Update CHECK_AUTH Query to Prevent Over-Fetching Sensitive PII

[sancheet230]

Issue related to

PalisadoesFoundation/talawa-admin#3484

Description:

The CHECK_AUTH query in the talawa-api repository currently exposes unnecessary Personally Identifiable Information (PII) such as birthDate, phone.mobile, educationGrade, employmentStatus, and maritalStatus. This violates privacy best practices and regulatory standards (GDPR/CCPA).

Proposed Fix:

Minimize Fields: Update the CHECK_AUTH query to fetch only essential data for authentication (e.g., _id, email, firstName, image).
Field-Level Permissions: Use GraphQL directives (e.g., @auth) to restrict access to sensitive fields.
Backend Validation: Ensure resolvers enforce access control.

Revised Query Example:

query CHECK_AUTH {  
  checkAuth {  
    _id  
    firstName  
    email  
    image  
  }  
}

Impact:

Prevents unauthorized exposure of PII.
Ensures compliance with GDPR/CCPA.
Reduces attack surface by limiting sensitive data exposure.

[github-actions]

Congratulations on making your first Issue! 🎊 If you haven't already, check out our Contributing Guidelines and Issue Reporting Guidelines to ensure that you are following our guidelines for contributing and making issues.

[sancheet230]

I am already working on this issue check here I just have to do some changes in backend code first to solve the issue so kindly assign me

[sancheet230]

@palisadoes @Cioppolo14 I have completed all the changes required in backed to solve whole issue so you can assign me so that I can raise a PR for the same.

[palisadoes]

Which branch is this for?

[sancheet230]

@palisadoes main branch

[palisadoes]

We are focusing on the develop-postgres branch.
This will need to be closed

[sancheet230]

@palisadoes ok I will stick with develop-postgres branch from now on thanks for clarification