{"action":"created","issue":{"url":"https://api.github.com/repos/reactioncommerce/reaction/issues/399","labels_url":"https://api.github.com/repos/reactioncommerce/reaction/issues/399/labels{/name}","comments_url":"https://api.github.com/repos/reactioncommerce/reaction/issues/399/comments","events_url":"https://api.github.com/repos/reactioncommerce/reaction/issues/399/events","html_url":"https://github.com/reactioncommerce/reaction/issues/399","id":92479160,"number":399,"title":"Limit returned fields for ShopMembers","user":{"login":"queso","id":106,"avatar_url":"https://avatars.githubusercontent.com/u/106?v=3","gravatar_id":"","url":"https://api.github.com/users/queso","html_url":"https://github.com/queso","followers_url":"https://api.github.com/users/queso/followers","following_url":"https://api.github.com/users/queso/following{/other_user}","gists_url":"https://api.github.com/users/queso/gists{/gist_id}","starred_url":"https://api.github.com/users/queso/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/queso/subscriptions","organizations_url":"https://api.github.com/users/queso/orgs","repos_url":"https://api.github.com/users/queso/repos","events_url":"https://api.github.com/users/queso/events{/privacy}","received_events_url":"https://api.github.com/users/queso/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":1,"created_at":"2015-07-01T20:32:36Z","updated_at":"2015-07-01T20:41:12Z","closed_at":null,"body":"Redefine fields here: https://github.com/reactioncommerce/reaction-core/blob/development/server/publications.coffee#L120-L127\r\n\r\n```\r\nsort of not - these are all administrative roles where the full list of users was needed. however, we've made changes to move the user \"profiles\" into the \"Accounts\" collection,  maybe this could be pruned to just a list of _id,  that and then a join to the accounts collection for the actual profile data. \r\ncould also update to: `permissions = ['dashboard/orders','owner','admin']` as 'dashboard/customers' is deprecated.\r\n```"},"comment":{"url":"https://api.github.com/repos/reactioncommerce/reaction/issues/comments/117818954","html_url":"https://github.com/reactioncommerce/reaction/issues/399#issuecomment-117818954","issue_url":"https://api.github.com/repos/reactioncommerce/reaction/issues/399","id":117818954,"user":{"login":"queso","id":106,"avatar_url":"https://avatars.githubusercontent.com/u/106?v=3","gravatar_id":"","url":"https://api.github.com/users/queso","html_url":"https://github.com/queso","followers_url":"https://api.github.com/users/queso/followers","following_url":"https://api.github.com/users/queso/following{/other_user}","gists_url":"https://api.github.com/users/queso/gists{/gist_id}","starred_url":"https://api.github.com/users/queso/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/queso/subscriptions","organizations_url":"https://api.github.com/users/queso/orgs","repos_url":"https://api.github.com/users/queso/repos","events_url":"https://api.github.com/users/queso/events{/privacy}","received_events_url":"https://api.github.com/users/queso/received_events","type":"User","site_admin":false},"created_at":"2015-07-01T20:41:12Z","updated_at":"2015-07-01T20:41:12Z","body":"@aaronjudd so my gut here says it is better to limit publications to the fields we need/care about, rather than exposing the whole record. Especially when it comes to the user and things like oAuth tokens or salted password hashes."}}