 _ = require 'lodash'
+mask = require 'json-mask'
 Band = require '../models/band'
 Vote = require '../models/vote'
 
+WHITELIST = [
+  '_id'
+  'name'
+  'parent'
+  'vote_count'
+  'userHasVotedFor'
+].join(',')
+
+# removes data that shouldn't be returned in json
+partialResponse = (json) ->
+  mask(json, WHITELIST)
+
+# returns ip address
 getIpAddress = (ipObj) ->
   if ipObj?
     ipObj.clientIp

        newResult = _.map result, (obj) ->
          hasVoted = if _.find(obj.children, { user_id: userId })? then true else false
          return _.assign obj, userHasVotedFor: hasVoted
        return res.status(200).json newResult
  )

# GET /api/bands/:id
exports.show = (req, res) ->
  Band.findById req.params.id, (err, result) ->
    return res.status(500).json error: err if err?
    return res.status(200).json result

# POST /api/bands
exports.create = (req, res) ->

    user_ip_address: getIpAddress(req.session.ipAddress)
  new Vote(data).save (err, result) ->
    return res.status(500).json error: err if err?
    return res.status(200).json partialResponse(result)

# PUT /api/bands/:id
exports.update = (req, res) ->
