fix(server): keep service accounts out of the namespace payload

openapi/spec/components/schemas/namespace.yaml

@@ -7,7 +7,10 @@ properties:
   tenant_id:
     $ref: namespaceTenantID.yaml
   members:
-    description: Namespace's members
+    description: >-
+      The namespace's human members. A service account is a non-human
+      principal that exists for SSH and is listed by GET /api/service-accounts,
+      so it is never a member here.
     type: array
     items:
       type: object

pkg/api/responses/namespace.go

@@ -0,0 +1,94 @@
+package responses
+
+import (
+	"time"
+
+	"github.com/shellhub-io/shellhub/pkg/api/authorizer"
+	"github.com/shellhub-io/shellhub/pkg/models"
+)
+
+// Member is a person's membership as the namespace routes return it. It carries no principal
+// type, because every member here is a person.
+type Member struct {
+	ID               string            `json:"id,omitempty"`
+	AddedAt          time.Time         `json:"added_at"`
+	Email            string            `json:"email"`
+	Role             authorizer.Role   `json:"role"`
+	AccountStatus    models.UserStatus `json:"account_status,omitempty"`
+	AwaitingApproval bool              `json:"awaiting_approval,omitempty"`
+}
+
+// Namespace is what the namespace routes return. Its Members holds people only; a service
+// account is listed by GET /api/service-accounts instead.
+type Namespace struct {
+	Name     string                    `json:"name"`
+	Owner    string                    `json:"owner"`
+	TenantID string                    `json:"tenant_id"`
+	Members  []Member                  `json:"members"`
+	Settings *models.NamespaceSettings `json:"settings"`
+
+	DevicesAcceptedCount int64 `json:"devices_accepted_count"`
+	DevicesPendingCount  int64 `json:"devices_pending_count"`
+	DevicesRejectedCount int64 `json:"devices_rejected_count"`
+	DevicesRemovedCount  int64 `json:"devices_removed_count"`
+
+	MaxDevices int             `json:"max_devices"`
+	CreatedAt  time.Time       `json:"created_at"`
+	Billing    *models.Billing `json:"billing"`
+	Type       models.Type     `json:"type"`
+}
+
+// NamespaceFromModel projects the stored namespace onto the response, dropping the service
+// accounts from its members. It returns nil for a nil namespace, and its Members is never nil, so
+// a namespace with no human member serializes as an empty array rather than null. A member whose
+// type is empty counts as a person.
+func NamespaceFromModel(m *models.Namespace) *Namespace {
+	if m == nil {
+		return nil
+	}
+
+	members := make([]Member, 0, len(m.Members))
+
+	for _, member := range m.Members {
+		if member.Type == models.UserTypeService {
+			continue
+		}
+
+		members = append(members, Member{
+			ID:               member.ID,
+			AddedAt:          member.AddedAt,
+			Email:            member.Email,
+			Role:             member.Role,
+			AccountStatus:    member.AccountStatus,
+			AwaitingApproval: member.AwaitingApproval,
+		})
+	}
+
+	return &Namespace{
+		Name:                 m.Name,
+		Owner:                m.Owner,
+		TenantID:             m.TenantID,
+		Members:              members,
+		Settings:             m.Settings,
+		DevicesAcceptedCount: m.DevicesAcceptedCount,
+		DevicesPendingCount:  m.DevicesPendingCount,
+		DevicesRejectedCount: m.DevicesRejectedCount,
+		DevicesRemovedCount:  m.DevicesRemovedCount,
+		MaxDevices:           m.MaxDevices,
+		CreatedAt:            m.CreatedAt,
+		Billing:              m.Billing,
+		Type:                 m.Type,
+	}
+}
+
+// NamespacesFromModel projects a page of namespaces, and returns an empty slice for an empty or
+// nil page so the list route never serializes null.
+func NamespacesFromModel(m []models.Namespace) []Namespace {
+	namespaces := make([]Namespace, 0, len(m))
+
+	for _, namespace := range m {
+		namespaces = append(namespaces, *NamespaceFromModel(&namespace))
+	}
+
+	return namespaces
+}

pkg/api/responses/namespace_test.go

@@ -0,0 +1,218 @@
+package responses_test
+
+import (
+	"encoding/json"
+	"testing"
+	"time"
+
+	"github.com/shellhub-io/shellhub/pkg/api/authorizer"
+	"github.com/shellhub-io/shellhub/pkg/api/responses"
+	"github.com/shellhub-io/shellhub/pkg/models"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+func TestNamespaceFromModel(t *testing.T) {
+	cases := []struct {
+		description string
+		namespace   *models.Namespace
+		expected    []responses.Member
+	}{
+		{
+			description: "drops the service account",
+			namespace: &models.Namespace{
+				Members: []models.Member{
+					{ID: "human", Email: "human@test.com", Role: authorizer.RoleOwner},
+					{ID: "bot", Email: "bot@test.com", Role: authorizer.RoleService, Type: models.UserTypeService},
+				},
+			},
+			expected: []responses.Member{
+				{ID: "human", Email: "human@test.com", Role: authorizer.RoleOwner},
+			},
+		},
+		{
+			description: "drops a service account that does not carry the service role",
+			namespace: &models.Namespace{
+				Members: []models.Member{
+					{ID: "human", Email: "human@test.com", Role: authorizer.RoleOwner, Type: models.UserTypeHuman},
+					{ID: "bot", Email: "bot@test.com", Role: authorizer.RoleObserver, Type: models.UserTypeService},
+				},
+			},
+			expected: []responses.Member{
+				{ID: "human", Email: "human@test.com", Role: authorizer.RoleOwner},
+			},
+		},
+		{
+			description: "keeps a member whose type is empty",
+			namespace: &models.Namespace{
+				Members: []models.Member{
+					{ID: "legacy", Email: "legacy@test.com", Role: authorizer.RoleObserver},
+				},
+			},
+			expected: []responses.Member{
+				{ID: "legacy", Email: "legacy@test.com", Role: authorizer.RoleObserver},
+			},
+		},
+		{
+			description: "keeps a member whose type is human",
+			namespace: &models.Namespace{
+				Members: []models.Member{
+					{ID: "human", Email: "human@test.com", Role: authorizer.RoleOperator, Type: models.UserTypeHuman},
+				},
+			},
+			expected: []responses.Member{
+				{ID: "human", Email: "human@test.com", Role: authorizer.RoleOperator},
+			},
+		},
+		{
+			description: "projects an empty list when every member is a service account",
+			namespace: &models.Namespace{
+				Members: []models.Member{
+					{ID: "bot", Email: "bot@test.com", Role: authorizer.RoleService, Type: models.UserTypeService},
+				},
+			},
+			expected: []responses.Member{},
+		},
+		{
+			description: "projects an empty list when the namespace has no members",
+			namespace:   &models.Namespace{},
+			expected:    []responses.Member{},
+		},
+	}
+
+	for _, tc := range cases {
+		t.Run(tc.description, func(t *testing.T) {
+			res := responses.NamespaceFromModel(tc.namespace)
+
+			require.NotNil(t, res)
+			assert.Equal(t, tc.expected, res.Members)
+		})
+	}
+}
+
+func TestNamespaceFromModelNil(t *testing.T) {
+	assert.Nil(t, responses.NamespaceFromModel(nil))
+}
+
+func TestNamespaceFromModelNeverMarshalsMembersAsNull(t *testing.T) {
+	data, err := json.Marshal(responses.NamespaceFromModel(&models.Namespace{}))
+	require.NoError(t, err)
+
+	decoded := map[string]json.RawMessage{}
+	require.NoError(t, json.Unmarshal(data, &decoded))
+
+	assert.JSONEq(t, "[]", string(decoded["members"]))
+}
+
+func TestNamespaceFromModelDoesNotMutateSource(t *testing.T) {
+	namespace := &models.Namespace{
+		Members: []models.Member{
+			{ID: "human", Email: "human@test.com", Role: authorizer.RoleOwner},
+			{ID: "bot", Email: "bot@test.com", Role: authorizer.RoleService, Type: models.UserTypeService},
+		},
+	}
+
+	responses.NamespaceFromModel(namespace)
+
+	assert.Equal(
+		t,
+		[]models.Member{
+			{ID: "human", Email: "human@test.com", Role: authorizer.RoleOwner},
+			{ID: "bot", Email: "bot@test.com", Role: authorizer.RoleService, Type: models.UserTypeService},
+		},
+		namespace.Members,
+	)
+}
+
+func TestNamespaceFromModelProjectsEveryField(t *testing.T) {
+	createdAt := time.Date(2026, 9, 16, 12, 0, 0, 0, time.UTC)
+	settings := &models.NamespaceSettings{SessionRecord: true, SSHAccessMode: "identity"}
+	billing := &models.Billing{CustomerID: "cus_test"}
+
+	res := responses.NamespaceFromModel(&models.Namespace{
+		Name:                 "namespace",
+		Owner:                "000000000000000000000000",
+		TenantID:             "00000000-0000-4000-0000-000000000000",
+		Members:              []models.Member{{ID: "human", Email: "human@test.com", Role: authorizer.RoleOwner}},
+		Settings:             settings,
+		MaxDevices:           10,
+		CreatedAt:            createdAt,
+		Billing:              billing,
+		Type:                 models.TypeTeam,
+		DevicesAcceptedCount: 1,
+		DevicesPendingCount:  2,
+		DevicesRejectedCount: 3,
+		DevicesRemovedCount:  4,
+	})
+
+	assert.Equal(
+		t,
+		&responses.Namespace{
+			Name:                 "namespace",
+			Owner:                "000000000000000000000000",
+			TenantID:             "00000000-0000-4000-0000-000000000000",
+			Members:              []responses.Member{{ID: "human", Email: "human@test.com", Role: authorizer.RoleOwner}},
+			Settings:             settings,
+			MaxDevices:           10,
+			CreatedAt:            createdAt,
+			Billing:              billing,
+			Type:                 models.TypeTeam,
+			DevicesAcceptedCount: 1,
+			DevicesPendingCount:  2,
+			DevicesRejectedCount: 3,
+			DevicesRemovedCount:  4,
+		},
+		res,
+	)
+}
+
+func TestNamespacesFromModel(t *testing.T) {
+	cases := []struct {
+		description string
+		namespaces  []models.Namespace
+		expected    []responses.Namespace
+	}{
+		{
+			description: "projects an empty list when there are no namespaces",
+			namespaces:  []models.Namespace{},
+			expected:    []responses.Namespace{},
+		},
+		{
+			description: "projects an empty list when the source is nil",
+			namespaces:  nil,
+			expected:    []responses.Namespace{},
+		},
+		{
+			description: "drops the service account from each namespace",
+			namespaces: []models.Namespace{
+				{
+					Name: "first",
+					Members: []models.Member{
+						{ID: "human", Email: "human@test.com", Role: authorizer.RoleOwner},
+						{ID: "bot", Email: "bot@test.com", Role: authorizer.RoleService, Type: models.UserTypeService},
+					},
+				},
+				{
+					Name:    "second",
+					Members: []models.Member{{ID: "bot", Email: "bot@test.com", Role: authorizer.RoleService, Type: models.UserTypeService}},
+				},
+			},
+			expected: []responses.Namespace{
+				{
+					Name:    "first",
+					Members: []responses.Member{{ID: "human", Email: "human@test.com", Role: authorizer.RoleOwner}},
+				},
+				{
+					Name:    "second",
+					Members: []responses.Member{},
+				},
+			},
+		},
+	}
+
+	for _, tc := range cases {
+		t.Run(tc.description, func(t *testing.T) {
+			assert.Equal(t, tc.expected, responses.NamespacesFromModel(tc.namespaces))
+		})
+	}
+}

server/api/routes/nsadm.go

@@ -6,6 +6,7 @@ import (
 
 	"github.com/shellhub-io/shellhub/pkg/api/query"
 	"github.com/shellhub-io/shellhub/pkg/api/requests"
+	"github.com/shellhub-io/shellhub/pkg/api/responses"
 	"github.com/shellhub-io/shellhub/server/api/pkg/gateway"
 	"github.com/shellhub-io/shellhub/server/api/services"
 	log "github.com/sirupsen/logrus"
@@ -64,7 +65,7 @@ func (h *Handler) GetNamespaceList(c *gateway.Context) error {
 
 	c.Response().Header().Set("X-Total-Count", strconv.Itoa(count))
 
-	return c.JSON(http.StatusOK, namespaces)
+	return c.JSON(http.StatusOK, responses.NamespacesFromModel(namespaces))
 }
 
 // CreateNamespace creates a namespace owned by the caller.
@@ -84,7 +85,7 @@ func (h *Handler) CreateNamespace(c *gateway.Context) error {
 		return err
 	}
 
-	return c.JSON(http.StatusOK, namespace)
+	return c.JSON(http.StatusOK, responses.NamespaceFromModel(namespace))
 }
 
 // GetNamespace serves one namespace by tenant ID.
@@ -114,7 +115,7 @@ func (h *Handler) GetNamespace(c *gateway.Context) error {
 		}
 	}
 
-	return c.JSON(http.StatusOK, ns)
+	return c.JSON(http.StatusOK, responses.NamespaceFromModel(ns))
 }
 
 // ListNamespaceMembers serves who belongs to a namespace and in what role.
@@ -176,7 +177,7 @@ func (h *Handler) EditNamespace(c *gateway.Context) error {
 		return err
 	}
 
-	return c.JSON(http.StatusOK, res)
+	return c.JSON(http.StatusOK, responses.NamespaceFromModel(res))
 }
 
 // AddNamespaceMember invites or adds a member in the requested role.
@@ -196,7 +197,7 @@ func (h *Handler) AddNamespaceMember(c *gateway.Context) error {
 		return err
 	}
 
-	return c.JSON(http.StatusOK, res)
+	return c.JSON(http.StatusOK, responses.NamespaceFromModel(res))
 }
 
 // RemoveNamespaceMember removes another member from the namespace.
@@ -216,7 +217,7 @@ func (h *Handler) RemoveNamespaceMember(c *gateway.Context) error {
 		return err
 	}
 
-	return c.JSON(http.StatusOK, res)
+	return c.JSON(http.StatusOK, responses.NamespaceFromModel(res))
 }
 
 // LeaveNamespace removes the caller from the namespace. It is separate from removing a member