mblarsen / mongoose-hidden

A Mongoose schema plugin for filtering properties you usually do not want to sent client-side like passwords and IDs.

Geek Repo:Geek Repo

Github PK Tool:Github PK Tool

Nested objects are not correctly handled

bisubus opened this issue · comments

For given schema piece

obj: {
	public: {
		type: String
	},
	private: {
		type: String,
		hide: true
	}
},

the debugger shows that one of the properties is set to hidden and another is not:

mongoose-hidden Object: copy "obj" +1ms
mongoose-hidden Object: hiding "obj" +0ms

But hidden state is set for entire obj, and it is missing from JSON output.

When { defaultHidden: { 'obj.private': true }} is used instead of hide, it doesn't affect anything:

mongoose-hidden Object: copy "local" +1ms
mongoose-hidden Object: copy "local" +0ms

I did put a note about this in the limitations section, but perhaps it can be revisited.

Related #5

(nfs: timestamps api)

Ok, I see, thanks. An unfortunate limitation indeed. I will consider a PR if I will come up with something.

I will look it over soon. There are a few suggestions that some restructoring is needed.

  1. Better handling of paths
  2. Non-schema values/objects
  3. Nested documents

It shouldn't be too difficult. The limitation wasn't meant by design, just the state of the lib :)

Regarding non-schema fields, should it possibly be handled with something like strict: true plugin option?
Considering my own use cases, I don't mind if non-schema fields leak into results, so select(...) may be an overkill, but I certainly don't want non-schema fields to appear in toObject and toJSON.

@bisubus it still doesn't work for nested Schemas, but it should work for nested objects now.

not for nested virtuals maybe?

@naxmefy yes that is right. virtuals is a feature of the schema.

@mblarsen it works on top level virtuals - i use it successfully with dynamic populations - but not in nested properties like:

schema.virtual('top')
schema.virtual('foo.bar')

schema.plugin(hidden(), {
  virtuals: {
    top: 'hideJSON', // that works
    'foo.bar': 'hideJSON', // does nothing
    foo: {
      bar: 'hideJSON' // hides foo
    }
  }
})

could handle it maybe with toJSON method - didn't try

@naxmefy should work now. (v1.1)

schema.plugin(hidden(), {
  virtuals: {

     // the correct way
    'foo.bar': 'hideJSON', 

     // incorrect way
    foo: {
      bar: 'hideJSON' 
    }

  }
})