generators/app/templates/server/api/user(auth)/user.model.js
function preSave(next) {
  // jshint validthis: true
  var self = this;

  if (this.isNew && !validatePresenceOf(this.hashedPassword)) {
    return next(new MongooseError.ValidationError('Missing password'));
  }

  // check if the root user should be updated
  // return an error if some not root tries to touch the root document
  self.constructor.getRoot(function (err, rootUser) {
    if (err) {
      throw err;
    }

    // will we update the root user?
    if (rootUser && self.id === rootUser.id) {

      // delete the role to prevent loosing the root status
      delete self.role;

      // get the user role to check if a root user will perform the update
      var userRole = contextService.getContext('request:acl.user.role');
      if (!userRole) { // no user role - no root user check
        return next();
      }

      if (!auth.roles.isRoot(userRole)) {
        // return error, only root can update root
        return next(new MongooseError.ValidationError('Forbidden root update request'));
      }
    }

    // normal user update
    return next();
  });
}
function preSave(next) {
  // jshint validthis: true
  var self = this;

  if (this.isNew && !validatePresenceOf(this.hashedPassword)) {
    return next(new MongooseError.ValidationError('Missing password'));
  }

  // check if the root user should be updated
  // return an error if some not root tries to touch the root document
  self.constructor.getRoot(function (err, rootUser) {
    if (err) {
      throw err;
    }

    // will we update the root user?
    if (rootUser && self.id === rootUser.id) {

      // delete the role to prevent loosing the root status
      delete self.role;

      // get the user role to check if a root user will perform the update
      var userRole = contextService.getContext('request:acl.user.role');
      if (!userRole) { // no user role - no root user check
        return next();
      }

      if (!auth.roles.isRoot(userRole)) {
        // return error, only root can update root
        return next(new MongooseError.ValidationError('Forbidden root update request'));
      }
    }

    // normal user update
    return next();
  });
}
function preSave ( next ) { // jshint validthis: true var self = this ; if ( this . isNew && ! validatePresenceOf ( this . hashedPassword ) ) { return next ( new MongooseError . ValidationError ( 'Missing password' ) ) ; } // check if the root user should be updated // return an error if some not root tries to touch the root document self . constructor . getRoot ( function ( err , rootUser ) { if ( err ) { throw err ; } // will we update the root user? if ( rootUser && self . id === rootUser . id ) { // delete the role to prevent loosing the root status delete self . role ; // get the user role to check if a root user will perform the update var userRole = contextService . getContext ( 'request:acl.user.role' ) ; if ( ! userRole ) { // no user role - no root user check return next ( ) ; } if ( ! auth . roles . isRoot ( userRole ) ) { // return error, only root can update root return next ( new MongooseError . ValidationError ( 'Forbidden root update request' ) ) ; } } // normal user update return next ( ) ; } ) ; }
Pre save hook for the User model. Validates the existence of the
hashedPassword property if the document is saved for the first time.
Ensure that only the root user can update itself.

@api private
@param {Function} next - The mongoose middleware callback
@returns {*} If an error occurs the passed callback with an Error as its argument is called
Pre save hook for the User model . Validates the existence of the hashedPassword property if the document is saved for the first time . Ensure that only the root user can update itself .