feat(api): do not return sensitive donation information

api/desecapi/serializers.py

@@ -615,6 +615,11 @@ class DonationSerializer(serializers.ModelSerializer):
         model = models.Donation
         fields = ('name', 'iban', 'bic', 'amount', 'message', 'email', 'mref', 'interval')
         read_only_fields = ('mref',)
+        extra_kwargs = {  # do not return sensitive information
+            'iban': {'write_only': True},
+            'bic': {'write_only': True},
+            'message': {'write_only': True},
+        }
 
 
     @staticmethod

api/desecapi/tests/test_donations.py

@@ -25,8 +25,8 @@ class DonationTests(DesecTestCase):
         direct_debit = str(mail.outbox[0].attachments[0][1])
         reply_to = mail.outbox[0].reply_to
         self.assertStatus(response, status.HTTP_201_CREATED)
+        self.assertEqual(response.data.keys(), {'name', 'amount', 'email', 'mref', 'interval'})
         self.assertEqual(len(mail.outbox), 1)
-        self.assertEqual(response.data['iban'], data['iban'])
         self.assertEqual(response.data['interval'], 0)
         self.assertIn('ONDON1', response.data['mref'])
         self.assertTrue('Name' in direct_debit)
@@ -50,8 +50,8 @@ class DonationTests(DesecTestCase):
         direct_debit = str(mail.outbox[0].attachments[0][1])
         reply_to = mail.outbox[0].reply_to
         self.assertStatus(response, status.HTTP_201_CREATED)
+        self.assertEqual(response.data.keys(), {'name', 'amount', 'email', 'mref', 'interval'})
         self.assertEqual(len(mail.outbox), 2)
-        self.assertEqual(response.data['iban'], data['iban'])
         self.assertEqual(response.data['interval'], 3)
         self.assertIn('ONDON1', response.data['mref'])
         self.assertTrue('Komplizierter Vornamu' in direct_debit)

test/e2e2/spec/test_donation.py

@@ -6,13 +6,10 @@ from pytest_schema import schema, Optional
 
 donation = {
     'name': str,
-    'iban': str,
-    'bic': str,
     'amount': str,
+    'email': str,
     'mref': str,
     'interval': int,
-    'message': str,
-    'email': str,
 }