From 8b4cdd5886b9d51c8c1a6323c0c2cd6a68f2e173 Mon Sep 17 00:00:00 2001
From: Adrian Obelmejias <obeladrian@gmail.com>
Date: Thu, 11 Feb 2016 19:01:08 -0500
Subject: [PATCH] Remove password and salt from response

---
 src/controllers/users.js | 12 ++++++++----
 1 file changed, 8 insertions(+), 4 deletions(-)

diff --git a/src/controllers/users.js b/src/controllers/users.js
index d50dc1c..c06c320 100644
--- a/src/controllers/users.js
+++ b/src/controllers/users.js
@@ -1,5 +1,6 @@
 import Router from 'koa-router'
 import User from '../models/users'
+import config from '../../config/config'
 import jwt from 'jsonwebtoken'
 
 const router = new Router({ prefix: '/users' })
@@ -7,7 +8,7 @@ const router = new Router({ prefix: '/users' })
 router.get('/',
   async (ctx) => {
     try {
-      const users = User.find({}, '-password')
+      const users = User.find({}, '-password -salt')
       ctx.body = users
     } catch(err) {
       this.throw(err, 500)
@@ -18,7 +19,7 @@ router.get('/',
 router.get('/:id',
   async (ctx) => {
     try {
-      const user = await User.findById(ctx.params.id, '-password')
+      const user = await User.findById(ctx.params.id, '-password -salt')
       if(!user) {
         this.throw(404)
       }
@@ -36,10 +37,13 @@ router.post('/',
       await user.save()
       const token = jwt.sign({ id: user.id }, config.token)
 
-      delete user.password
+      const response = user.toJSON()
+
+      delete response.password
+      delete response.salt
 
       ctx.body = {
-        user,
+        user: response,
         token
       }
     } catch(err) {