Add hidden property support to models

lib/models/model.js

@@ -200,6 +200,22 @@ Model._getAccessTypeForMethod = function(method) {
   }
 }
 
+var superToJSON = Model.prototype.toJSON;
+Model.prototype.toJSON = function toJSON() {
+  var Model = this.constructor;
+  var obj = superToJSON.apply(this, arguments);
+  var settings = Model.definition && Model.definition.settings;
+  var hiddenProperties = settings && settings.hidden;
+
+  if(Array.isArray(hiddenProperties)) {
+    for(var i = 0; i < hiddenProperties.length; i++) {
+      delete obj[hiddenProperties[i]];
+    }
+  }
+
+  return obj;
+}
+
 // setup the initial model
 Model.setup();
 

lib/models/user.js

@@ -49,6 +49,7 @@ var properties = {
 };
 
 var options = {
+  hidden: ['password'],
   acls: [
     {
       principalType: ACL.ROLE,

test/access-control.integration.js

@@ -55,6 +55,7 @@ describe('access control - integration', function () {
       return '/api/accessTokens/' + this.randomToken.id;
     }
   });
+  */
 
   describe('/users', function () {
 
@@ -94,6 +95,10 @@ describe('access control - integration', function () {
       });
       lt.describe.whenCalledRemotely('GET', '/api/users/:id', function() {
         lt.it.shouldBeAllowed();
+        it('should not include a password', function() {
+          var user = this.res.body;
+          assert.equal(user.password, undefined);
+        });
       });
       lt.describe.whenCalledRemotely('PUT', '/api/users/:id', function() {
         lt.it.shouldBeAllowed();
@@ -136,7 +141,6 @@ describe('access control - integration', function () {
       return '/api/banks/' + this.bank.id;
     }
   });
-  */
 
   describe('/accounts', function () {
     lt.beforeEach.givenModel('account');

test/hidden-properties.test.js

@@ -4,15 +4,27 @@ describe('hidden properties', function () {
   beforeEach(function (done) {
     var app = this.app = loopback();
     var Product = this.Product = app.model('product', {
-      properties: {
-        secret: {}
-      },
+      options: {hidden: ['secret']},
       dataSource: loopback.memory()
     });
-    app.listen(done);
+    app.use(loopback.rest());
+
+    Product.create(
+      {name: 'pencil', secret: 'secret'},
+      done
+    );
   });
 
-  it('should hide a property remotely', function () {
-    
+  it('should hide a property remotely', function (done) {
+     request(this.app)
+        .get('/products')
+        .expect('Content-Type', /json/)
+        .expect(200)
+        .end(function(err, res){
+          if(err) return done(err);
+          var product = res.body[0];
+          assert.equal(product.secret, undefined);
+          done();
+        });
   });
 });