lib/security/ObjectAcl.js
function doSanitizeObject(obj, user, filterArrays, acl) {
  var result = obj

  var finalAcl = undefined

  var objAclDatum = obj.__acl__
  if (objAclDatum) {
    objAcl = o(aclDatum, null, module.exports) // clone
    objAcl.object = obj
    finalAcl = objAcl
  }

  if (acl) {
    var aclClone = o({ _type: acl })
    aclClone.object = obj

    if (finalAcl) {
      finalAcl = aclClone.and(finalAcl)
    } else {
      finalAcl = aclClone
    }
  }

  if (finalAcl) {
    // Only check permission if acl exists
    // If acl does not exist result will be the original obj
    if (!finalAcl.hasPermission(user, 'read', undefined)) {
      result = undefined
      // XXX later this is more nuanced to sanitize
    }
  }

  return result
}
function doSanitizeObject(obj, user, filterArrays, acl) {
  var result = obj

  var finalAcl = undefined

  var objAclDatum = obj.__acl__
  if (objAclDatum) {
    objAcl = o(aclDatum, null, module.exports) // clone
    objAcl.object = obj
    finalAcl = objAcl
  }

  if (acl) {
    var aclClone = o({ _type: acl })
    aclClone.object = obj

    if (finalAcl) {
      finalAcl = aclClone.and(finalAcl)
    } else {
      finalAcl = aclClone
    }
  }

  if (finalAcl) {
    // Only check permission if acl exists
    // If acl does not exist result will be the original obj
    if (!finalAcl.hasPermission(user, 'read', undefined)) {
      result = undefined
      // XXX later this is more nuanced to sanitize
    }
  }

  return result
}
*************************************************************************************************
@method doSanitizeObject
@description doSanitizeObject description
@param {xxx} obj -- xxx
@param {xxx} user -- xxx
@param {xxx} filterArrays -- xxx
@param {xxx} acl -- xxx
@returns {xxx} -- xxx