Don't expose private RSA key

cc @Tirokk

backend/src/middleware/passwordMiddleware.js

@@ -11,10 +11,15 @@ export default {
     }
   },
   Query: async (resolve, root, args, context, info) => {
-    const result = await resolve(root, args, context, info)
-    return walkRecursive(result, ['password'], () => {
+    let result = await resolve(root, args, context, info)
+    result = walkRecursive(result, ['password'], () => {
       // replace password with asterisk
       return '*****'
     })
+    result = walkRecursive(result, ['privateKey'], () => {
+      // replace password with asterisk
+      return '*****'
+    })
+    return result
   }
 }

backend/src/middleware/permissionsMiddleware.js

@@ -73,7 +73,8 @@ const permissions = shield({
   },
   User: {
     email: isMyOwn,
-    password: isMyOwn
+    password: isMyOwn,
+    privateKey: isMyOwn
   }
 })