server-injectable.js

app.post('/documents/find', (req, res) => {

    if (!req.body.type && !req.body.title) {
        return res.json([]);
    }

    if (req.body.type === "evil projects") { // I don't want people to discover my evli projects,
        // it would be a shame is 'client.js' contained a method show all the content of the collection here...
        return res.json([]);
    }

    Document.find(req.body).exec()
        .then((r) => res.json(r))
        .catch((err) => res.json(err));
});