feat: filter out API details from user object

[wanlingt]

Problem

The full user object, which includes the apiToken property, is returned in multiple queries.

Closes FRM-1011

Solution

Add select to the apiToken property in the user model to filter out apiToken from any query that returns the full user object
(from docs: select: {Boolean} - Specifies default path selection behavior. In other words, you can specify if this path should be included or excluded from query results by default.)

Breaking Changes

• No - this PR is backwards compatible

Tests

• Update a user with the apiToken property ({keyHash: .., createdAt:.., lastUsedAt:.. }). Check that none of the following queries returns the apiToken property with the user object:
  • GET /api/v3/admin/forms - visit admin form dashboard page
  • POST /api/v3/auth/otp/verify - log out and log in again
  • GET /api/v3/user - visit admin form dashboard page
  • POST /user/contact/otp/verify - verify contact OTP

[tshuli]

thanks @wanlingt! as an alternative to updating each query to de-select apiToken, would you like to consider setting select:false at the schema level? This should ensure that apiToken is not returned by default in all queries (in case someone forgets to deselect next time)😅

see https://mongoosejs.com/docs/2.7.x/docs/schematypes.html

select: {Boolean} - Specifies default path selection behavior. In other words, you can specify if this path should be included or excluded from query results by default.

[wanlingt]

thanks @wanlingt! as an alternative to updating each query to de-select apiToken, would you like to consider setting select:false at the schema level? This should ensure that apiToken is not returned by default in all queries (in case someone forgets to deselect next time)😅

see https://mongoosejs.com/docs/2.7.x/docs/schematypes.html

select: {Boolean} - Specifies default path selection behavior. In other words, you can specify if this path should be included or excluded from query results by default.

that is awesome, thanks for the suggestion @tshuli ! I've added it to the user model in f2b8dc2

[tshuli]

lgtm! maybe just add one unit test to check that the select:false property is working property

[wanlingt]

lgtm! maybe just add one unit test to check that the select:false property is working property

done! c773b37