You should make sure people can't go assigning the uid "0" or "false" (any case) to their tickets :)

Does this not return the ticket's uid if there is any?

There is always one, but indeed it is never exposed by the API

I think we should send a 404 in case of private tickets. With a 403, we are showing information about its existence.

We do the same in the UI

Hmmm, this does leak data (the fact that a private ticket got a comment).

Then maybe that needs fixing as well?

Why is it not exposed, if I can even use it from the API?

This was a confusion. I thought the "uid" was user-assigned.

I think this still leaks quite a bit of information: every field that gets edited.

Yes, and the problem is? :)

But not what changed, we use the same approach in FAS for fedmsg.

Even though we leak the fact there is a private issue, it looks good to me. :thumbsup:

Because it's not really meant for people to use the uid with the API, but the application itself has access to this information.

So we support both values (id and uid) according to which you have access to

Thanks for the review