feat(workspaces): expose role-aware membership details

apps/workspaces/api/serializers.py

@@ -4,6 +4,7 @@ from rest_framework import serializers
 
 from apps.notifications.services import notify_workspace_membership_added
 from apps.users.models import User
+from apps.workspaces.services import WORKSPACE_MEMBERS_VIEW, has_workspace_capability
 from core.serializers.base import BaseModelSerializer
 from apps.workspaces.models import PriceUnit, Workspace, WorkspaceMembership, WorkspaceUserRate
 from core.serializers.mini import UserMiniSerializer
@@ -76,22 +77,36 @@ class WorkspaceSerializer(BaseModelSerializer):
 
 
 class WorkspaceMembershipSerializer(BaseModelSerializer):
-    class Meta:
-        model = WorkspaceMembership
-        fields = BaseModelSerializer.Meta.fields + (
-            "workspace",
-            "user",
+    user = serializers.SerializerMethodField()
+
+    class Meta:
+        model = WorkspaceMembership
+        fields = BaseModelSerializer.Meta.fields + (
+            "workspace",
+            "user",
             "role",
             "is_active",
         )
 
-    def to_representation(self, instance):
-        data = super().to_representation(instance)
-        data["user"] = UserMiniSerializer(
-            instance.user,
-            context=self.context
-        ).data
-        return data
+    def get_user(self, instance):
+        request = self.context.get("request")
+        viewer = getattr(request, "user", None)
+        can_view_sensitive_details = bool(
+            viewer
+            and viewer.is_authenticated
+            and has_workspace_capability(viewer, instance.workspace, WORKSPACE_MEMBERS_VIEW)
+        )
+
+        user_data = UserMiniSerializer(instance.user, context=self.context).data
+        if can_view_sensitive_details:
+            return user_data
+
+        return {
+            "id": user_data["id"],
+            "first_name": user_data.get("first_name"),
+            "last_name": user_data.get("last_name"),
+            "profile_picture": user_data.get("profile_picture"),
+        }
 
 
 class PriceUnitSerializer(BaseModelSerializer):