How can I enable hook.remove when I accessing a service from a custom hook?

Question

I'm trying to create a custom populate hook for one service and each service has an user connected to it via an id.

When I do hook.app.service('users').get(id), I get the user object but the problem is that everything including the password and other sensitive data are being returned but in my user service after hooks (all) I've added hooks.remove('password',...)

Thanks in advance guys

Answer 1

The .remove hook you are using will only run if it looks like it the data is being accessed externally (if we e.g. check the login information on the server we do need the password to compare). You can cause the hook to run by setting params.provider in your method call like this:

hook.app.service('users').get(id, { provider: 'server' })