Using plainToClass with @t.exclude isn't working as it should or my understanding is wrong.

[smolinari]

Hi,

When using plainToClass with or without the group options, I seem to have difficulty understanding the intention of the library. I also looked at tests and the source code. I'm still very uncertain.

So, I'll explain my situation. If I have the entity below (side note: this is also using Typegoose thus why the @prop decorators are there):

class Account {
  @t.mongoId
  public _id: string;

  @t
  public __v: number;

  @t
  @prop()
  public email: string;

  @t.group(Group.admin) 
  @prop()
  public password?: string;
}

and I use plainToClass without any grouping options, I get all properties. My thinking was, I should get all properties except the password.

If I use plainToClass with the groups option, I get only the password property.

And, if do this.

class Account {
  @t.mongoId
  public _id: string;

  @t
  public __v: number;

  @t
  @prop()
  public email: string;

  @t.exclude() // <- this is added
  @t.group(Group.admin)
  @prop()
  public password?: string;
}

If I use plainToClass without any group options, I get all properties except password. This is how I thought it should work and seems correct to me.

However, if I use plainToClass with the groups option, I get an empty object back. This doesn't make any sense to me and I tried the different group options (i.e. empty arrays, groupsExclude, etc). So, I believe my understanding about how @deepkit/type should be working is probably not completely understood, despite me reading the docs several times, looking at source code and tests (which btw, the options for plainToClass aren't tested or I couldn't find it).

What I'd like to see is, if I use plainToClass with no grouping options, I want all properties except the password. If I also add the groups option, then the password property should also be given. If there is no value in the pojo for password, it should give me a null value for the property.

Can someone help me clarify my understanding?

Scott

[marcj]

What I'd like to see is, if I use plainToClass with no grouping options, I want all properties except the password

plainToClass only limits properties when a group is either included or excluded. If you don't pass any additional information to plainToClass, then nothing is limited.

So if you want to exclude password, you should

const user = plainToClass(Account, json, {groupsExclude: [Group.admin]});

t.exclude is used to exclude a property for a whole serializer. If you want for example to not serialise password at all (no matter what group) when using the jsonSerializer (which classToPlain and plainToClass use), you can use @t.exclude('json'). Then it will never be used.

May I give you a tip: Don't store sensitive data at a common entity like that. Put it in AccountCredentials and only join/load it when necessary.

class Account {
  @t.mongoId
  public _id: string;

  @t
  public __v: number;

  @t
  @prop()
  public email: string;
}

class AccountCredentials {
  @prop()
  public password?: string;

  constructor(@t.primary.reference() public account: Account) {
  }
}

This way you do not "accidentally" expose this information.

[smolinari]

Thanks Marc (@marcj)! I appreciate the reply.

Ok. Now I understand. What I'm doing is writing a test suite for Typegoose, so that it shows Typegoose can work with @deepkit/type instead of class-transformer, because it seems, class-transformer is abandonware. So, the Account entity is just one for testing. I have the tests finished and passing now.

IMHO, the intention should be that if the groups option is used, it should be additive to any properties not assigned to a group. It seems that if I use the groups option, all the non-grouped properties are removed/ excluded. That means, to get the other properties, I'd have to add them to another group and declare both groups in the groups option. That would be unnecessary verbosity, as in most cases, the intention is to have most properties publicly accessible. Right?

I think this makes for ugly code. Can you suggest anything else?

class Account {
  @t.mongoId.group(Group.public)
  public _id: string;

  @t.group(Group.public)
  public __v: number;

  @t.group(Group.public)
  @prop()
  public email: string;
  
  @t.group(Group.confidential)
  @prop()
  public confidentialProperty?: string;
}

The tip on not having the password property directly in the entity is a good one. I'll take you up on it in my regular apps. I've changed the property name to confidentialProperty for now.

Thanks again.

Scott

[smolinari]

Btw. here is the PR.

typegoose/typegoose#602

I also added your suggestion about confidential data to the docs, as it also helps make sense of trying to avoid using groups . If you can offer advice on making the PR better, please do. I'd really appreciate it.

Scott

[marcj]

Cool :)