Crud: How to hide some fields like password?

[indian-boy]

How to return a custom model? For example, hide password or whatever i want and return response?

@Crud({
  model: {
    type: User,
  },
  routes: {
    getManyBase: {
      decorators: [
        UseGuards(AuthGuard()),
      ],
    },
  },
})
@Controller('users')

When i call the endpoint like GET /users it returns me something like this:

[
    {
        "id": 1,
        "email": "[email protected]",
        "password": "43587y34t9078eryht457089649",
        "isActive": true,
        "isEmailConfirmed": true,
        "createdAt": "2019-07-16T03:05:50.020Z",
        "updatedAt": "2019-07-19T21:11:16.032Z",
        "lastSession": "2019-07-19T21:11:16.007Z",
        "resetPasswordExpire": null,
        "resetPasswordToken": null
    }
]

[zMotivat0r]

You can use exclude in the CrudOptions

[eranshmil]

@zMotivat0r Hi, thanks for your hard work.
The exclude option isn't supposed to exclude also from the response of the create/update requests?

[zMotivat0r]

@eranshmil it's been fixed but not released yet. Will be included in the upcoming release soon

[eranshmil]

Thanks a lot!
Btw, there's a way to use some sort of dev builds, before the release?

[zMotivat0r]

@eranshmil I'm going to publish RC version today probably. Will let you know ;)

[eranshmil]

@zMotivat0r I updated to the alpha version and still I get the excluded properties in the response.

[zMotivat0r]

@eranshmil I'm pretty much sure that if you specify in the CrudOptions query.exclude with some array of entity's fields, then you won't get that field in the create/update/replace response.
So, if I add exclude: ['domain'] here https://github.com/nestjsx/crud/blob/883cef9fe7e8786002a30cbed0438ed967754ef7/integration/crud-typeorm/companies/companies.controller.ts#L12-L17 it works as it should.
If you still have issues with that, I would ask you to create a repo with the minimum reproduction of your bug. Thanks!

[Quaiks]

Hello!!

If I add a field to query.exclude for example, password, I do not get the field when a do a GET request but when a create a new entity the field is returned.

[indian-boy]

Any solution/workaround on this? @Quaiks can you show us your package.json ?

[zMotivat0r]

fixed with 4.3.0:

• exclude works wor every route
• also serialization has been added

[cleivson]

• exclude works wor every route

@zMotivat0r , I don't know if it's by design, but when we set returnDeleted: true, the field in excluded field is still returned.

Example:

@Crud({
  model: {
    type: User,
  },
  routes: {
    deleteOneBase: {
      returnDeleted: true,
    }, // TODO add test to check whether or not the user is being returned
  },
  query: {
    exclude: [
      propertyOf<User>('passwordHash'), 
      // passwordHash is still returned when deleting an user
    ],
  },
  validation: {
    transform: true,
  },
})

[zMotivat0r]

@cleivson yeah, it's by design will return a shallow entity. But you can use respose dto to exclude or transform any property

[cleivson]

@zMotivat0r

@cleivson yeah, it's by design will return a shallow entity. But you can use respose dto to exclude or transform any property

You think the exclude behavior could be extended for delete endpoint? I don't think of any cases where the users could benefit of receiving more fields in a call to delete than he would receive in a call to get

[zMotivat0r]

@cleivson it works in both sides - in get request a user can get more fields too when there are joins for example. As I said, there is a serialization enabled, so one can use response dto to exclude/transform/add properties