How to return only specific attributes when using Sequelize Create method

Question

I have been searching through Sequelize documentation and forums for the correct syntax and it seems I am doing it the right way, but for some reason the password field is still being returned in the response payload...

The following link shows the attributes exclude syntax I am using was added in version 3.11 of Sequelize: https://github.com/sequelize/sequelize/issues/4074

Anyone know what I might be missing here? Below is the Create method and the console log from the Insert statement.

Create method

async create(req, res) {
try {
    let user = await User.create({
        firstName: req.body.firstName,
        lastName: req.body.lastName,
        email: req.body.email,
        password: req.body.password
    }, {
        attributes: {
            exclude: ['password']
        }
    });

    console.log("USER: ", user);

    res.status(201).send(user.toJSON());
}
catch (error) {
    res.status(500).send(error)
};

}

Console Log

Executing (default): INSERT INTO "Users" ("id","firstName","lastName","email","password","createdAt","updatedAt") VALUES (DEFAULT,'James','Martineau','test@gmail.com','$2b$10$7ANyHzs74OXYfXHuhalQ3ewaS4DDem1cHMprKaIa7gO434rlVLKp2','2019-02-28 15:18:15.856 +00:00','2019-02-28 15:18:15.856 +00:00') RETURNING *;

USER: User { dataValues: { id: 6, firstName: 'James', lastName: 'Martineau', email: 'test@gmail.com', password: '$2b$10$7ANyHzs74OXYfXHuhalQ3ewaS4DDem1cHMprKaIa7gO434rlVLKp2', updatedAt: 2019-02-28T15:18:15.856Z, createdAt: 2019-02-28T15:18:15.856Z }...

i'm still looking for this like you needed. You finded one way to do this without property.delete? delete all my properties seems not to be a dry solution — veroneseComS, Sep 08 '20 at 04:50

score 9 · Answer 1 · answered Nov 19 '20 at 15:20

The proper way to handle this is to leverage the afterCreate and afterUpdate hooks on the actual data model, that Sequelize exposes. These hooks are fired after the record is persisted, so any mutations to the dataValues will only be reflected in the return.

sequelize.define(
    'User',
    {
        id: { type: DataType.UUID, defaultValue: Sequelize.UUIDV4, primaryKey: true },
        username: { type: DataType.STRING, allowNull: false },
        password: { type: DataType.STRING, allowNull: false }
    },
    {
        hooks: {
            afterCreate: (record) => {
                delete record.dataValues.password;
            },
            afterUpdate: (record) => {
                delete record.dataValues.password;
            },
        }
    }
);

Here is a link to the documentation: https://sequelize.org/master/manual/hooks.html

Better solution and practical approach – Norseback Sep 02 '21 at 04:29 — Norseback, Sep 02 '21 at 04:29

score 4 · Accepted Answer · edited May 20 '21 at 18:56

4

I see in the document, you can't exclude attributes when you create a model. Only exclude when you find a model.

I suggest:

async create(req, res);
{
    try {
        let user = await User.create({
            firstName: req.body.firstName,
            lastName: req.body.lastName,
            email: req.body.email,
            password: req.body.password
        });
        delete user["password"];//delete field password
        console.log("USER: ", user);

        res.status(201).send(user.toJSON());
    }
    catch (error) {
        res.status(500).send(error);
    };
}

edited May 20 '21 at 18:56

Filip Seman

1,252
2
15
22

answered Mar 01 '19 at 03:10

Chuong Tran

3,131
17
25

2

Here was the final result `delete user.dataValues.password` Querying the database again to get the specific attributes would be more costly. – James Mar 02 '19 at 23:09

score 2 · Answer 3 · answered Mar 13 '19 at 15:37

2

 User.create(req.body).then(user => {
    delete user.dataValues.password
    res.json(user)
  }).catch(error => {
   // do something with error
  })

answered Mar 13 '19 at 15:37

KBH

315
3
9

score 2 · Answer 4 · answered Oct 23 '19 at 22:55

Try overloading Sequelize Model class with your desired functionality. For example, run following code once during application bootstrap:

import {Model} from 'sequelize';

const toJSON = Model.prototype.toJSON;

Model.prototype.toJSON = function ({attributes = []} = {}) {
    const obj = toJSON.call(this);

    if (!attributes.length) {
      return obj;
    }

    return attributes.reduce((result, attribute) => {
      result[attribute] = obj[attribute];

      return result;
    }, {});
  };

After that, you can use your code as usual, but with an attributes option:

User.toJSON({attributes: ['name', 'etc...']}).

tyzion · Answer 5 · 2021-05-20T15:02:07.827

I know it's an old question, but it's a problem i faced recently. The way I solved this, is like this:

try {
    const { firstName, lastName, email } = await User.create({
        firstName: req.body.firstName,
        lastName: req.body.lastName,
        email: req.body.email,
        password: req.body.password
    })
    const user = { firstName, lastName, email }

}

     console.log("USER: ", user);

     res.status(201).send(user.toJSON());
}
catch (error) {
     res.status(500).send(error)
};

You can instantiate the fields you want like this, at least it's what i'm doing everywhere in my code

hope this works for you too :)

score 1 · Answer 6 · answered Feb 28 '19 at 15:56

1

With a quick read through the docs, it seems attributes is only mentioned within queries like:

Model.findAll({
  attributes: { exclude: ['baz'] }
});

(http://docs.sequelizejs.com/manual/tutorial/querying.html#attributes)

If you want to exclude password with create, you could do something like:

let user = await User.create({
    firstName: req.body.firstName,
    lastName: req.body.lastName,
    email: req.body.email,
    password: req.body.password
}, {
    fields: ['firstName', 'lastName', 'email']
});

(http://docs.sequelizejs.com/manual/tutorial/instances.html#creating-persistent-instances)

answered Feb 28 '19 at 15:56

Scott Rudiger

1,224
12
16

2

Thanks Scott, but I don't think your response is correct. The documentation seems to state that the `fields` parameter dictates what fields will be set. This further makes sense as when i attempted to implement your suggestion by Sequelize User model blew up because the password was not provided, only the 3 fields defined were. – James Feb 28 '19 at 16:27
Ah, perhaps I misunderstood your intent. Have you tried: `User.create({ //... {include: ['firstName', 'lastName', 'email']} })`? – Scott Rudiger Feb 28 '19 at 16:39
The include parameter is used for model associations. Since this is simply a Create function and no associations are being added here, the include parameter would not be appropriate. I am basically trying to add the `attributes` parameter for the Sequelize.create but apparently there's a different way to do it...? – James Feb 28 '19 at 16:55
Hmm...the only thing I can think of now is to first `create` then query for the same record with `findOne` and return that. That way you can use `attributes` to `exclude` `password`. – Scott Rudiger Feb 28 '19 at 22:19
1

Seems like it should also be possible to use `findOrCreate`; e.g., `let [user] = await User.findOrCreate({ firstName: req.body.firstName, lastName: req.body.lastName, email: req.body.email, password: req.body.password }, { attributes: { exclude: ['password'] } });` Let me know if that works and I'll gladly edit the answer. – Scott Rudiger Feb 28 '19 at 23:48

How to return only specific attributes when using Sequelize Create method

6 Answers6