Do not apply roles if none is specified to get

[hendrul]

I need to restrict the visibility of some attributes to some roles, only when sending data to client, but I still need to access this properties from the instance using the readable "instance.attrib" syntax. So reading the documentation I see that with set() if you don't specify any role, by default it apply "self".

var user = sequelize.define('user', {
  ...
  rank: {
     type: Sequelize.STRING,
     roles: {
       self: {set: false, get: true}
       admin: true
     }
  }
}
user.set({rank: 'UBER'}, {role: 'self'||undefined}); // Will be ignored

So I thought the same apply for get(), and with this role definition:

password: {
  roles: {
    self: true,
    client: false
  }
}

I could achieve what I want

//getter with no roles defined defaults to 'self'
user.password //123
//when returning to client:
user.get({role: 'client'}) //password is hidden

In short, I want to be able to only hide attributes when I need it

[mickhansen]

We don't actually apply any default role, self is just an example.

[hendrul]

I think it would be a good idea, because showing all attrs when not asking for any role in particular, could help me solve two issues I'm having right now:

1. using "instance.attrib" syntax to access all fields, and only when I need to hide attributes I specify roles.
2. using association accessors fails when the foreign key has some role defined

Maybe we could setup this behavior for get() and set() through config

[hendrul]

By the way, there is no support for ACLs with set() as the documentation says, only get is overwritten.

[mickhansen]

@hendrul intent was set aswell, but never got around to it.

[hendrul]

In my case I need to show all attributes by default when instance.get() but apply ACLs by default when instance.set() (well, when set() functionality gets implemented) the behavior for both should be configurable.

[drunkhacker]

this is super useful if implemented. Actually I think it can be done with quick fix like changing
if (!attr || !attr.roles || attr.roles && attr.roles[options.role] && attr.roles[options.role].get) { to
if (!attr || !attr.roles || !options.role || attr.roles && attr.roles[options.role] && attr.roles[options.role].get) { in lib/index.js

[mickhansen]

@drunkhacker happy to review a PR but not actively maintaining this project anymore.