I have defined a schema like

var UserSchema = new Schema({
  firstName: { type: String, required: true },
  lastName: { type: String, required: true },
  email: { type: String, required: true },
  location: { type: String, required: true },
  picture: { type: String, required: true },
  passwordHash: { type: String, required: true },
  resetPasswordToken: String,
  resetPasswordExpired: Boolean
});

I have a REST Endpoint which return list of all users. In that list I want to hide some properties i.e, passwordHash, resetPasswordToken, resetPasswordExpired

I defined a custom filter function like below

var doFilterUser = function(user) {
  _.omit(user, ['passwordHash', 'resetPasswordToken', 'resetPasswordExpired']);
   user.id = user._id;
   delete user._id;
   delete user.__v;
   return user;
};

_ is lodash

When I check my API is responding with all user properties

This filter function is defined in mon helper module and I am calling it like

User.findOne({_id: id}, function(err, user) {
  var filtered = helper.doFilterUser(user);
});

How to resolve this issue?

I have defined a schema like

var UserSchema = new Schema({
  firstName: { type: String, required: true },
  lastName: { type: String, required: true },
  email: { type: String, required: true },
  location: { type: String, required: true },
  picture: { type: String, required: true },
  passwordHash: { type: String, required: true },
  resetPasswordToken: String,
  resetPasswordExpired: Boolean
});

I have a REST Endpoint which return list of all users. In that list I want to hide some properties i.e, passwordHash, resetPasswordToken, resetPasswordExpired

I defined a custom filter function like below

var doFilterUser = function(user) {
  _.omit(user, ['passwordHash', 'resetPasswordToken', 'resetPasswordExpired']);
   user.id = user._id;
   delete user._id;
   delete user.__v;
   return user;
};

_ is lodash

When I check my API is responding with all user properties

This filter function is defined in mon helper module and I am calling it like

User.findOne({_id: id}, function(err, user) {
  var filtered = helper.doFilterUser(user);
});

How to resolve this issue?

• javascript
• node.js
• mongodb
• mongoose
• mongodb-query

3 Answers 3

Try this: You are allowed to access certain values through mongoose.

User.findOne({_id: id}, 'firstName lastName email location picture', function(err, user){
  console.log(user);

});

You just mention the fields needed, after the query.

Hope it helps....

The problem here is that you still have a mongoose document that conforms to s strict schema. If you want to change that document, then you need to make it a "raw" object without all the additional controls:

User.findOne({_id: id}, function(err, user) {
  var filtered = helper.doFilterUser(user.toObject());
});

So the .toObject() method here will return an object in it's raw form. That allows you to manipulate the keys how you wish.

You can also explicitly direct it not to serve back certain properties. Useful if you don't want to render a hashed password over the wire. The find method would look like this:

User.find({}, '-id -__v',function(err,users){
})

or

User.findOne({_id: id}, '-id -__v',function(err,user){
})