fix: scope user access token serialization

app/views/api/v1/models/_user.json.jbuilder

@@ -1,8 +1,10 @@
-# Withhold the full-scope token from callers who authenticated with a
-# read-only token — otherwise GET /api/v1/profile would let a read-only
-# holder lift the full token and bypass the scope gate entirely.
-json.access_token resource.access_token&.token unless @access_token&.scope == 'read_only'
-json.read_only_access_token resource.read_only_access_token&.token
+if local_assigns[:include_access_tokens]
+  # Withhold the full-scope token from callers who authenticated with a
+  # read-only token — otherwise GET /api/v1/profile would let a read-only
+  # holder lift the full token and bypass the scope gate entirely.
+  json.access_token resource.access_token&.token unless @access_token&.scope == 'read_only'
+  json.read_only_access_token resource.read_only_access_token&.token
+end
 json.account_id resource.active_account_user&.account_id
 json.available_name resource.available_name
 json.avatar_url resource.avatar_url

app/views/api/v1/profiles/auto_offline.jbuilder

@@ -1 +1 @@
-json.partial! 'api/v1/models/user', formats: [:json], resource: @user
+json.partial! 'api/v1/models/user', formats: [:json], resource: @user, include_access_tokens: true

app/views/api/v1/profiles/availability.jbuilder

@@ -1 +1 @@
-json.partial! 'api/v1/models/user', formats: [:json], resource: @user
+json.partial! 'api/v1/models/user', formats: [:json], resource: @user, include_access_tokens: true

app/views/api/v1/profiles/avatar.json.jbuilder

@@ -1 +1 @@
-json.partial! 'api/v1/models/user', formats: [:json], resource: @user
+json.partial! 'api/v1/models/user', formats: [:json], resource: @user, include_access_tokens: true

app/views/api/v1/profiles/reset_access_token.json.jbuilder

@@ -1 +1 @@
-json.partial! 'api/v1/models/user', formats: [:json], resource: @user
+json.partial! 'api/v1/models/user', formats: [:json], resource: @user, include_access_tokens: true

app/views/api/v1/profiles/reset_read_only_access_token.json.jbuilder

@@ -1 +1 @@
-json.partial! 'api/v1/models/user', formats: [:json], resource: @user
+json.partial! 'api/v1/models/user', formats: [:json], resource: @user, include_access_tokens: true

app/views/api/v1/profiles/show.json.jbuilder

@@ -1 +1 @@
-json.partial! 'api/v1/models/user', formats: [:json], resource: @user
+json.partial! 'api/v1/models/user', formats: [:json], resource: @user, include_access_tokens: true

app/views/api/v1/profiles/update.json.jbuilder

@@ -1 +1 @@
-json.partial! 'api/v1/models/user', formats: [:json], resource: @user
+json.partial! 'api/v1/models/user', formats: [:json], resource: @user, include_access_tokens: true

app/views/devise/_auth.json.jbuilder

@@ -1,3 +1,3 @@
 json.data do
-  json.partial! 'api/v1/models/user', formats: [:json], resource: resource
+  json.partial! 'api/v1/models/user', formats: [:json], resource: resource, include_access_tokens: true
 end

spec/enterprise/controllers/api/v1/accounts/agent_capacity_policies/users_controller_spec.rb

@@ -18,6 +18,10 @@ RSpec.describe 'Agent Capacity Policy Users API', type: :request do
 
         expect(response).to have_http_status(:success)
         expect(response.parsed_body.first['id']).to eq(user.id)
+        expect(response.parsed_body.first).not_to have_key('access_token')
+        expect(response.parsed_body.first).not_to have_key('read_only_access_token')
+        expect(response.body).not_to include(user.access_token.token)
+        expect(response.body).not_to include(user.read_only_access_token.token)
       end
 
       it 'returns each user only once without duplicates' do
@@ -63,6 +67,10 @@ RSpec.describe 'Agent Capacity Policy Users API', type: :request do
 
         expect(response).to have_http_status(:success)
         expect(user.account_users.first.reload.agent_capacity_policy).to eq(agent_capacity_policy)
+        expect(response.parsed_body).not_to have_key('access_token')
+        expect(response.parsed_body).not_to have_key('read_only_access_token')
+        expect(response.body).not_to include(user.access_token.token)
+        expect(response.body).not_to include(user.read_only_access_token.token)
       end
     end
   end