From ae00f1fc441d305a0cf0096557c34143afe34e4a Mon Sep 17 00:00:00 2001
From: Koda <koda@twyco.de>
Date: Fri, 24 Apr 2026 09:37:53 +0000
Subject: [PATCH] Hide assignee metadata when no visible assigned tickets exist

---
 .../Api/UserAssignedTicketController.php      |  8 +++--
 docs/openapi/kanbangit-api.openapi.json       | 11 +++++--
 tests/Feature/Api/AssignedTicketsApiTest.php  | 33 +++++++++++++++++++
 .../Feature/Api/OpenApiDocumentationTest.php  |  8 +++++
 4 files changed, 56 insertions(+), 4 deletions(-)

diff --git a/app/Http/Controllers/Api/UserAssignedTicketController.php b/app/Http/Controllers/Api/UserAssignedTicketController.php
index c750955..cbd01cb 100644
--- a/app/Http/Controllers/Api/UserAssignedTicketController.php
+++ b/app/Http/Controllers/Api/UserAssignedTicketController.php
@@ -18,10 +18,14 @@ class UserAssignedTicketController extends ApiController
     {
         $viewer = $this->authenticatedUser($request);
 
+        $assignedTickets = $this->listAssignedTicketsByVisibleProject->handle($viewer, $user);
+
         return response()->json([
-            'data' => $this->listAssignedTicketsByVisibleProject->handle($viewer, $user),
+            'data' => $assignedTickets,
             'meta' => [
-                'assignee' => UserResource::make($user)->resolve(),
+                'assignee' => $assignedTickets === []
+                    ? null
+                    : UserResource::make($user)->resolve(),
             ],
         ]);
     }
diff --git a/docs/openapi/kanbangit-api.openapi.json b/docs/openapi/kanbangit-api.openapi.json
index 9a1a607..043b565 100644
--- a/docs/openapi/kanbangit-api.openapi.json
+++ b/docs/openapi/kanbangit-api.openapi.json
@@ -1643,7 +1643,7 @@
         }
       },
       "AssignedTicketsPayload": {
-        "description": "Tickets assigned to a user grouped by projects visible to the authenticated application key owner.",
+        "description": "Tickets assigned to a user grouped by projects visible to the authenticated application key owner. meta.assignee is null when no visible assigned tickets exist.",
         "content": {
           "application/json": {
             "schema": {
@@ -1844,7 +1844,14 @@
             "type": "object",
             "properties": {
               "assignee": {
-                "$ref": "#/components/schemas/User"
+                "anyOf": [
+                  {
+                    "$ref": "#/components/schemas/User"
+                  },
+                  {
+                    "type": "null"
+                  }
+                ]
               }
             },
             "required": ["assignee"]
diff --git a/tests/Feature/Api/AssignedTicketsApiTest.php b/tests/Feature/Api/AssignedTicketsApiTest.php
index 196f39e..0b7647f 100644
--- a/tests/Feature/Api/AssignedTicketsApiTest.php
+++ b/tests/Feature/Api/AssignedTicketsApiTest.php
@@ -77,4 +77,37 @@ class AssignedTicketsApiTest extends TestCase
             ->assertJsonCount(1, 'data.1.tickets')
             ->assertJsonCount(2, 'data');
     }
+
+    public function test_assignee_metadata_is_hidden_when_no_visible_assigned_tickets_exist(): void
+    {
+        $viewer = User::factory()->create();
+        $assignee = User::factory()->create([
+            'name' => 'Hidden User',
+        ]);
+
+        $visibleProject = Project::factory()->create([
+            'key' => 'VIS',
+            'name' => 'Visible project',
+        ]);
+        $hiddenProject = Project::factory()->create([
+            'key' => 'HID',
+            'name' => 'Hidden project',
+        ]);
+
+        $this->syncProjectPermissions($visibleProject, $viewer, ['view']);
+
+        Ticket::factory()->create([
+            'assignee_user_id' => $assignee->id,
+            'project_id' => $hiddenProject->id,
+            'sequence_number' => 1,
+            'ticket_key' => 'HID-1',
+            'title' => 'Hidden ticket',
+        ]);
+
+        $this->withApplicationKey($viewer)
+            ->getJson(route('api.users.assigned-tickets', $assignee))
+            ->assertOk()
+            ->assertJsonPath('data', [])
+            ->assertJsonPath('meta.assignee', null);
+    }
 }
diff --git a/tests/Feature/Api/OpenApiDocumentationTest.php b/tests/Feature/Api/OpenApiDocumentationTest.php
index db2ae00..24418f2 100644
--- a/tests/Feature/Api/OpenApiDocumentationTest.php
+++ b/tests/Feature/Api/OpenApiDocumentationTest.php
@@ -83,5 +83,13 @@ class OpenApiDocumentationTest extends TestCase
         $this->assertArrayHasKey('UserGitConnectionRequest', $document['components']['schemas']);
         $this->assertArrayHasKey('AssignedTicketsPayloadEnvelope', $document['components']['schemas']);
         $this->assertArrayHasKey('AssignedTicketsProjectGroup', $document['components']['schemas']);
+
+        $assigneeSchema = $document['components']['schemas']['AssignedTicketsPayloadEnvelope']['properties']['meta']['properties']['assignee'] ?? null;
+
+        $this->assertIsArray($assigneeSchema);
+        $this->assertSame([
+            ['$ref' => '#/components/schemas/User'],
+            ['type' => 'null'],
+        ], $assigneeSchema['anyOf'] ?? null);
     }
 }
-- 
2.54.0