// ...
var UserSchema = new Schema({
name: String,
email: {type: String, lowercase: true},
contracts: [{
type: Schema.Types.ObjectId,
ref: 'Contract'
}]
});
module.exports = mongoose.model('User', UserSchema);
// ...
User.findOne({
_id: userId
}, '-salt -hashedPassword')
.populate('contracts')
.exec(function(err, user) { // don't ever give out the password or salt
if (err) return next(err);
if (!user) return res.json(401);
// user.contracts.forEach(function(contract, index){ console.log(index, contract); });
res.json(user);
});