Avoid passing secret details of recipient in transfer

README.md

@@ -320,7 +320,7 @@ PAYLOAD:
     },
     "to": {
         "publicKey": "<base58 string>",
-        "privateKey": "<base58 string>"
+        "privateKey": null
     }
 }
 
@@ -334,6 +334,10 @@ RETURNS:
 }
 ```
 
+Note that the `to` field in the payload may avoid specifying the new holder's
+private details (i.e. `signingKey`), but should still provide the keys needed to
+conform to the [user model](#create-users).
+
 To check if your POST was successful, follow the steps in [registering a
 manifestation](#was-my-post-to-manifestations-successful) and use the returned
 Right's data instead.

tests/test_api.py

@@ -180,7 +180,10 @@ def test_transfer_right(client, alice, bob, carly, created_derived_right):
             'action': 'loan',
         },
         'currentHolder': alice,
-        'to': bob,
+        'to': {
+            'publicKey': bob['publicKey'],
+            'privateKey': None,
+        }
     }
 
     expected = {

web/models.py

@@ -2,6 +2,7 @@
 
 
 user_model = parse_model(['publicKey', 'privateKey'])
+public_user_model = parse_model(['publicKey'])
 manifestation_model = parse_model(['name', 'datePublished', 'url'])
 work_model = parse_model(['name', 'author'])
 right_model = parse_model(['license'])

web/utils.py

@@ -35,7 +35,7 @@ def _parse_model(inputs):
                 value = inputs[field]
             except KeyError:
                 raise KeyError('`{}` must be provided'.format(field))
-            if bool(value) is not True:
+            if not value:
                 raise ValueError("`{}`'s value must be defined".format(field))
         return inputs
     return _parse_model

web/views/rights.py

@@ -3,7 +3,7 @@
 
 from coalaip import CoalaIp, ModelDataError, entities
 from coalaip_bigchaindb.plugin import Plugin
-from web.models import right_model, user_model
+from web.models import right_model, public_user_model, user_model
 from web.utils import get_bigchaindb_api_url
 
 
@@ -49,7 +49,7 @@ def post(self):
                             location='json')
         parser.add_argument('currentHolder', type=user_model, required=True,
                             location='json')
-        parser.add_argument('to', type=user_model, required=True,
+        parser.add_argument('to', type=public_user_model, required=True,
                             location='json')
         parser.add_argument('rightsAssignment', type=dict, location='json')
         args = parser.parse_args()