Adding flag for allowed fields

README.md

@@ -31,9 +31,24 @@ This will set mognoose options on the two populate calls, as if you'd defined op
 
 *Note: This method does not set options on the query itself.*
 
+#### Resticting Options
+You can restrict which options are allowed to be set in the options of populate commands. This can be useful when handling API requests where any arbitrary option can be sent by the client.
+
+```js
+MyModel.find()
+  .populate('friends')
+  .setPopulateOptions({ limit: 2 }, ['limit', 'skip']);
+```
+
 #### Submodule
 You can also load the submodule that will give will take a populate value (e.g. `friends` or `{ path: 'friends', options: { limit: 10 } }` and return an object that has the new options inserted at every level. This may be useful when manually dealing with options, like within an API.
 
+```js
+const populateObfForElement = require('mongoose-populate-options/populateObfForElement');
+
+const newPopulate = populateObfForElement(myOptions.populate, { limit: 5 });
+```
+
 ## Contributing
 
 ### Running the tests

index.js

@@ -1,7 +1,7 @@
 var populateObjForElement = require('./populateObjForElement');
 
 module.exports = function populateOptionsPlugin(schema) {
-  schema.query.setPopulateOptions = function(optionsToSet) {
+  schema.query.setPopulateOptions = function(optionsToSet, allowedOptions) {
     // Population information is stored in _mongooseOptions.populate. Note
     // that this data strucutre is a bit odd looking. The first level of
     // keys are the names of the fields to be populated. After that, the
@@ -20,7 +20,8 @@ module.exports = function populateOptionsPlugin(schema) {
       for (var i = 0; i < keys.length; i++) {
         this._mongooseOptions.populate[keys[i]] = populateObjForElement(
           this._mongooseOptions.populate[keys[i]],
-          optionsToSet
+          optionsToSet,
+          allowedOptions
         );
 
       }

package.json

@@ -1,6 +1,6 @@
 {
   "name": "mongoose-populate-options",
-  "version": "1.0.1",
+  "version": "1.1.0",
   "description": "A Mongoose plugin for applying query options to every layer of population.",
   "main": "index.js",
   "directories": {

tests/index.test.js

@@ -101,3 +101,28 @@ test('Does not affect subsequent population calls', function (t) {
     'setPopulateOptions should affect subsequent populate calls'
   );
 });
+
+test('Only allowed fields shold remain', function (t) {
+  var Org = t.context.Org;
+  var options = { limit: 10 };
+  var query = Org.find()
+    .skip(5)
+    .populate({ path: 'foo', options: { lean: true, skip: 5 } })
+    .setPopulateOptions({ limit: 10 }, ['lean']);
+
+  t.is(
+    query._mongooseOptions.populate.foo.options.skip,
+    undefined,
+    'Pre-existing options that are not allowed should be removed'
+  );
+  t.is(
+    query._mongooseOptions.populate.foo.options.limit,
+    10,
+    'New options should stay'
+  );
+  t.is(
+    query._mongooseOptions.populate.foo.options.lean,
+    true,
+    'Allowed options should still be present'
+  );
+});