Fix annotation privacy: filter /api/tasks/<id>/ embedded annotations

ls_proxy_hf.py

@@ -1118,6 +1118,28 @@ def projects_ls():
     return _proxy_stream("/projects/")
 
 
+@app.route("/api/tasks/<int:task_id>/", methods=["GET"])
+@app.route("/api/tasks/<int:task_id>", methods=["GET"])
+def filter_task_data(task_id):
+    """Strip other users' embedded annotations from task data so LS shows a blank form."""
+    uid, admin = get_current_user(request)
+    resp = _proxy_buffered(f"/api/tasks/{task_id}/")
+    if admin or uid is None:
+        return _respond_buffered(resp)
+    try:
+        data = resp.json()
+        if "annotations" in data:
+            def _cb_id(ann):
+                cb = ann.get("completed_by")
+                return cb.get("id") if isinstance(cb, dict) else cb
+            data["annotations"] = [a for a in data["annotations"] if _cb_id(a) == uid]
+            data["total_annotations"] = len(data["annotations"])
+        return Response(json.dumps(data), status=resp.status_code,
+                        content_type="application/json; charset=utf-8")
+    except Exception:
+        return _respond_buffered(resp)
+
+
 @app.route("/api/tasks/<int:task_id>/annotations/", methods=["GET", "POST"])
 @app.route("/api/tasks/<int:task_id>/annotations", methods=["GET", "POST"])
 def filter_task_annotations(task_id):
@@ -1178,7 +1200,10 @@ def filter_task_annotations(task_id):
         return _respond_buffered(resp)
     try:
         data = resp.json()
-        own = [ann for ann in data if ann.get("completed_by") == uid]
+        def _cb_id(ann):
+            cb = ann.get("completed_by")
+            return cb.get("id") if isinstance(cb, dict) else cb
+        own = [ann for ann in data if _cb_id(ann) == uid]
         return Response(json.dumps(own), status=resp.status_code,
                         content_type="application/json; charset=utf-8")
     except Exception: