Change 849656 had a related patch set uploaded (by Daimona Eaytoy; author: Daimona Eaytoy):

[mediawiki/extensions/CampaignEvents@master] [WIP] Implement perm check to determine if user can see private participants

https://gerrit.wikimedia.org/r/849656

(The patch is WIP due to the question in the task description)

TBD: What if the organizer was blocked?

@ifried Do we have an answer on this? If not, can we just disallow blocked organizers for now?

Change 849656 merged by jenkins-bot:

[mediawiki/extensions/CampaignEvents@master] Implement perm check to determine if user can see private participants

https://gerrit.wikimedia.org/r/849656

This can be tested indirectly together with T321625.

✅ Only the organizer of an event should be able to see privately registered participants

See test notes at T321625#8368773 which went through this (it is working as expected)

✅ If the organizer is blocked, they should not be able to see private registrations

Organizer blocked after creating event and cannot see private participants:

@Daimona when the organizer is blocked after creating an event, they can still see publicly registered participants with ?include_private=false (just like any non-organizer would be able to see, or when logged out and viewing the event). I believe this is the correct behavior, but checking to make sure?

In T321723#8371373, @vaughnwalters wrote:

@Daimona when the organizer is blocked after creating an event, they can still see publicly registered participants with ?include_private=false (just like any non-organizer would be able to see, or when logged out and viewing the event). I believe this is the correct behavior, but checking to make sure?

Yes, because as you mentioned, that information is publicly available.