call toObject

packages/core/src/models/serializers/attachment-serializer.ts

@@ -1,13 +1,20 @@
-import type { IAttachment } from '~/interfaces';
+import { Document } from 'mongoose';
+
+import type { IAttachment, IUser } from '~/interfaces';
 
 import { isPopulated, isRef, type Ref } from '../../interfaces/common';
 
 import { serializeUserSecurely, type IUserSerializedSecurely } from './user-serializer';
 
-export type IAttachmentSerializedSecurely<A extends IAttachment = IAttachment> = Omit<A, 'creator'> & { creator?: Ref<IUserSerializedSecurely> };
+export type IAttachmentSerializedSecurely<A extends IAttachment> = Omit<A, 'creator'> & { creator?: Ref<IUserSerializedSecurely<IUser>> };
 
 const omitInsecureAttributes = <A extends IAttachment>(attachment: A): IAttachmentSerializedSecurely<A> => {
-  const { creator, ...rest } = attachment;
+
+  const leanDoc = (attachment instanceof Document)
+    ? attachment.toObject<A>()
+    : attachment;
+
+  const { creator, ...rest } = leanDoc;
 
   const secureCreator = creator == null
     ? undefined

packages/core/src/models/serializers/user-serializer.ts

@@ -1,13 +1,20 @@
+import { Document } from 'mongoose';
+
 import { isPopulated, isRef, type Ref } from '../../interfaces/common';
 import type { IUser } from '../../interfaces/user';
 
-export type IUserSerializedSecurely<U extends IUser = IUser> = Omit<U, 'password' | 'apiToken' | 'email'> & { email?: string };
+export type IUserSerializedSecurely<U extends IUser> = Omit<U, 'password' | 'apiToken' | 'email'> & { email?: string };
+
+export const omitInsecureAttributes = <U extends IUser>(user: U): IUserSerializedSecurely<U> => {
+
+  const leanDoc = (user instanceof Document)
+    ? user.toObject<U>()
+    : user;
 
-export const omitInsecureAttributes = <U extends IUser = IUser>(user: U): IUserSerializedSecurely<U> => {
   const {
     // eslint-disable-next-line @typescript-eslint/no-unused-vars
     password, apiToken, email, ...rest
-  } = user;
+  } = leanDoc;
 
   const secureUser: IUserSerializedSecurely<U> = rest;