Passing in something called `user` might be confusing, maybe try something like:

```javascript
module.exports = function(api, userSchema,  platform, config) {

var loggedInUser = _.cloneDeep(userSchema);
// could be good to clone to protect yourself from somebody outside modifying that object later on
```