Make visibility opt-in by default; coerce visibility booleans; only 'vorstand' overrides

server/api/members.get.js

@@ -49,6 +49,14 @@ export default defineEventHandler(async (event) => {
       const normalizedName = fullName.toLowerCase()
 
       const memberIndex = mergedMembers.length
+      // Ensure visibility flags are booleans for manual entries
+      const vis = member.visibility || {}
+      member.visibility = {
+        showEmail: vis.showEmail === undefined ? false : Boolean(vis.showEmail),
+        showPhone: vis.showPhone === undefined ? false : Boolean(vis.showPhone),
+        showAddress: vis.showAddress === undefined ? false : Boolean(vis.showAddress)
+      }
+
       mergedMembers.push({
         ...member,
         name: fullName, // Computed for display
@@ -127,12 +135,18 @@ export default defineEventHandler(async (event) => {
         // Add as new member (from login system)
         const migratedUser = migrateUserRoles({ ...user })
         const roles = Array.isArray(migratedUser.roles) ? migratedUser.roles : (migratedUser.role ? [migratedUser.role] : ['mitglied'])
+        // Registered-only user: default to privacy-preserving visibility (hidden) unless user explicitly set visibility elsewhere
         mergedMembers.push({
           id: user.id,
           name: user.name,
           email: user.email,
           phone: user.phone || '',
           address: '',
+          visibility: {
+            showEmail: false,
+            showPhone: false,
+            showAddress: false
+          },
           notes: `Rolle(n): ${roles.join(', ')}`,
           source: 'login',
           editable: false,