index.js
function callback(req, res, resolve, reject, error, result, permissions,
	action) {
	if (error) {
		reqlog.error('internal server error', error);
		if (exports.handleErrors) {
			responseBuilder.error(req, res, 'INTERNAL_SERVER_ERROR');
		} else {
			reject(error);
		}
	} else {
		// filter the result attributes to send only those that this userType can see
		// check if the result is an array, to iterate it
		if (Array.isArray(result)) {
			for (var i = 0, length = result.length; i < length; i++) {
				result[i] = filterAttributes(result[i], permissions);
			}
		} else {
			result = filterAttributes(result, permissions);
		}
		reqlog.info(action + '.success', result);
		resolve(result);
	}

	/**
	 * Delete the attributes that the activeUser cant see
	 * @method filterAttributes
	 * @param  {object}         object      The result object
	 * @param  {object}         permissions The permissions object
	 * @return {object}                     The filtered object
	 */
	function filterAttributes(object, permissions) {
		if (object) {
			var userType = req.activeUser && req.activeUser.type || 'null';
			for (var attribute in object._doc) {
				if (object._doc.hasOwnProperty(attribute)) {
					// dont return this attribute when:
					if (!permissions[attribute] || // if this attribute is not defined in permissions
						permissions[attribute][0] !== 'null' && // this attribute is not set as public
						permissions[attribute].indexOf(userType) === -1 && // this attribute is not available to this userType
						userType !== 'admin' // the user is not admin
					) {
						delete object._doc[attribute];
					}
				}
			}
		}

		return object;
	}
}
function callback(req, res, resolve, reject, error, result, permissions,
	action) {
	if (error) {
		reqlog.error('internal server error', error);
		if (exports.handleErrors) {
			responseBuilder.error(req, res, 'INTERNAL_SERVER_ERROR');
		} else {
			reject(error);
		}
	} else {
		// filter the result attributes to send only those that this userType can see
		// check if the result is an array, to iterate it
		if (Array.isArray(result)) {
			for (var i = 0, length = result.length; i < length; i++) {
				result[i] = filterAttributes(result[i], permissions);
			}
		} else {
			result = filterAttributes(result, permissions);
		}
		reqlog.info(action + '.success', result);
		resolve(result);
	}

	/**
	 * Delete the attributes that the activeUser cant see
	 * @method filterAttributes
	 * @param  {object}         object      The result object
	 * @param  {object}         permissions The permissions object
	 * @return {object}                     The filtered object
	 */
	function filterAttributes(object, permissions) {
		if (object) {
			var userType = req.activeUser && req.activeUser.type || 'null';
			for (var attribute in object._doc) {
				if (object._doc.hasOwnProperty(attribute)) {
					// dont return this attribute when:
					if (!permissions[attribute] || // if this attribute is not defined in permissions
						permissions[attribute][0] !== 'null' && // this attribute is not set as public
						permissions[attribute].indexOf(userType) === -1 && // this attribute is not available to this userType
						userType !== 'admin' // the user is not admin
					) {
						delete object._doc[attribute];
					}
				}
			}
		}

		return object;
	}
}
function callback ( req , res , resolve , reject , error , result , permissions , action ) { if ( error ) { reqlog . error ( 'internal server error' , error ) ; if ( exports . handleErrors ) { responseBuilder . error ( req , res , 'INTERNAL_SERVER_ERROR' ) ; } else { reject ( error ) ; } } else { // filter the result attributes to send only those that this userType can see // check if the result is an array, to iterate it if ( Array . isArray ( result ) ) { for ( var i = 0 , length = result . length ; i < length ; i ++ ) { result [ i ] = filterAttributes ( result [ i ] , permissions ) ; } } else { result = filterAttributes ( result , permissions ) ; } reqlog . info ( action + '.success' , result ) ; resolve ( result ) ; } /**
	 * Delete the attributes that the activeUser cant see
	 * @method filterAttributes
	 * @param  {object}         object      The result object
	 * @param  {object}         permissions The permissions object
	 * @return {object}                     The filtered object
	 */ function filterAttributes ( object , permissions ) { if ( object ) { var userType = req . activeUser && req . activeUser . type || 'null' ; for ( var attribute in object . _doc ) { if ( object . _doc . hasOwnProperty ( attribute ) ) { // dont return this attribute when: if ( ! permissions [ attribute ] || // if this attribute is not defined in permissions permissions [ attribute ] [ 0 ] !== 'null' && // this attribute is not set as public permissions [ attribute ] . indexOf ( userType ) === - 1 && // this attribute is not available to this userType userType !== 'admin' // the user is not admin ) { delete object . _doc [ attribute ] ; } } } } return object ; } }
Query callback. Handles errors, filters attributes
@method callback
@param  {object}   req         The request object
@param  {object}   res         The response object
@param  {function}   resolve     The promise resolve
@param  {function}   reject      The promise reject
@param  {object}   error       The query error
@param  {object}   result      The query result
@param  {object}   permissions The attributes views permissions
@param  {string}   action      Action used for logging]
Query callback . Handles errors filters attributes