@airoom/nextmin-node 0.1.8 → 1.1.0

package/dist/api/apiRouter.d.ts

@@ -16,6 +16,7 @@ export declare class APIRouter {
     private schemaLoader;
     private isDevelopment;
     private findRoutesMounted;
+    private searchRoutesMounted;
     private authRoutesInitialized;
     private schemasRouteRegistered;
     private registeredModels;
@@ -33,6 +34,7 @@ export declare class APIRouter {
     private mountSchemasEndpointOnce;
     private mountRoutes;
     private mountFindRoutes;
+    private mountSearchRoutes;
     private mountFileRoutes;
     private createCtx;
     private getSchema;

package/dist/api/apiRouter.js

@@ -16,10 +16,12 @@ const setupFileRoutes_1 = require("./router/setupFileRoutes");
 const setupAuthRoutes_1 = require("./router/setupAuthRoutes");
 const mountCrudRoutes_1 = require("./router/mountCrudRoutes");
 const mountFindRoutes_1 = require("./router/mountFindRoutes");
+const mountSearchRoutes_1 = require("./router/mountSearchRoutes");
 class APIRouter {
     constructor(options) {
         this.models = {};
         this.findRoutesMounted = false;
+        this.searchRoutesMounted = false;
         this.authRoutesInitialized = false;
         this.schemasRouteRegistered = false;
         this.registeredModels = new Set();
@@ -196,6 +198,7 @@ class APIRouter {
             this.mountSchemasEndpointOnce();
             this.mountRoutes(initialSchemas);
             this.mountFindRoutes();
+            this.mountSearchRoutes();
             this.mountFileRoutes();
             await this.syncAllIndexes(initialSchemas);
             const initializer = new DefaultDataInitializer_1.DefaultDataInitializer(this.dbAdapter, this.models);
@@ -334,6 +337,13 @@ class APIRouter {
         (0, mountFindRoutes_1.mountFindRoutes)(this.createCtx());
         this.ensureNotFoundLast();
     }
+    mountSearchRoutes() {
+        if (this.searchRoutesMounted)
+            return;
+        this.searchRoutesMounted = true;
+        (0, mountSearchRoutes_1.mountSearchRoutes)(this.createCtx());
+        this.ensureNotFoundLast();
+    }
     mountFileRoutes() {
         if (this.fileRoutesMounted)
             return;

package/dist/api/router/mountCrudRoutes.js

@@ -213,21 +213,7 @@ function mountCrudRoutes(ctx, modelNameLC) {
             const sortRaw = String(req.query.sort ?? '').trim();
             const sortTypeRaw = String(req.query.sortType ?? '').trim();
             const filter = {};
-            const buildSortSpec = () => {
-                const keys = (0, utils_1.splitCSV)(sortRaw);
-                const dirs = (0, utils_1.splitCSV)(sortTypeRaw);
-                const s = {};
-                keys.forEach((k, i) => {
-                    if (!schema.attributes?.[k])
-                        return;
-                    const d = dirs[i] ?? dirs[dirs.length - 1] ?? 'desc';
-                    s[k] = /^(desc|-1)$/i.test(d) ? -1 : 1;
-                });
-                if (!Object.keys(s).length)
-                    s.createdAt = -1;
-                return s;
-            };
-            // SEARCH
+            // ---------- SEARCH ----------
             const ors = [];
             const ands = [];
             if (q && searchKey && schema.attributes?.[searchKey]) {
@@ -277,7 +263,7 @@ function mountCrudRoutes(ctx, modelNameLC) {
                         filter[dateKey] = range;
                 }
             }
-            // arbitrary field filters ---- Direct field filters from req.query (e.g., ?isPublic=true&key=doctor) ----
+            // ---------- Direct field filters from req.query ----------
             const RESERVED = new Set([
                 'page',
                 'limit',
@@ -354,21 +340,23 @@ function mountCrudRoutes(ctx, modelNameLC) {
             if (!rdec.allow) {
                 return res.status(403).json({ error: true, message: 'forbidden' });
             }
-            const baseSort = buildSortSpec();
+            // ---------- SORT (updated; type-safe; honors client; allows virtual keys) ----------
+            const baseKeys = new Set(Object.keys(schema.attributes || {}));
+            const baseSort = (0, utils_1.parseSort)(sortRaw, sortTypeRaw, baseKeys);
             const finalFilter = (0, authorize_1.andFilter)(filter, rdec.queryFilter || {});
             const isUsersModel = modelNameLC === 'user' ||
                 modelNameLC === 'users' ||
                 (schema?.modelName ?? '').toLowerCase() === 'users';
             const currentUserId = req?.user?.id;
-            // EXTENDED PATH
+            // ---------- EXTENDED PATH ----------
             if (schema.extends) {
                 const baseName = String(schema.extends);
                 const baseLC = baseName.toLowerCase();
                 const baseSchema = ctx.getSchema(baseLC);
                 const baseModel = ctx.getModel(baseLC);
-                const baseKeys = new Set(Object.keys(baseSchema.attributes || {}));
-                const { child: childFilter, base: extBaseFilter } = (0, utils_1.splitFilterForExtended)(finalFilter, baseKeys);
-                const { child: childSort, base: extBaseSort } = (0, utils_1.splitSortForExtended)(baseSort, baseKeys);
+                const baseAttrKeys = new Set(Object.keys(baseSchema.attributes || {}));
+                const { child: childFilter, base: extBaseFilter } = (0, utils_1.splitFilterForExtended)(finalFilter, baseAttrKeys);
+                const { child: childSort, base: extBaseSort } = (0, utils_1.splitSortForExtended)(baseSort, baseAttrKeys);
                 const needPrivateForHydrate = true;
                 const requiresBaseProcessing = Object.keys(extBaseFilter).length > 0 ||
                     Object.keys(extBaseSort).length > 0;
@@ -407,7 +395,26 @@ function mountCrudRoutes(ctx, modelNameLC) {
                 }
                 const combinedSort = { ...extBaseSort, ...childSort };
                 if (Object.keys(combinedSort).length) {
-                    merged = (0, utils_1.sortInMemory)(merged, combinedSort);
+                    merged = merged.sort((a, b) => {
+                        for (const k of Object.keys(combinedSort)) {
+                            const dir = combinedSort[k];
+                            const av = a?.[k];
+                            const bv = b?.[k];
+                            const ax = av instanceof Date ? +av : av;
+                            const bx = bv instanceof Date ? +bv : bv;
+                            if (ax == null && bx == null)
+                                continue;
+                            if (ax == null)
+                                return 1 * dir;
+                            if (bx == null)
+                                return -1 * dir;
+                            if (ax > bx)
+                                return 1 * dir;
+                            if (ax < bx)
+                                return -1 * dir;
+                        }
+                        return 0;
+                    });
                 }
                 // **dedupe**: one row per base entity
                 merged = (0, utils_1.dedupeBy)(merged, (r) => String(r.exId || r.id || r._id || ''));
@@ -423,9 +430,7 @@ function mountCrudRoutes(ctx, modelNameLC) {
                     paged = merged.slice(start, start + limit);
                 }
                 else {
-                    // If your model supports it, prefer a distinct count on baseId:
-                    // totalRows = await (model as any).countDistinct?.('baseId', childFilter) ?? merged.length;
-                    totalRows = merged.length; // fallback keeps UI consistent with deduped list
+                    totalRows = merged.length;
                     paged = merged.slice(0, limit);
                 }
                 const data = rdec.exposePrivate
@@ -439,7 +444,7 @@ function mountCrudRoutes(ctx, modelNameLC) {
                     sort: combinedSort,
                 });
             }
-            // NON-EXTENDED
+            // ---------- NON-EXTENDED ----------
             const sort = baseSort;
             const totalRows = await model.count(finalFilter);
             let rawRows = [];

package/dist/api/router/mountSearchRoutes.d.ts

@@ -0,0 +1,2 @@
+import type { RouterCtx } from './ctx';
+export declare function mountSearchRoutes(ctx: RouterCtx): void;

package/dist/api/router/mountSearchRoutes.js

@@ -0,0 +1,197 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.mountSearchRoutes = mountSearchRoutes;
+const utils_1 = require("./utils");
+function mountSearchRoutes(ctx) {
+    const { router } = ctx;
+    router.post('/search', ctx.optionalAuthMiddleware, async (req, res) => {
+        try {
+            const body = (0, utils_1.isPlainObject)(req.body)
+                ? req.body
+                : {};
+            const text = typeof body.text === 'string' ? body.text.trim() : '';
+            const models = Array.isArray(body.models) ? body.models : [];
+            const fields = Array.isArray(body.fields) ? body.fields : [];
+            const select = (0, utils_1.isPlainObject)(body.select)
+                ? body.select
+                : {};
+            const perModelLimit = typeof body.limit === 'number' && body.limit > 0
+                ? Math.floor(body.limit)
+                : 10;
+            if (!text || text.length < 2) {
+                return res
+                    .status(400)
+                    .json({
+                    error: true,
+                    message: 'text must be at least 2 characters',
+                });
+            }
+            if (!models.length) {
+                return res
+                    .status(400)
+                    .json({
+                    error: true,
+                    message: 'models must be a non-empty string array',
+                });
+            }
+            if (!fields.length) {
+                return res
+                    .status(400)
+                    .json({
+                    error: true,
+                    message: 'fields must be a non-empty string array',
+                });
+            }
+            // 🚫 Block sensitive/non-searchable models
+            const forbidden = new Set(['users', 'roles', 'settings']);
+            const modelsLC = models.map((m) => String(m || '').toLowerCase());
+            const forbiddenInRequest = modelsLC.filter((m) => forbidden.has(m));
+            if (forbiddenInRequest.length) {
+                // build an empty results shape for client predictability
+                const emptyResults = Object.fromEntries(modelsLC.map((m) => [m, []]));
+                return res.status(400).json({
+                    error: true,
+                    message: `These models are not searchable: ${forbiddenInRequest.join(', ')}`,
+                    data: emptyResults,
+                });
+            }
+            const adapterAny = ctx.dbAdapter;
+            const results = {};
+            const escapeRegex = (s) => s.replace(/[.*+?^${}()|[\]\\]/g, '\\$&');
+            const textEsc = escapeRegex(text);
+            const buildOrFilter = (flds) => {
+                const orClauses = [];
+                for (const f of flds) {
+                    orClauses.push({ [f]: { $regex: `^${textEsc}`, $options: 'i' } });
+                    orClauses.push({ [f]: { $regex: textEsc, $options: 'i' } });
+                }
+                return { $or: orClauses };
+            };
+            const getValuesForPath = (row, path) => {
+                const parts = path.split('.');
+                const walk = (node, i) => {
+                    if (node == null)
+                        return [];
+                    if (i >= parts.length)
+                        return Array.isArray(node) ? node : [node];
+                    const key = parts[i];
+                    if (Array.isArray(node)) {
+                        const out = [];
+                        for (const el of node)
+                            out.push(...walk(el?.[key], i + 1));
+                        return out;
+                    }
+                    return walk(node[key], i + 1);
+                };
+                return walk(row, 0).filter((v) => v !== undefined && v !== null);
+            };
+            for (const rawName of models) {
+                const modelNameLC = String(rawName || '').toLowerCase();
+                let items = [];
+                try {
+                    const schema = ctx.getSchema(modelNameLC);
+                    const extendsUsers = String(schema?.extends || '').toLowerCase() === 'users';
+                    // Projection with baseId if extends Users
+                    const projection = Array.isArray(select?.[modelNameLC])
+                        ? Object.fromEntries(select[modelNameLC].map((k) => [k, 1]))
+                        : undefined;
+                    if (extendsUsers && projection)
+                        projection['baseId'] = 1;
+                    const filter = buildOrFilter(fields);
+                    const useAdapter = typeof adapterAny.findMany === 'function' &&
+                        typeof schema?.modelName === 'string';
+                    if (useAdapter) {
+                        items = await adapterAny.findMany(schema.modelName, filter, {
+                            sort: undefined,
+                            skip: 0,
+                            limit: undefined,
+                            projection,
+                        });
+                    }
+                    else {
+                        const all = await ctx.getModel(modelNameLC).read({}, 0, 0, true);
+                        const reStart = new RegExp('^' + escapeRegex(text), 'i');
+                        const reContain = new RegExp(escapeRegex(text), 'i');
+                        const matches = all.filter((row) => fields.some((f) => {
+                            const vals = getValuesForPath(row, f).map((v) => String(v ?? ''));
+                            return vals.some((s) => reStart.test(s) || reContain.test(s));
+                        }));
+                        items = matches.map((it) => {
+                            if (projection) {
+                                const picked = { id: it.id ?? it._id };
+                                for (const k of Object.keys(projection))
+                                    picked[k] = it[k];
+                                return picked;
+                            }
+                            return it;
+                        });
+                    }
+                    // If model extends Users, enrich results from base users via baseId
+                    if (extendsUsers && Array.isArray(items) && items.length) {
+                        const baseIds = Array.from(new Set(items
+                            .map((row) => String(row?.baseId?._id ?? row?.baseId ?? ''))
+                            .filter(Boolean)));
+                        if (baseIds.length) {
+                            const userModel = ctx.getModel('users');
+                            const baseUsers = await userModel.read({ id: { $in: baseIds } }, baseIds.length, 0, true);
+                            // keep only pure base users and sensible visibility
+                            const validUsers = baseUsers.filter((u) => !('baseId' in u) &&
+                                (!u.type || u.type === 'user') &&
+                                (!u.status || u.status === 'active'));
+                            const userMap = new Map(validUsers.map((u) => [String(u.id ?? u._id), u]));
+                            items = items.map((row) => {
+                                const bid = String(row?.baseId?._id ?? row?.baseId ?? '');
+                                const u = bid ? userMap.get(bid) : undefined;
+                                const merged = u
+                                    ? {
+                                        ...row,
+                                        firstName: u.firstName ?? row.firstName,
+                                        lastName: u.lastName ?? row.lastName,
+                                        profilePicture: u.profilePicture ?? row.profilePicture,
+                                        status: u.status ?? row.status,
+                                        type: u.type ?? row.type,
+                                        email: u.email ?? row.email,
+                                        phone: u.phone ?? row.phone,
+                                    }
+                                    : row;
+                                // remove baseId before returning
+                                if ('baseId' in merged)
+                                    delete merged.baseId;
+                                return merged;
+                            });
+                        }
+                        else {
+                            items = items.map((row) => {
+                                if ('baseId' in row)
+                                    delete row.baseId;
+                                return row;
+                            });
+                        }
+                    }
+                    else {
+                        // Not extended — ensure baseId removed if present
+                        items = items.map((row) => {
+                            if ('baseId' in row)
+                                delete row.baseId;
+                            return row;
+                        });
+                    }
+                    results[modelNameLC] = Array.isArray(items)
+                        ? items.slice(0, perModelLimit)
+                        : [];
+                }
+                catch {
+                    results[modelNameLC] = [];
+                }
+            }
+            return res
+                .status(200)
+                .json({ success: true, message: 'Search results', data: results });
+        }
+        catch (err) {
+            return res
+                .status(400)
+                .json({ error: true, message: err?.message || 'Error' });
+        }
+    });
+}

package/dist/api/router/setupFileRoutes.d.ts

@@ -1,2 +1,2 @@
-import type { RouterCtx } from "./ctx";
+import type { RouterCtx } from './ctx';
 export declare function setupFileRoutes(ctx: RouterCtx): void;

package/dist/api/router/setupFileRoutes.js

@@ -14,23 +14,26 @@ function setupFileRoutes(ctx) {
         limits: { fileSize: 50 * 1024 * 1024, files: 20 },
     });
     const fileAuthMiddleware = (req, res, next) => ctx.authenticateMiddleware(req, res, next);
-    ctx.router.post("/files", fileAuthMiddleware, upload.any(), async (req, res) => {
+    const fileApiKeyMiddleware = (req, res, next) => ctx.apiKeyMiddleware(req, res, next);
+    ctx.router.post('/file', fileApiKeyMiddleware, upload.any(), async (req, res) => {
         try {
             const files = req.files ?? [];
             if (!files.length) {
-                return res.status(400).json({ error: true, message: "No files uploaded" });
+                return res
+                    .status(400)
+                    .json({ error: true, message: 'No files uploaded' });
             }
             const results = await Promise.all(files.map(async (f) => {
                 const folder = shortFolder();
                 const ext = (f.originalname.match(/\.([A-Za-z0-9]{1,8})$/)?.[1] ??
                     (0, filename_1.extFromMime)(f.mimetype) ??
-                    "bin").toLowerCase();
+                    'bin').toLowerCase();
                 const key = `${folder}/${shortUid()}.${ext}`;
                 const out = await ctx.fileStorage.upload({
                     key,
                     body: f.buffer,
                     contentType: f.mimetype,
-                    metadata: { originalName: f.originalname || "" },
+                    metadata: { originalName: f.originalname || '' },
                 });
                 return {
                     provider: out.provider,
@@ -46,38 +49,88 @@ function setupFileRoutes(ctx) {
             }));
             return res.json({
                 success: true,
-                message: "Files uploaded successfully",
+                message: 'Files uploaded successfully',
                 data: results,
             });
         }
         catch (err) {
-            return res.status(400).json({ error: true, message: err?.message ?? "Upload failed" });
+            return res
+                .status(400)
+                .json({ error: true, message: err?.message ?? 'Upload failed' });
         }
     });
-    ctx.router.delete("/files/:key(*)", fileAuthMiddleware, async (req, res) => {
+    ctx.router.post('/files', fileAuthMiddleware, upload.any(), async (req, res) => {
         try {
-            const key = String(req.params.key || "");
+            const files = req.files ?? [];
+            if (!files.length) {
+                return res
+                    .status(400)
+                    .json({ error: true, message: 'No files uploaded' });
+            }
+            const results = await Promise.all(files.map(async (f) => {
+                const folder = shortFolder();
+                const ext = (f.originalname.match(/\.([A-Za-z0-9]{1,8})$/)?.[1] ??
+                    (0, filename_1.extFromMime)(f.mimetype) ??
+                    'bin').toLowerCase();
+                const key = `${folder}/${shortUid()}.${ext}`;
+                const out = await ctx.fileStorage.upload({
+                    key,
+                    body: f.buffer,
+                    contentType: f.mimetype,
+                    metadata: { originalName: f.originalname || '' },
+                });
+                return {
+                    provider: out.provider,
+                    bucket: out.bucket,
+                    key: out.key,
+                    url: out.url,
+                    etag: out.etag,
+                    contentType: out.contentType,
+                    size: out.size,
+                    metadata: out.metadata,
+                    originalName: f.originalname,
+                };
+            }));
+            return res.json({
+                success: true,
+                message: 'Files uploaded successfully',
+                data: results,
+            });
+        }
+        catch (err) {
+            return res
+                .status(400)
+                .json({ error: true, message: err?.message ?? 'Upload failed' });
+        }
+    });
+    ctx.router.delete('/files/:key(*)', fileAuthMiddleware, async (req, res) => {
+        try {
+            const key = String(req.params.key || '');
             if (!key) {
-                return res.status(400).json({ error: true, message: "Key is required" });
+                return res
+                    .status(400)
+                    .json({ error: true, message: 'Key is required' });
             }
             const { deleted } = await ctx.fileStorage.delete(key);
             return res.json({
                 success: true,
-                message: deleted ? "File deleted" : "Delete attempted",
+                message: deleted ? 'File deleted' : 'Delete attempted',
                 key,
                 deleted,
             });
         }
         catch (err) {
-            return res.status(400).json({ error: true, message: err?.message ?? "Delete failed" });
+            return res
+                .status(400)
+                .json({ error: true, message: err?.message ?? 'Delete failed' });
         }
     });
 }
 function shortFolder() {
     const d = new Date();
     const y = d.getFullYear();
-    const m = String(d.getMonth() + 1).padStart(2, "0");
-    const day = String(d.getDate()).padStart(2, "0");
+    const m = String(d.getMonth() + 1).padStart(2, '0');
+    const day = String(d.getDate()).padStart(2, '0');
     return `uploads/${y}/${m}/${day}`;
 }
 function shortUid() {

package/dist/api/router/utils.d.ts

@@ -2,6 +2,7 @@ import type { Request } from 'express';
 export type AnyRec = Record<string, any>;
 export type SortDir = 1 | -1;
 export type SortSpec = Record<string, SortDir>;
+export declare const ALLOWED_VIRTUAL_ATTRS: Set<string>;
 export declare const isPlainObject: (v: unknown) => v is AnyRec;
 export declare const splitCSV: (raw: string) => string[];
 export declare function normalizeAttrType(attr: any): string;
@@ -46,16 +47,16 @@ export declare function buildPredicateForField(field: string, attr: any, raw: st
 } | {
     [field]: Date;
 } | null;
-export declare function parseSort(expr?: string): Record<string, 1 | -1> | undefined;
-export declare function parseQuery(req: Request): {
+export declare const VIRTUAL_SORT_KEYS: Set<string>;
+export declare function parseSort(sortRaw: unknown, sortTypeRaw: unknown, allowedKeys?: Set<string>): SortSpec;
+export type ParsedQuery = {
     limit: number;
     page: number;
     skip: number;
-    projection: {
-        [k: string]: 1;
-    } | undefined;
-    sort: Record<string, 1 | -1> | undefined;
+    projection?: Record<string, 1>;
+    sort: SortSpec;
 };
+export declare function parseQuery(req: Request, allowedKeys?: Set<string>): ParsedQuery;
 export declare function extractIds(val: unknown): string[];
 export declare function refInfoFromAttr(attr: any): {
     ref: string;

package/dist/api/router/utils.js

@@ -1,6 +1,6 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.dedupeBy = exports.splitCSV = exports.isPlainObject = void 0;
+exports.dedupeBy = exports.VIRTUAL_SORT_KEYS = exports.splitCSV = exports.isPlainObject = exports.ALLOWED_VIRTUAL_ATTRS = void 0;
 exports.normalizeAttrType = normalizeAttrType;
 exports.toIdString = toIdString;
 exports.splitFilterForExtended = splitFilterForExtended;
@@ -12,6 +12,12 @@ exports.parseSort = parseSort;
 exports.parseQuery = parseQuery;
 exports.extractIds = extractIds;
 exports.refInfoFromAttr = refInfoFromAttr;
+exports.ALLOWED_VIRTUAL_ATTRS = new Set([
+    'createdAt',
+    'updatedAt',
+    '_id',
+    'id',
+]);
 const isPlainObject = (v) => !!v && typeof v === 'object' && !Array.isArray(v);
 exports.isPlainObject = isPlainObject;
 const splitCSV = (raw) => raw
@@ -206,35 +212,68 @@ function buildPredicateForField(field, attr, raw) {
                 : { [field]: raw };
     }
 }
-function parseSort(expr) {
-    if (!expr)
-        return;
-    const out = {};
-    for (const raw of expr
+exports.VIRTUAL_SORT_KEYS = new Set([
+    'createdAt',
+    'updatedAt',
+    '_id',
+    'id',
+]);
+function parseSort(sortRaw, sortTypeRaw, allowedKeys) {
+    const keys = String(sortRaw ?? '')
         .split(',')
         .map((s) => s.trim())
-        .filter(Boolean)) {
-        if (raw.startsWith('-'))
-            out[raw.slice(1)] = -1;
-        else if (raw.startsWith('+'))
-            out[raw.slice(1)] = 1;
-        else
-            out[raw] = 1;
+        .filter(Boolean);
+    const dirs = String(sortTypeRaw ?? '')
+        .split(',')
+        .map((s) => s.trim())
+        .filter(Boolean);
+    const hasKey = (k) => (allowedKeys?.has(k) ?? false) || exports.VIRTUAL_SORT_KEYS.has(k);
+    const spec = {};
+    if (keys.length) {
+        keys.forEach((k, i) => {
+            let field = k;
+            let dir = null;
+            // compact + / - prefix
+            if (k.startsWith('-')) {
+                field = k.slice(1);
+                dir = -1;
+            }
+            else if (k.startsWith('+')) {
+                field = k.slice(1);
+                dir = 1;
+            }
+            if (dir === null) {
+                const d = dirs[i] ?? dirs[dirs.length - 1] ?? 'desc';
+                dir = /^(desc|-1)$/i.test(d)
+                    ? -1
+                    : /^(asc|1)$/i.test(d)
+                        ? 1
+                        : -1;
+            }
+            if (field && hasKey(field)) {
+                spec[field] = dir;
+            }
+        });
+        // client sent sort but none validated → honor “no default”
+        return spec;
     }
-    return Object.keys(out).length ? out : undefined;
+    // no sort sent → default
+    return { createdAt: -1 };
 }
-function parseQuery(req) {
-    const limit = Math.min(parseInt(String(req.query.limit ?? '12'), 10) || 12, 100);
-    const page = Math.max(parseInt(String(req.query.page ?? '1'), 10) || 1, 1);
+function parseQuery(req, allowedKeys) {
+    const limit = Math.min(Number.parseInt(String(req.query.limit ?? '12'), 10) || 12, 100);
+    const page = Math.max(Number.parseInt(String(req.query.page ?? '1'), 10) || 1, 1);
     const skip = (page - 1) * limit;
     const fields = String(req.query.fields ?? '')
         .split(',')
         .map((s) => s.trim())
         .filter(Boolean);
-    const projection = fields.length
+    const projection = fields.length > 0
         ? Object.fromEntries(fields.map((f) => [f, 1]))
         : undefined;
-    const sort = parseSort(String(req.query.sort ?? '-createdAt'));
+    // NOTE: do NOT force a fallback like '-createdAt' here;
+    // parseSort will apply { createdAt: -1 } only if no sort is provided.
+    const sort = parseSort(req.query.sort, req.query.sortType, allowedKeys);
     return { limit, page, skip, projection, sort };
 }
 function extractIds(val) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@airoom/nextmin-node",
-  "version": "0.1.8",
+  "version": "1.1.0",
   "license": "MIT",
   "main": "dist/index.js",
   "types": "dist/index.d.ts",