const user = await AuthUser.findOne({ _id: id }).select('-password').populate('scopes').exec()