fuel/core — pull request #840 by danharper (2012-02-17 16:53:48+00:00)
Title: Specify which fields are safe to "expose" in a REST Controller

On a recent project I've been building a RESTful API atop Fuel and we found specifying which database fields to expose via the API painful (writing in multiple places etc.). So I wrote in a few helper methods to allow each of our resources to specify exactly which fields to expose, and even the ability to expose computed/dynamic fields.

As a run-down, imagine we have a Users resource with the following fields:

- id
- username
- email
- password
- location
- first_name
- last_name
- last_login_ip
- created_at
- updated_at

On our API we want to expose this data, but let's say we don't want to expose the `password`, `last_login_ip`, `created_at` or `updated_at` fields. In our Controller we can specify exactly which fields to expose with the `$_exposable` variable:

```php
$model->first_name.' '.$model->last_name,
);
}
```

Exposing our specified fields is now as simple as doing something like:

```php
response($expose, 200);
}
```

Looking for any criticisms/feedback on this; I haven't looked into whether I need to write tests, or what sort of documentation to write just yet. I've found this sort of functionality to be incredibly useful when building APIs.