removed password field leakage while populating a collection

Author: yash-pouranik

apps/dashboard-api/src/controllers/auth.controller.js

@@ -132,7 +132,7 @@ module.exports.login = async (req, res) => {
     try {
         const { email, password } = loginSchema.parse(req.body);
 
-        const dev = await Developer.findOne({ email: email.toLowerCase().trim() });
+        const dev = await Developer.findOne({ email: email.toLowerCase().trim() }).select('+password');
         if (!dev) return res.status(400).json({ error: "User not found" });
 
         const validPass = await bcrypt.compare(password, dev.password);
@@ -156,7 +156,7 @@ module.exports.changePassword = async (req, res) => {
     try {
         const { currentPassword, newPassword } = changePasswordSchema.parse(req.body);
 
-        const dev = await Developer.findById(req.user._id);
+        const dev = await Developer.findById(req.user._id).select('+password');
 
         const validPass = await bcrypt.compare(currentPassword, dev.password);
         if (!validPass) return res.status(400).json({ error: "Incorrect current password" });
@@ -180,7 +180,7 @@ module.exports.deleteAccount = async (req, res) => {
     try {
         const { password } = deleteAccountSchema.parse(req.body);
 
-        const dev = await Developer.findById(req.user._id);
+        const dev = await Developer.findById(req.user._id).select('+password');
 
         const validPass = await bcrypt.compare(password, dev.password);
         if (!validPass) return res.status(400).json({ error: "Incorrect password. Cannot delete account." });
@@ -246,7 +246,7 @@ module.exports.verifyOtp = async (req, res) => {
     try {
         const { email, otp } = verifyOtpSchema.parse(req.body);
 
-        const existingUser = await Developer.findOne({ email });
+        const existingUser = await Developer.findOne({ email }).select('+password');
         if (!existingUser) return res.status(400).json({ error: "User not found" });
 
         const otpDoc = await validateOtp(existingUser._id, otp);
@@ -290,7 +290,7 @@ module.exports.resetPassword = async (req, res) => {
     try {
         const { email, otp, newPassword } = resetPasswordSchema.parse(req.body);
 
-        const dev = await Developer.findOne({ email });
+        const dev = await Developer.findOne({ email }).select('+password');
         if (!dev) return res.status(400).json({ error: "User not found" });
 
         const otpDoc = await validateOtp(dev._id, otp);
@@ -366,7 +366,7 @@ module.exports.refreshToken = async (req, res) => {
         }
 
         const decoded = jwt.verify(refreshToken, process.env.JWT_REFRESH_SECRET || process.env.JWT_SECRET);
-        const user = await Developer.findById(decoded._id);
+        const user = await Developer.findById(decoded._id).select('+refreshToken');
 
         if (!user || user.refreshToken !== refreshToken) {
             return res.status(403).json({ error: "Invalid refresh token" });

apps/public-api/src/__tests__/userAuth.refresh.test.js

@@ -22,9 +22,11 @@ jest.mock('mongoose', () => ({
 jest.mock('@urbackend/common', () => {
     const z = require('zod');
     const mockModel = {
-        findOne: jest.fn(),
+        findOne: jest.fn().mockReturnThis(),
         create: jest.fn(),
         updateOne: jest.fn(),
+        select: jest.fn().mockReturnThis(),
+        lean: jest.fn().mockReturnThis(),
     };
 
     const projectFindByIdChain = {
@@ -125,7 +127,7 @@ describe('public userAuth refresh flow', () => {
     });
 
     test('login issues access token and sets refresh cookie', async () => {
-        mockModel.findOne.mockResolvedValueOnce({
+        mockModel.select.mockResolvedValueOnce({
             _id: 'user_1',
             password: 'hashed_pw',
             email: 'a@b.com',

apps/public-api/src/controllers/userAuth.controller.js

@@ -1050,7 +1050,7 @@ module.exports.login = async (req, res) => {
         const connection = await getConnection(project._id);
         const Model = getCompiledModel(connection, usersColConfig, project._id, project.resources.db.isExternal);
 
-        const user = await Model.findOne({ email: normalizedEmail });
+        const user = await Model.findOne({ email: normalizedEmail }).select('+password');
 
         if (!user) return res.status(400).json({ error: "Invalid email or password" });
 

packages/common/src/models/Developer.js

@@ -8,7 +8,8 @@ const developerSchema = new mongoose.Schema({
     },
     password: {
         type: String,
-        required: true
+        required: true,
+        select: false
     },
     isVerified: {
         type: Boolean,
@@ -20,7 +21,8 @@ const developerSchema = new mongoose.Schema({
     },
     refreshToken: {
         type: String,
-        default: null
+        default: null,
+        select: false
     }
 }, { timestamps: true });
 

packages/common/src/utils/injectModel.js

@@ -10,15 +10,16 @@ const typeMapping = {
 };
 
 // Recursive field definition builder
-function buildFieldDef(field, projectId, isExternal) {
+// Recursive field definition builder
+function buildFieldDef(field, projectId, isExternal, isUsersCollection = false) {
   // Object type — nested sub-schema
   if (field.type === "Object" && field.fields && field.fields.length > 0) {
     const subSchema = {};
     field.fields.forEach((f) => {
       const normalizedKey = normalizeKey(f.key);
       if (!normalizedKey) return;
 
-      subSchema[normalizedKey] = buildFieldDef(f, projectId, isExternal);
+      subSchema[normalizedKey] = buildFieldDef(f, projectId, isExternal, isUsersCollection);
     });
     return { type: subSchema, required: !!field.required };
   }
@@ -42,7 +43,7 @@ function buildFieldDef(field, projectId, isExternal) {
         const normalizedKey = normalizeKey(f.key);
         if (!normalizedKey) return;
 
-        subSchema[normalizedKey] = buildFieldDef(f, projectId, isExternal);
+        subSchema[normalizedKey] = buildFieldDef(f, projectId, isExternal, isUsersCollection);
       });
       return { type: [subSchema], required: !!field.required };
     }
@@ -71,25 +72,32 @@ function buildFieldDef(field, projectId, isExternal) {
   }
 
   // Primitive types
-  return {
+  const def = {
     type: typeMapping[field.type],
     required: !!field.required,
   };
+
+  // HARDEN: Exclude password by default for project users
+  if (isUsersCollection && normalizeKey(field.key) === "password") {
+    def.select = false;
+  }
+
+  return def;
 }
 function normalizeKey(key) {
   return String(key || "")
     .replace(/\uFEFF/g, "")
     .trim();
 }
 
-function buildMongooseSchema(fieldsArray = [], projectId, isExternal) {
+function buildMongooseSchema(fieldsArray = [], projectId, isExternal, isUsersCollection = false) {
   const schemaDef = {};
 
   fieldsArray.forEach((field) => {
     const normalizedKey = normalizeKey(field.key);
     if (!normalizedKey) return;
 
-    schemaDef[normalizedKey] = buildFieldDef(field, projectId, isExternal);
+    schemaDef[normalizedKey] = buildFieldDef(field, projectId, isExternal, isUsersCollection);
   });
 
   return new mongoose.Schema(schemaDef, {
@@ -126,7 +134,8 @@ function getCompiledModel(connection, collectionData, projectId, isExternal) {
   }
 
   // Build schema + compile
-  const schema = buildMongooseSchema(collectionData.model, projectId, isExternal);
+  const isUsersCollection = collectionData.name === "users";
+  const schema = buildMongooseSchema(collectionData.model, projectId, isExternal, isUsersCollection);
   const model = connection.model(collectionName, schema);
 
   // Cache it
@@ -135,6 +144,7 @@ function getCompiledModel(connection, collectionData, projectId, isExternal) {
   return model;
 }
 
+
 // Clear cached model (needed when schema changes)
 function clearCompiledModel(connection, collectionName) {
   if (modelRegistry.has(connection)) {