[#57077] Admin only User Custom field is visible to non-admin users

https://community.openproject.org/work_packages/57077

app/models/user.rb

@@ -187,6 +187,15 @@ def mail=(arg)
     write_attribute(:mail, arg.to_s.strip)
   end
 
+  def self.available_custom_fields(_user)
+    user = User.current
+    RequestStore.fetch(:"#{name.underscore}_custom_fields_#{user.id}_#{user.admin?}") do
+      scope = CustomField.where(type: "#{name}CustomField").order(:position)
+      scope = scope.where(admin_only: false) if !user.admin?
+      scope
+    end
+  end
+
   def self.search_in_project(query, options)
     options.fetch(:project).users.like(query)
   end

spec/models/user_spec.rb

@@ -1016,4 +1016,30 @@ def build_user_double_with_expired_password(is_expired)
     let(:model_instance) { user }
     let(:custom_field) { create(:user_custom_field, :string) }
   end
+
+  describe ".available_custom_fields" do
+    let(:admin) { build_stubbed(:admin) }
+    let(:user) { build_stubbed(:user) }
+
+    shared_let(:user_cf) { create(:user_custom_field) }
+    shared_let(:admin_user_cf) { create(:user_custom_field, admin_only: true) }
+
+    context "for an admin" do
+      current_user { admin }
+
+      it "returns all fields including admin-only" do
+        expect(user.available_custom_fields)
+          .to contain_exactly(user_cf, admin_user_cf)
+      end
+    end
+
+    context "for a member" do
+      current_user { user }
+
+      it "does not return admin-only field" do
+        expect(user.available_custom_fields)
+          .to contain_exactly(user_cf)
+      end
+    end
+  end
 end