Public Disclosure Projection

The bug this exists to prevent

The instinct is to redact: take the internal object, delete buyerId, delete email, return the rest. It works, it reviews well, and it is a denylist — correct only for the fields that existed on the day it was written.

Six months later someone adds purchaserContact to the internal type for an unrelated reason. The projection does not delete it, because nobody told it to. It is now on a public endpoint. Nothing failed, no test broke, and the leak is a field that was never considered.

The real bundle here was worse than one stray id. It embedded buyer identifiers in its event records and carried a system-wide integrity chain — every buyer's every action, not just the one item being disclosed. Handing that to an anonymous visitor is orders of magnitude past "one leaked id."

Rule 1 — allowlist, and prove it with a schema test

The projection emits exactly the allowlisted keys at every level, no more and no less. The test asserting that is the product: it fails when the internal shape grows, which is the only moment anyone would otherwise have to notice.

Rule 2 — drop the whole structure, do not redact inside it

The system-wide integrity log is removed entirely rather than filtered in place. Redacting within it would mean the public bundle's safety depends on a per-entry filter staying correct forever, over a structure that grows with every action in the system. Not shipping it is a property of the shape; filtering it is a promise about a loop.

Rule 3 — a scan over the whole object graph, not a field checklist

One test walks the entire output looking for any buyerId/email/user/payment/actorId shaped key at any depth. A checklist of known fields tests your memory; a graph scan tests the output. The scanner ships with the package.

What this does NOT do

No authentication, no authorisation, no rate limiting. It shapes a payload — deciding who may request it is yours.

It does not anonymise. There is no hashing or pseudonymisation: identifying fields are absent, not obscured, which is the stronger property and a different one.

Verified

5 tests: no PII-shaped key anywhere in the graph, the integrity log dropped entirely, every non-PII field the public surface needs retained, exactly the allowlisted keys at every level, and unknown fields on a grown internal shape stripped rather than passed through.

Not covered: nothing verifies your own bundle is safe — the allowlist encodes one internal shape, and adapting it is a deliberate edit. Re-run the graph scan against your output after.