS unless version.item_type == "Participant"
+      cleaned.except(*hidden)
     rescue => e
       Rails.logger.warn("[AuditLog] Could not parse version #{version.id}: #{e.message}")
       {}

app/helpers/admin/participants_helper.rb

@@ -76,6 +76,14 @@ def render_blocking_step_badge(participant_event)
     content_tag(:span, label, class: "inline-flex items-center px-2 py-0.5 rounded text-xs font-medium bg-yellow-50 text-yellow-700 border border-yellow-200")
   end
 
+  # Placeholder for a contact detail the current role isn't allowed to see (see
+  # EventRoleAssignment::PII_RESTRICTED_ROLES). Every surface hides it the same
+  # way, and the title says why so it doesn't read as missing data.
+  def contact_hidden_placeholder(label = "Hidden")
+    content_tag(:span, label, class: "italic text-gray-400",
+      title: "Phone numbers and guardian contact details are hidden for your role")
+  end
+
   def render_sort_icon(field, current_sort, current_direction)
     return "" unless current_sort == field
 

app/models/emergency_contact.rb

@@ -27,6 +27,13 @@ def participant
     participant_event&.participant || guardian_participant_event&.participant
   end
 
+  # `name` is one free-form field, so the first word is the best we can do for a
+  # first name. Roles that can't see contact details still get this much plus
+  # the phone number, so they can call the contact during an incident.
+  def first_name
+    name.to_s.split.first.presence || name
+  end
+
   private
 
   def linked_to_guardian_or_participant

app/models/event_role_assignment.rb

@@ -15,10 +15,14 @@ class EventRoleAssignment < ApplicationRecord
   }
 
   # Roles that do the job without seeing a participant's most identifying
-  # details: they get age instead of an exact date of birth, and no address of
-  # any kind — not the home address, not the travel pickup address. Medical
-  # records are deliberately NOT restricted; someone helping with a medical
-  # incident needs the conditions and medications. Enforced through
+  # details: they get age instead of an exact date of birth, no address of any
+  # kind — not the home address, not the travel pickup address — and no phone
+  # numbers, plus nothing at all for the people around a participant (guardian
+  # and emergency contact contact details). The exceptions are the
+  # participant's own email address, which these roles search and work from
+  # every day, and an emergency contact's first name and phone number, which
+  # someone running an incident has to be able to dial. Medical records are
+  # deliberately NOT restricted for the same reason. Enforced through
   # User#can_view_participant_pii?, which every surface that renders or exports
   # those fields checks.
   PII_RESTRICTED_ROLES = %w[limited].freeze
@@ -56,17 +60,22 @@ class EventRoleAssignment < ApplicationRecord
     },
     "limited" => {
       label: "Limited",
-      summary: "Day-to-day logistics, without addresses or exact birthdays.",
+      summary: "Day-to-day logistics, without phone numbers, addresses, or exact birthdays.",
       can: [
         "View and edit travel and accommodation",
         "Manage groups and rooming",
         "View full medical records, so they can help in an incident",
         "View consents and notes",
-        "See age at the event, instead of a date of birth"
+        "See age at the event, instead of a date of birth",
+        "See attendee email addresses, and search by them",
+        "See the first name and phone number of an emergency contact"
       ],
       cannot: [
         "See exact dates of birth",
         "See any address, at home or for travel pickup",
+        "See phone numbers, other than an emergency contact one",
+        "See a guardian email address, or edit guardian details",
+        "Work the support inbox",
         "Manage staff",
         "Add or remove participants",
         "Access safeguarding records"

app/models/user.rb

@@ -14,8 +14,11 @@ class User < ApplicationRecord
 
   enum :global_role, { no_role: "none", global_admin: "global_admin", read_only: "read_only" }, default: :no_role
 
-  # Event roles whose day-to-day work includes the support inbox.
-  SUPPORT_ROLES = %w[event_admin ops limited].freeze
+  # Event roles whose day-to-day work includes the support inbox. Limited is
+  # deliberately absent: an SMS ticket is keyed by the sender's phone number,
+  # and threads carry guardians' contact details too, neither of which that
+  # role may see (see EventRoleAssignment::PII_RESTRICTED_ROLES).
+  SUPPORT_ROLES = %w[event_admin ops].freeze
 
   # `oidc_claims` holds PII straight from Hack Club Auth (phone number,
   # birthdate, home address). Encrypting the whole jsonb blob works because the
@@ -334,8 +337,10 @@ def admin?
       series_role_assignments.exists?
   end
 
-  # Whether this user may see participants' exact dates of birth and home
-  # addresses. False only for someone whose access comes entirely from
+  # Whether this user may see participants' identifying details: exact dates of
+  # birth, home addresses, phone numbers, and the contact details of the people
+  # around them (guardians and emergency contacts). A participant's own email
+  # address is not gated. False only for someone whose access comes entirely from
   # PII-restricted roles (see EventRoleAssignment::PII_RESTRICTED_ROLES) —
   # holding any other role, on the event in question or anywhere when no event
   # is given, restores the full view. Fails closed for a user with no roles.

app/services/exports/field_registry.rb

@@ -17,7 +17,7 @@ class FieldRegistry
     CATEGORIES = {
       "identity"           => { label: "Identity", tier: :identity, description: "Participant name and email" },
       "basic"              => { label: "Participant", tier: :general, description: "Contact details, address, and profile information",
-                                pii_restricted_description: "Contact details and profile information" },
+                                pii_restricted_description: "Profile information" },
       "event_status"       => { label: "Event Status", tier: :general, description: "Registration status, check-in, and onboarding progress" },
       "travel"             => { label: "Travel", tier: :general, description: "Inbound and outbound travel details" },
       "flight_legs"        => { label: "Flight Legs", tier: :general, description: "Per-leg flight details (only in one-row-per-flight-leg mode)" },
@@ -44,8 +44,11 @@ class FieldRegistry
     # EventRoleAssignment::PII_RESTRICTED_ROLES). "Age at Event Start" stays, so
     # a Limited exporter can still do the rooming and minor-count work that
     # needs an age. The travel origin addresses are here too: for a car
-    # journey that field is the participant's doorstep.
+    # journey that field is the participant's doorstep. The phone number goes
+    # with them; a participant's email address does not, since those roles work
+    # from it every day.
     PII_RESTRICTED_FIELD_KEYS = %w[
+      participant.phone
       participant.date_of_birth
       participant.address_line_1
       participant.address_line_2