adds support for protected properties.

lib/list.js

@@ -72,11 +72,11 @@ List.prototype.push = function (obj) {
   return item;
 };
 
-List.prototype.toObject = function (onlySchema, removeHidden) {
+List.prototype.toObject = function (onlySchema, removeHidden, removeProtected) {
   var items = [];
   this.forEach(function (item) {
     if (item && typeof item === 'object' && item.toObject) {
-      items.push(item.toObject(onlySchema, removeHidden));
+      items.push(item.toObject(onlySchema, removeHidden, removeProtected));
     } else {
       items.push(item);
     }

lib/model.js

@@ -302,7 +302,7 @@ ModelBaseClass.toString = function () {
  *
  * @param {Boolean} onlySchema Restrict properties to dataSource only.  Default is false.  If true, the function returns only properties defined in the schema;  Otherwise it returns all enumerable properties.
  */
-ModelBaseClass.prototype.toObject = function (onlySchema, removeHidden) {
+ModelBaseClass.prototype.toObject = function (onlySchema, removeHidden, removeProtected) {
   if (onlySchema === undefined) {
     onlySchema = true;
   }
@@ -334,11 +334,15 @@ ModelBaseClass.prototype.toObject = function (onlySchema, removeHidden) {
       continue;
     }
 
+    if (removeProtected && Model.isProtectedProperty(propertyName)) {
+      continue;
+    }
+
     if (val instanceof List) {
-      data[propertyName] = val.toObject(!schemaLess, removeHidden);
+      data[propertyName] = val.toObject(!schemaLess, removeHidden, true);
     } else {
       if (val !== undefined && val !== null && val.toObject) {
-        data[propertyName] = val.toObject(!schemaLess, removeHidden);
+        data[propertyName] = val.toObject(!schemaLess, removeHidden, true);
       } else {
         data[propertyName] = val;
       }
@@ -362,13 +366,16 @@ ModelBaseClass.prototype.toObject = function (onlySchema, removeHidden) {
       if (removeHidden && Model.isHiddenProperty(propertyName)) {
         continue;
       }
+      if (removeProtected && Model.isProtectedProperty(propertyName)) {
+        continue;
+      }
       val = self[propertyName];
       if (val !== undefined && data[propertyName] === undefined) {
         if (typeof val === 'function') {
           continue;
         }
         if (val !== null && val.toObject) {
-          data[propertyName] = val.toObject(!schemaLess, removeHidden);
+          data[propertyName] = val.toObject(!schemaLess, removeHidden, true);
         } else {
           data[propertyName] = val;
         }
@@ -386,16 +393,18 @@ ModelBaseClass.prototype.toObject = function (onlySchema, removeHidden) {
         if (removeHidden && Model.isHiddenProperty(propertyName)) {
           continue;
         }
+        if (removeHidden && Model.isProtectedProperty(propertyName)) {
+          continue;
+        }
         var ownVal = self[propertyName];
         // The ownVal can be a relation function
-        val = (ownVal !== undefined && (typeof ownVal !== 'function'))
+        val = (ownVal !== undefined && (typeof ownVal !== 'function')) ? ownVal : self.__data[propertyName];
-          ? ownVal : self.__data[propertyName];
         if (typeof val === 'function') {
           continue;
         }
 
         if (val !== undefined && val !== null && val.toObject) {
-          data[propertyName] = val.toObject(!schemaLess, removeHidden);
+          data[propertyName] = val.toObject(!schemaLess, removeHidden, true);
         } else {
           data[propertyName] = val;
         }
@@ -406,6 +415,25 @@ ModelBaseClass.prototype.toObject = function (onlySchema, removeHidden) {
   return data;
 };
 
+ModelBaseClass.isProtectedProperty = function (propertyName) {
+  var model = this;
+  var settings = Model.definition && Model.definition.settings;
+  var protectedProperties = settings & (settings.protectedProperties || settings.protected);
+
+  if (Array.isArray(protectedProperties)) {
+    settings.protectedProperties = {};
+    for (var i = 0; i < protectedProperties.length; i++) {
+      settings.protectedProperties[protectedProperties[i]] = true;
+    }
+    protectedProperties = settings.protectedProperties;
+  }
+  if (protectedProperties) {
+    return protectedProperties[propertyName];
+  } else {
+    return false;
+  }
+};
+
 ModelBaseClass.isHiddenProperty = function (propertyName) {
   var Model = this;
   var settings = Model.definition && Model.definition.settings;
@@ -423,10 +451,10 @@ ModelBaseClass.isHiddenProperty = function (propertyName) {
   } else {
     return false;
   }
-}
+};
 
 ModelBaseClass.prototype.toJSON = function () {
-  return this.toObject(false, true);
+  return this.toObject(false, true, false);
 };
 
 ModelBaseClass.prototype.fromObject = function (obj) {

test/model-definition.test.js

@@ -270,6 +270,45 @@ describe('ModelDefinition class', function () {
     assert(grandChild.prototype instanceof child);
   });
 
+  it('should serialize protected properties into JSON', function() {
+    var memory = new DataSoruce({connector: Memory});
+    var modelBuilder = memory.modelBuilder;
+    var ProtectedModel = memory.createModel('protected', {}, {
+      protected: ['protectedProperty']
+    });
+    var pm = new ProtectedModel({
+      id: 1, foo: 'bar', protectedProperty: 'protected'
+    });
+    var serialized = pm.toJSON();
+    assert.deepEqual(serialized, {
+      id: 1, foo: 'bar', protectedProperty: 'protected'
+    });
+  });
+
+  it('should not serialized protected properties of nested models into JSON', function(done){
+    var memory = new DataSource({connector: Memory});
+    var modelBuilder = memory.modelBuilder;
+    var Parent = memory.createModel('parent');
+    var Child = memory.createModel('child', {}, {protected: ['protectedProperty']});
+    Parent.hasMany(Child);
+    Parent.create({
+      name: 'parent'
+    }, function(err, parent) {
+      parent.children.create({
+        name: 'child',
+        protectedProperty: 'protectedValue'
+      }, function(err, child) {
+        Parent.find({include: 'children'}, function(err, parents) {
+          var serialized = parents[0].toJSON();
+          var child = serialized.children[0];
+          assert.equal(child.name, 'child');
+          assert.notEqual(child.protectedProperty, 'protectedValue');
+          done();
+        });
+      });
+    });
+  });
+
   it('should not serialize hidden properties into JSON', function () {
     var memory = new DataSource({connector: Memory});
     var modelBuilder = memory.modelBuilder;