From feb09823bfb976d651ee0f3a8dfe58bbbbe1472e Mon Sep 17 00:00:00 2001
From: Jakub Zych <jakub@keios.eu>
Date: Fri, 18 Sep 2026 23:45:55 +0200
Subject: [PATCH] fix(05): CR-03 hide User password and require secret columns
 in Hidden()

---
 models/user.go | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/models/user.go b/models/user.go
index dc6769e..d19833b 100644
--- a/models/user.go
+++ b/models/user.go
@@ -4,12 +4,15 @@ package models
 type User struct {
 	ID                 uint   `gorm:"column:id;primaryKey"`
 	Email              string `gorm:"column:email"`
-	Password           string `gorm:"column:password"`
+	Password           string `gorm:"column:password" json:"-"`
 	MustChangePassword bool   `gorm:"column:must_change_password"`
 }
 
 func (User) TableName() string { return "users" }
 
+// Hidden mirrors PHP User::$hidden for the columns this stub carries (D-08).
+func (User) Hidden() []string { return []string{"password"} }
+
 func init() {
 	Register(User{})
 }