Phase 1: Critical security fixes - 59 permissions, grants, RLS, mass-assignment, ownership, leaks, MIME

app/routes/system_settings.py

@@ -20,11 +20,24 @@ async def get_system_settings(
     db: AsyncSession = Depends(get_db),
     current_user: dict = Depends(require_permission("settings:read")),
 ):
-    """Get system settings for the current tenant."""
+    """Get system settings for the current tenant.
+
+    Sensitive fields (tax_number, iban, bic) are masked for non-admin users.
+    """
     tenant_id = uuid.UUID(current_user["tenant_id"])
     result = await system_settings_service.get_system_settings(db, tenant_id)
     if result is None:
         return SystemSettingsResponse()
+
+    # Mask sensitive fields for non-admin users
+    if not current_user.get("is_system_admin"):
+        if hasattr(result, "tax_number") and result.tax_number:
+            result.tax_number = "********"
+        if hasattr(result, "iban") and result.iban:
+            result.iban = "********"
+        if hasattr(result, "bic") and result.bic:
+            result.bic = "********"
+
     return result