twilson63/express-couchUser — pull request #14 by the-t-in-rtf (2014-03-28 18:22:22+00:00)
Title: Sanitized information returned to users...

Per https://github.com/twilson63/express-couchUser/issues/11 I raised concerns about users being passed their own (and other people's) hashes, encrypted passwords, etc. Based on our conversation I have wrapped all outgoing user data objects in calls to "only" which only allows a range of whitelisted fields. I also made it a requirement that a user at least be logged in to access user lookup and management functions.

This took longer than expected as there were a lot of calls that expected to get raw couch records and pass that on. I ended up making "our" delete and update methods get the couch record separately and then perform the main action based on the user-supplied data.

For this round I did go through the mocha tests and review. I ended up adding tests for the new /api/user/current functions and getting the signin/signout tests to work again (previously they were commented out).