Two signature types, split by who is asking
- Decision
- The public query returns a signature type with no email field. The type that carries the address appears only behind a valid session.
- Why
- Returning addresses on a publicly readable query would turn the card into a mailing list for anyone with devtools.
- Trade-off
- Two GraphQL types and mappers for what is one database row.
- Outcome
- Leaking an address would need a schema change, not just a forgotten filter.
