javascript - underscore.js .keys and .omit not working as expected -

i'm running mongodb access via mongoose store user records. have underscore on server. have restful api route returns collection (array of objects) database. want return full collection client but remove password element each object doesn't sent client. before says anything, use bcrypt salt , hash password in final version :)

today have 1 entry in database, user 'administrator'. here's code in route:

app.get('/users', function(req, res) {   user.find().sort({'username': 'ascending'}).exec(function(err, data) {     _.each(data, function (element, index, list) {       console.log('username=' + element.username);       console.log('password=' + element.password);       delete element.password;       console.log('keys: ' + _.keys(element));       console.log('password=' + element.password);       console.log(_.omit(element, 'password'));     });     res.json(data);   }); }); 

what sent browser is:

[{"_id":"54058e6eb53dd60730295f59","modifiedon":"2014-09-01t15:19:10.012z", "username":"administrator","password":"stackoverflow","role":"administrator", "__v":0,"createdby":"54058e6eb53dd60730295f59","createdon":"2014-09-01t15:19:10.004z", "previouslogins":[],"accountislocked":false,"loginattempts":0}] 

which fine, res.json(data) statement sending raw data browser - that's not issue. issue delete (and if use .omit) don't seem work on collection! can see there lots of console.log debugging, here's gets output:

username=administrator password=stackoverflow keys: $__,isnew,errors,_maxlisteners,_doc,_pres,_posts,save,_events password=stackoverflow { _id: 54058e6eb53dd60730295f59,   modifiedon: mon sep 01 2014 19:19:10 gmt+0400 (gst),   username: 'administrator',   password: 'stackoverflow',   role: 'administrator',   __v: 0,   createdby: 54058e6eb53dd60730295f59,   createdon: mon sep 01 2014 19:19:10 gmt+0400 (gst),   previouslogins: [],   accountislocked: false,   loginattempts: 0 } 

the output of _.keys shows keys (i assume object prototype?) don't see when console.log(element) none of keys accessible via element.key.

any idea why i'm seeing behaviour?

the problem data passed exec callback function document object - can thought of collection of models created mongoose. these objects have plenty of useful methods, remember connection db etc. - won't able process them plain objects.

the solution instruct mongoose want plain js objects result of query lean():

user.find().sort({'username': 'ascending'}).lean().exec(function(err, data) {   // process data }); 

alternatively, should able turn each model plain object .toobject() method, filter it:

var filtered = _.map(data, function(model) {   return _.omit(model.toobject(), 'password'); }); res.json(filtered); 

... i'd rather use first approach. )