@anteros/core 0.0.18 → 0.0.20

package/database/collection.ts

@@ -84,23 +84,35 @@ async function initializeOnDatabase(collections: Collection[]) {
                     }
 
                     if (field?.index) {
-                        let indexValue: Boolean | number = field.index;
-                        let includesStringType: Field['type'][] = ['string', 'email', 'enum', 'url', 'random', 'slug'];
-                        let includesDateType: Field['type'][] = ['date', 'datetime-local'];
-                        if (typeof indexValue == "boolean" && includesStringType.includes(field.type)) {
-                            indexValue = 1
+                        let indexValue: number | string = 1;
+
+                        // Honor explicit indexType first
+                        if (field.indexType) {
+                            indexValue = field.indexType;
+                        } else if (typeof field.index === 'number') {
+                            indexValue = field.index;
+                        } else if (field.type === 'geojson.Point' || field.type === 'geojson.LineString' || field.type === 'geojson.Polygon') {
+                            indexValue = '2dsphere';
+                        } else {
+                            let includesStringType: Field['type'][] = ['string', 'email', 'enum', 'url', 'random', 'slug', 'relationship', 'uuid', 'password'];
+                            let includesDateType: Field['type'][] = ['date', 'datetime-local'];
+                            if (includesStringType.includes(field.type)) {
+                                indexValue = 1;
+                            } else if (includesDateType.includes(field.type)) {
+                                indexValue = -1;
+                            }
                         }
 
-                        if (typeof indexValue == "boolean" && includesDateType.includes(field.type)) {
-                            indexValue = -1
-                        }
+                        let isSparse = field.type === 'random'
+                            || (field.unique && field.required !== true);
+
                         specsFieldsIndexes.push({
                             key: {
-                                [field.name]: indexValue as number
+                                [field.name]: indexValue as any
                             },
                             unique: field.unique ?? false,
-                            sparse: field.type == 'random' ? true : false,
-                            ...field.indexOptions,
+                            sparse: isSparse,
+                            ...field.indexOptions,  // explicit overrides win
                         })
 
                     }
@@ -111,6 +123,22 @@ async function initializeOnDatabase(collections: Collection[]) {
                 if (specsFieldsIndexes.length) {
                     await db.collection(collection.slug).createIndexes(specsFieldsIndexes)
                 }
+
+                // Purge orphan indexes (fields removed from schema)
+                if (collection.purgeOrphanIndexes) {
+                    const expectedKeys = new Set(specsFieldsIndexes.map((idx) =>
+                        JSON.stringify(Object.keys(idx.key!).sort())
+                    ));
+                    const existingIndexes = await db.collection(collection.slug).listIndexes().toArray();
+                    for (const idx of existingIndexes) {
+                        if (idx.name === '_id_') continue; // built-in
+                        const idxKeys = JSON.stringify(Object.keys(idx.key!).sort());
+                        if (!expectedKeys.has(idxKeys)) {
+                            await db.collection(collection.slug).dropIndex(idx.name!);
+                            console.log(`🧹 Dropped orphan index: ${collection.slug}.${idx.name}`.gray);
+                        }
+                    }
+                }
             }
 
         } catch (err: any) {

package/database/decorator.ts

@@ -10,7 +10,7 @@ export function CheckIfCollectionExists(): any {
             return descriptor;
         }
         const originalMethod = descriptor.value;
-        descriptor.value = async function (...args: any[]) {
+        descriptor.value = async function (this: any, ...args: any[]) {
             let collection = args[0];
             let col = getCollection(collection, this.tenant_id)
             if (!col) {

package/database/mongodbadapter.ts

@@ -42,18 +42,22 @@ class MongoRest {
         if (options.session) {
             this.session = options.session;
         }
-        let tenant = getTenant(options?.tenant_id ?? '-')
-        if (options.tenant_id && tenant) {
+        // Resolve tenant: explicit tenant_id, else from request context
+        let tenantId = options.tenant_id;
+        if (!tenantId) {
+            tenantId = requestCtxStorage.get<string>('tenant_id');
+        }
+        let tenant = getTenant(tenantId ?? '-')
+        if (tenant) {
             this.#tenant = tenant;
             this.tenant_id = tenant.id;
             this.db = tenant.database.db as Db;
             this.client = tenant.database.client as MongoClient;
         }
-
     }
 
 
-    private _validate(options: { collection: string, action?: ActionsApiList, data?: any, update?: UpdateFilter<any> }) {
+    private _validate(options: { collection: string, action?: ActionsApiList, data?: any, update?: UpdateFilter<any> }): any {
         let col = getCollection(options.collection, this.#tenant.id)
         let schema = col?._schema_
         let partialSchema = col?._schemaPartial_
@@ -72,82 +76,81 @@ class MongoRest {
         })
 
 
-        //let unauthorizedKeys = func.unauthorizedKeys(options.data, getCollectionKeys(col))
-        /*  if (unauthorizedKeys.length > 0) {
-             throw new AppError(`Unauthorized keys in "${options.collection}" : ${unauthorizedKeys.join(', ')}`, {
-                 code: 'UNAUTHORIZED_KEYS',
-                 status: 400
-             })
-         } */
-
-
-
         if (schema && partialSchema) {
 
 
             if (options?.data) {
                 if (options.action == 'insertMany') {
-                    options.data.map(d => {
-                        validationResult = schema.validate(d, {
-                            allowUnknown: false,
-                        })
-                        if (validationResult && validationResult.error) {
+                    const sanitized: any[] = [];
+                    for (let i = 0; i < options.data.length; i++) {
+                        validationResult = schema.validate(options.data[i], { allowUnknown: false })
+                        if (validationResult?.error) {
                             throw new AppError(validationResult.error.message, {
                                 code: 'VALIDATION_ERROR',
                                 status: 400
                             })
                         }
-                    })
+                        sanitized.push(validationResult.value)
+                    }
+                    return sanitized;
                 }
 
                 if (options.action == 'insertOne') {
-                    validationResult = schema.validate(options.data, {
-                        allowUnknown: false,
-                    })
+                    validationResult = schema.validate(options.data, { allowUnknown: false })
+                    if (validationResult?.error) {
+                        throw new AppError(validationResult.error.message, {
+                            code: 'VALIDATION_ERROR',
+                            status: 400
+                        })
+                    }
+                    // Return sanitized value (Joi defaults applied, unknown keys handled)
+                    return validationResult.value;
                 }
             }
 
 
             if (options?.update) {
-                if (options.action == 'insertOne' && options.update?.$set) {
-                    validationResult = partialSchema.validate(options.update?.$set, {
-                        allowUnknown: false,
-                    })
-                }
-
-                if (options.action == 'insertMany' && options.update?.$set) {
-                    validationResult = partialSchema.validate(options.update?.$set, {
-                        allowUnknown: false,
-                    })
+                if ((options.action == 'insertOne' || options.action == 'insertMany') && options.update?.$set) {
+                    validationResult = partialSchema.validate(options.update.$set, { allowUnknown: false })
                 }
 
                 if (options.action == "findOneAndUpdate" && options.update.$set) {
-                    validationResult = partialSchema.validate(options.update.$set, {
-                        allowUnknown: false,
-                    })
+                    validationResult = partialSchema.validate(options.update.$set, { allowUnknown: false })
                 }
 
                 if (options.action == "findOneAndUpdate" && options.update.$setOnInsert) {
-                    validationResult = partialSchema.validate(options.update.$setOnInsert, {
-                        allowUnknown: false,
-                    })
+                    validationResult = partialSchema.validate(options.update.$setOnInsert, { allowUnknown: false })
                 }
-            }
 
-            if (validationResult?.error) {
-                throw new AppError(validationResult.error.message, {
-                    code: 'VALIDATION_ERROR',
-                    status: 400
-                })
+                // Faille 9: updateOne/updateMany — unflatten dot-notation ("address.zip") before Joi validation
+                if ((options.action == 'updateOne' || options.action == 'updateMany') && options.update?.$set) {
+                    const unflattened = func.unflattenKeys(options.update.$set)
+                    validationResult = partialSchema.validate(unflattened, { allowUnknown: false })
+                    if (validationResult?.error) {
+                        throw new AppError(validationResult.error.message, {
+                            code: 'VALIDATION_ERROR',
+                            status: 400
+                        })
+                    }
+                    // Write sanitized (nested) value back — MongoDB accepts nested objects
+                    if (validationResult.value) {
+                        options.update.$set = validationResult.value
+                    }
+                }
+
+                if (validationResult?.error) {
+                    throw new AppError(validationResult.error.message, {
+                        code: 'VALIDATION_ERROR',
+                        status: 400
+                    })
+                }
+                return validationResult?.value;
             }
 
         }
-
-
-
     }
 
-    private async #logActivity(data: {
+    async #logActivity(data: {
         action: string,
         collection: string,
         input?: any,
@@ -204,7 +207,7 @@ class MongoRest {
         await this.audit.addActivities([activity])
     }
 
-    private async #executeWithAudit<T>(
+    async #executeWithAudit<T>(
         action: string,
         collection: string,
         input: any,
@@ -269,7 +272,17 @@ class MongoRest {
         try {
 
             const col = getCollection(collection, this.#tenant.id) as Collection
-            const isSafe = func.isSafeAggregatePipeline(pipeline);
+            // Faille 12: restrict $lookup targets to this tenant's declared collections
+            const allowedCollections = [
+                ...(cfg.collections ?? [])
+                    .filter(c => c._tenant_ === this.tenant_id)
+                    .map(c => c.slug),
+                ...(cfg.fileCollections ?? [])
+                    .filter(fc => fc._tenant_ === this.tenant_id)
+                    .map(fc => fc.slug),
+                '_activities_', '_locks_', '_workflows_',
+            ];
+            const isSafe = func.isSafeAggregatePipeline(pipeline, allowedCollections);
             if (!isSafe.isSafe) {
                 throw isSafe.error;
             }
@@ -371,18 +384,19 @@ class MongoRest {
             data = await func.buildInput(data as T, {
                 action: action, col: col, rest: this
             })
-            this._validate({ collection, action: action, data: data })
 
             const meta: any = { action, collection, data }
             if (col.hooks?.beforeOperation) {
                 await col.hooks.beforeOperation({ rest: this, io, action, meta })
             }
+            // Validate AFTER hooks (they may fill required fields or apply Joi defaults)
+            meta.data = this._validate({ collection, action: action, data: meta.data })
 
-            await this.db.collection(collection).insertOne(func.toBson(data, { col }) as any, {
+            await this.db.collection(collection).insertOne(func.toBson(meta.data, { col }) as any, {
                 session: this.session,
             })
 
-            const result: T & { _id: string } = func.toJson(data as T & { _id: string })
+            const result: T & { _id: string } = func.toJson(meta.data as T & { _id: string })
             meta.result = result
             if (col?.hooks?.afterOperation) {
                 await col.hooks.afterOperation({ rest: this, io, action, meta })
@@ -409,18 +423,18 @@ class MongoRest {
                 dataInput.push(d)
             }
 
-            this._validate({ collection, action: action, data: dataInput })
-
             const meta: any = { action, collection, data: dataInput }
             if (col.hooks?.beforeOperation) {
                 await col.hooks.beforeOperation({ rest: this, io, action, meta })
             }
+            // Validate AFTER hooks (they may fill required fields or apply Joi defaults)
+            meta.data = this._validate({ collection, action: action, data: meta.data })
 
-            await this.db.collection(collection).insertMany(func.toBson(dataInput, { col }) as any, {
+            await this.db.collection(collection).insertMany(func.toBson(meta.data, { col }) as any, {
                 session: this.session,
             })
 
-            const result: (T & { _id: string })[] = func.toJson(dataInput as (T & { _id: string })[])
+            const result: (T & { _id: string })[] = func.toJson(meta.data as (T & { _id: string })[])
             meta.result = result
 
             if (col.hooks?.afterOperation) {
@@ -769,14 +783,14 @@ class MongoRest {
 
         const token = requestCtxStorage.get<{ value: string | null, decoded: Record<string, unknown> | null, provided: boolean, expired: boolean }>('token')
 
-        return await col.actions?.[action]({
+        return await col.actions?.[action]?.({
             rest: this,
-                    io,
+            io,
             data,
             error: fn.error,
             jwt: func.jwt,
-            token: token ?? { value: null, decoded: null },
-        })
+            token: token ?? { value: null, decoded: null, provided: false, expired: false },
+        } as any)
     }
 
     async runService<T = any>(service: string, action: string, data?: any): Promise<T> {
@@ -793,15 +807,14 @@ class MongoRest {
 
         const token = requestCtxStorage.get<{ value: string | null, decoded: Record<string, unknown> | null, provided: boolean, expired: boolean }>('token')
 
-        return await serviceInstance.actions?.[action]({
+        return await serviceInstance.actions?.[action]?.({
             data,
             error: fn.error,
             io,
             jwt: func.jwt,
             token: token ?? { value: null, decoded: null, provided: false, expired: false },
             rest: this,
-                    io,
-        })
+        } as any)
     }
 
     async stats() {
@@ -918,8 +931,8 @@ class MongoRest {
 
         try {
             const result = await this.db.collection('_locks_').findOneAndUpdate(
-                { _id: id, expiresAt: { $lt: now } },
-                { $set: { _id: id, tid: this.tenant_id, name, acquiredAt: now, expiresAt } },
+                { _id: id as any, expiresAt: { $lt: now } },
+                { $set: { tid: this.tenant_id, name, acquiredAt: now, expiresAt } },
                 { upsert: true, returnDocument: 'after' }
             );
             if (!result) {

package/lib/files.ts

@@ -53,7 +53,8 @@ export function createDiskStorage(baseDir?: string): FileStorage {
       const filename = `${meta.id}${ext}`;
       const filepath = path.join(dir, filename);
       const buffer = await file.arrayBuffer();
-      await fs.writeFile(filepath, new Uint8Array(buffer));
+      // Faille 17: 'wx' — fail if file already exists (no silent overwrite)
+      await fs.writeFile(filepath, new Uint8Array(buffer), { flag: 'wx' });
       const outPath = subpath ? `${subpath}/${filename}` : `${tenant_id}/${collection}/${filename}`;
       return { path: outPath, size: buffer.byteLength };
     },
@@ -146,6 +147,15 @@ async function transformImage(
   const format = options.format || 'webp';
   const quality = options.quality ?? 80;
 
+  // Faille 20: validate params (reject NaN / out-of-range)
+  if (!Number.isFinite(quality) || quality < 1 || quality > 100) {
+    throw new AppError('Invalid quality parameter', { code: 'INVALID_TRANSFORM', status: 400 });
+  }
+  if ((options.width != null && (!Number.isFinite(options.width) || options.width <= 0))
+    || (options.height != null && (!Number.isFinite(options.height) || options.height <= 0))) {
+    throw new AppError('Invalid width/height parameter', { code: 'INVALID_TRANSFORM', status: 400 });
+  }
+
   // Convertir ReadableStream en Uint8Array si nécessaire
   let buffer: Uint8Array;
   if (input instanceof Uint8Array) {
@@ -167,6 +177,12 @@ async function transformImage(
     }
   }
 
+  // Faille 20: only transform real images (magic bytes check)
+  const detected = detectMimeFromBuffer(buffer);
+  if (!detected || !detected.startsWith('image/')) {
+    throw new AppError('Not an image file', { code: 'NOT_AN_IMAGE', status: 400 });
+  }
+
   // Utiliser Bun.Image (natif, zéro dépendance)
   const img = new Bun.Image(buffer);
 
@@ -249,6 +265,28 @@ export async function handleUpload(options: UploadOptions): Promise<FileResult>
     });
   }
 
+  // Faille 4: validate magic bytes — don't trust client-declared Content-Type
+  const fullBuffer = new Uint8Array(await file.arrayBuffer());
+  const probe = fullBuffer.subarray(0, 4096);
+  const detected = detectMimeFromBuffer(probe);
+  const declaredMime = mimetype.toLowerCase();
+  const isImageDeclared = declaredMime.startsWith('image/');
+  const isImageDetected = detected?.startsWith('image/') ?? false;
+
+  // Reject content that lies about being an image (e.g. HTML/JS uploaded as image/png)
+  if (isImageDeclared && !isImageDetected) {
+    throw new AppError(`File content does not match declared MIME type '${mimetype}'`, {
+      code: 'MIMETYPE_MISMATCH', status: 400,
+    });
+  }
+
+  // Hardening: block SVG with embedded script (stored XSS)
+  if (detected === 'image/svg+xml' && svgContainsScript(probe)) {
+    throw new AppError('SVG with executable content is not allowed', {
+      code: 'SVG_SCRIPT_NOT_ALLOWED', status: 400,
+    });
+  }
+
   // Validate file size
   const maxSize = col.upload?.maxSize ?? 10 * 1024 * 1024; // 10MB default
   if (file.size > maxSize) {
@@ -358,20 +396,39 @@ export async function handleServe(
   fileId: string,
   filename: string,
   transform?: TransformOptions,
-): Promise<{ stream: ReadableStream; mimetype: string; size?: number } | null> {
+): Promise<{ stream: ReadableStream; mimetype: string; size?: number; attachment?: boolean } | null> {
   const storage = getStorageForCollection(collection, tenant_id);
   const col = getFileCollection(collection, tenant_id);
   const subpath = col?.storage?.path || undefined;
   const stream = await storage.getStream(tenant_id, collection, fileId, filename, subpath);
   if (!stream) return null;
 
-  let mimetype = getMimeType(filename);
+  // Faille 10: serve the MIME validated at upload time (content-checked),
+  // not re-derived from the extension.
+  let mimetype: string | undefined;
+  try {
+    const rest = new useRest({ tenant_id, internal: true, useHook: false, useCustomApi: false });
+    const doc = await rest.db.collection(collection).findOne(
+      { _id: (ObjectId.isValid(fileId) ? new ObjectId(fileId) : fileId) as any },
+      { projection: { '_file.mimetype': 1 } },
+    );
+    mimetype = (doc as any)?._file?.mimetype;
+  } catch {}
+
+  // Fallback: extension-derived MIME only when nothing stored
+  mimetype = mimetype || getMimeType(filename);
+  const isSvg = mimetype === 'image/svg+xml';
 
   if (transform && (transform.width || transform.height || transform.format)) {
     const { data, mimetype: newMime } = await transformImage(stream, transform);
     return { stream: new ReadableStream({ start(controller) { controller.enqueue(data); controller.close(); } }), mimetype: newMime, size: data.length };
   }
 
+  // Faille 4: SVG is served as an attachment (never inline) to prevent stored XSS
+  if (isSvg) {
+    return { stream, mimetype, attachment: true };
+  }
+
   return { stream, mimetype };
 }
 
@@ -389,6 +446,44 @@ function getMimeType(filename: string): string {
   return map[ext] || 'application/octet-stream';
 }
 
+/**
+ * Detect a file's real type from its magic bytes.
+ * Returns null when unknown. Used to prevent content spoofing (XSS via SVG etc).
+ */
+export function detectMimeFromBuffer(buf: Uint8Array): string | null {
+  const head = (offset: number, len: number) =>
+    String.fromCharCode(...buf.slice(offset, offset + len));
+  const hex = (offset: number, len: number) =>
+    Array.from(buf.slice(offset, offset + len)).map(b => b.toString(16).padStart(2, '0')).join('');
+
+  // JPEG: FF D8 FF
+  if (hex(0, 3) === 'ffd8ff') return 'image/jpeg';
+  // PNG: 89 50 4E 47
+  if (hex(0, 4) === '89504e47') return 'image/png';
+  // GIF: GIF87a / GIF89a
+  if (head(0, 4) === 'GIF8') return 'image/gif';
+  // WebP: RIFF....WEBP
+  if (head(0, 4) === 'RIFF' && head(8, 4) === 'WEBP') return 'image/webp';
+  // AVIF: ftypavif / ftypavis at offset 4
+  if (hex(4, 4) === '66747970' && (head(8, 4) === 'avif' || head(8, 4) === 'avis')) return 'image/avif';
+  // BMP: BM
+  if (head(0, 2) === 'BM') return 'image/bmp';
+  // PDF: %PDF
+  if (head(0, 4) === '%PDF') return 'application/pdf';
+  // ZIP (docx/xlsx/etc): PK\x03\x04
+  if (hex(0, 4) === '504b0304') return 'application/zip';
+  // SVG: XML declaration or <svg — MUST be served as attachment
+  const text = new TextDecoder().decode(buf.subarray(0, 2048));
+  if (/^\s*(<\?xml|<!DOCTYPE|<svg)/i.test(text)) return 'image/svg+xml';
+  return null;
+}
+
+/** True if the file content contains executable script (used for SVG hardening) */
+function svgContainsScript(buf: Uint8Array): boolean {
+  const text = new TextDecoder().decode(buf.subarray(0, 65536)); // first 64KB is enough
+  return /<script|onload\s*=|onerror\s*=|javascript:/i.test(text);
+}
+
 export async function handleDelete(
   tenant_id: string,
   collection: string,
@@ -403,7 +498,7 @@ export async function handleDelete(
   try {
     const rest = new useRest({ tenant_id, internal: true, useHook: false, useCustomApi: false });
     const doc = await rest.db.collection(collection).findOne(
-      { _id: ObjectId.isValid(fileId) ? new ObjectId(fileId) : fileId },
+      { _id: (ObjectId.isValid(fileId) ? new ObjectId(fileId) : fileId) as any },
       { projection: { '_file.filename': 1 } },
     );
     filename = doc?._file?.filename;
@@ -426,7 +521,7 @@ export async function handleDelete(
   try {
     const rest = new useRest({ tenant_id, internal: true, useHook: false, useCustomApi: false });
     await rest.db.collection(collection).deleteOne({
-      _id: ObjectId.isValid(fileId) ? new ObjectId(fileId) : fileId,
+      _id: (ObjectId.isValid(fileId) ? new ObjectId(fileId) : fileId) as any,
     });
   } catch (err: any) {
     console.error('Failed to delete file metadata:', err?.message || err);

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@anteros/core",
   "module": "index.ts",
-  "version": "0.0.18",
+  "version": "0.0.20",
   "type": "module",
   "description": "Anteros Core",
   "private": false,
@@ -21,7 +21,7 @@
     "bentocache": "1.6.1",
     "boxen": "^8.0.1",
     "dayjs": "1.11.21",
-    "hono": "4.13.0",
+    "hono": "^4.13.1",
     "ioredis": "6.0.0",
     "joi": "18.2.3",
     "jose": "6.2.8",

package/server/api.ts

@@ -1,4 +1,4 @@
-import type { Hono } from "hono"
+import type { Hono, Context } from "hono"
 import { cfg, safePublicConfig } from "./config";
 import type { ApiOptions } from "../types/api";
 import { getCollection } from "../database/collection";
@@ -244,11 +244,10 @@ function initializeApi(app: Hono<{ Variables: HonoVariables }>) {
     }
 
     // ─── Collection API ─────────────────────────────────────────────────
-    app.post(API_PREFIX, async (c) => {
+    app.post(API_PREFIX, async (c: Context<{ Variables: HonoVariables }>) => {
         let response: any;
         let body: any;
         let rest: InstanceType<typeof useRest>;
-        let canAccessToAction: boolean | undefined;
 
         try {
             const ContentType = c.req.header('Content-Type');
@@ -274,6 +273,9 @@ function initializeApi(app: Hono<{ Variables: HonoVariables }>) {
                 throw new AppError('Tenant `' + tenant_id + '` not found', { status: 400, code: 'TENANT_NOT_FOUND' });
             }
 
+            // Store tenant in request context so nested useRest() calls (hooks, actions) resolve it
+            requestCtxStorage.set('tenant_id', tenant_id);
+
             const col = getCollection(collection, tenant_id)
             if (!col) {
                 throw new AppError('Collection `' + collection + '` not found', { status: 400, code: 'COLLECTION_NOT_FOUND' });
@@ -344,27 +346,8 @@ function initializeApi(app: Hono<{ Variables: HonoVariables }>) {
             }
 
             // ── Access control ──
-            const access = col?.api?.access as Record<string, boolean | Function> | undefined;
-
-            if (access?.['*'] !== undefined && access?.[action] === undefined) {
-                if (typeof access['*'] === 'function') {
-                    canAccessToAction = await access['*']({ rest, error: fn.error, jwt: func.jwt, token: accessToken });
-                } else {
-                    canAccessToAction = access['*'] as boolean;
-                }
-                if (canAccessToAction !== true) throw new AppError('Access denied', { status: 401, code: 'ACCESS_DENIED' });
-            }
-
-            if (access?.[action] !== undefined) {
-                canAccessToAction = typeof access[action] === 'function'
-                    ? await (access[action] as Function)({ rest, error: fn.error, jwt: func.jwt, token: accessToken })
-                    : access[action] as boolean;
-                if (canAccessToAction !== true) throw new AppError('Access denied', { status: 401, code: 'ACCESS_DENIED' });
-            }
-
-            if (canAccessToAction !== true) {
-                throw new AppError('Unauthorized', { status: 401, code: 'ACCESS_DENIED_TO_PERFORM_THIS_ACTION' });
-            }
+            // Faille 7: single implementation via evaluateAccess (checks expired/forged tokens)
+            await evaluateAccess(col?.api?.access as any, action, rest, 'Action', c);
 
             // ── Execute action ──
             if (col.actions?.[action]) {
@@ -415,6 +398,7 @@ function initializeApi(app: Hono<{ Variables: HonoVariables }>) {
             const { service, tenant_id } = c.req.param() as { service: string, tenant_id: string };
             if (!tenant_id) throw new AppError('Tenant ID is required', { status: 400, code: 'TENANT_ID_REQUIRED' });
             if (!service) throw new AppError('Service is required', { status: 400, code: 'SERVICE_REQUIRED' });
+            requestCtxStorage.set('tenant_id', tenant_id);
 
             const serviceInstance = cfg.services?.find(s => s.name === service && s._tenant_ === tenant_id) as Service;
             const { action } = c.req.param() as { action: string };
@@ -457,6 +441,7 @@ function initializeApi(app: Hono<{ Variables: HonoVariables }>) {
             if (!cfg.tenants.find(t => t.id === tenant_id)) {
                 throw new AppError('Tenant `' + tenant_id + '` not found', { status: 400, code: 'TENANT_NOT_FOUND' });
             }
+            requestCtxStorage.set('tenant_id', tenant_id);
 
             const colUpload = getFileCollection(collection, tenant_id);
             if (!colUpload) {
@@ -469,6 +454,16 @@ function initializeApi(app: Hono<{ Variables: HonoVariables }>) {
                 throw new AppError('Content-Type must be multipart/form-data', { code: 'INVALID_CONTENT_TYPE', status: 400 });
             }
 
+            // Faille 11: reject oversized bodies BEFORE parseBody buffers them in memory
+            const contentLength = Number(c.req.header('Content-Length') ?? 0);
+            const maxUploadSize = colUpload.upload?.maxSize ?? 10 * 1024 * 1024; // 10MB default
+            // multipart overhead (boundaries/headers) ≈ 64KB max
+            if (Number.isFinite(contentLength) && contentLength > 0 && contentLength > maxUploadSize + 64 * 1024) {
+                throw new AppError(`Request too large (max ${Math.round(maxUploadSize / 1024 / 1024)}MB)`, {
+                    code: 'FILE_TOO_LARGE', status: 413,
+                });
+            }
+
             const formData = await c.req.parseBody();
             const fileField = formData['file'] || formData['upload'];
             if (!fileField || !(fileField instanceof File)) {
@@ -498,6 +493,7 @@ function initializeApi(app: Hono<{ Variables: HonoVariables }>) {
             if (!cfg.tenants.find(t => t.id === tenant_id)) {
                 throw new AppError('Tenant `' + tenant_id + '` not found', { status: 400, code: 'TENANT_NOT_FOUND' });
             }
+            requestCtxStorage.set('tenant_id', tenant_id);
 
             const colServe = getFileCollection(collection, tenant_id);
             if (!colServe) {
@@ -505,10 +501,12 @@ function initializeApi(app: Hono<{ Variables: HonoVariables }>) {
             }
             await checkFileAccess(colServe?.api?.access as any, 'read', tenant_id, c);
 
-            const filename = basename(c.req.param('file') as string);
-            if (!filename || filename.startsWith('.') || filename.includes('..') || filename.includes('/')) {
+            // Faille 18: validate the RAW path before basename (checks were dead code)
+            const rawFile = c.req.param('file') as string;
+            if (!rawFile || rawFile.startsWith('.') || rawFile.includes('..') || rawFile.includes('/') || rawFile.includes('\\')) {
                 throw new AppError('Invalid filename', { status: 400, code: 'INVALID_FILENAME' });
             }
+            const filename = basename(rawFile);
             const fileId = filename.replace(/\.[^.]+$/, '');
 
             const query = c.req.query();
@@ -529,6 +527,10 @@ function initializeApi(app: Hono<{ Variables: HonoVariables }>) {
             c.header('Content-Type', result.mimetype);
             if (result.size) c.header('Content-Length', String(result.size));
             c.header('Cache-Control', 'public, max-age=31536000, immutable');
+            // Faille 4: SVG served as attachment (no inline execution)
+            if (result.attachment) {
+                c.header('Content-Disposition', `attachment; filename="${filename}"`);
+            }
             return c.newResponse(result.stream);
         } catch (err: any) {
             if (cfg?.debug) console.error(err)
@@ -544,6 +546,7 @@ function initializeApi(app: Hono<{ Variables: HonoVariables }>) {
             if (!cfg.tenants.find(t => t.id === tenant_id)) {
                 throw new AppError('Tenant `' + tenant_id + '` not found', { status: 400, code: 'TENANT_NOT_FOUND' });
             }
+            requestCtxStorage.set('tenant_id', tenant_id);
 
             const colDelete = getFileCollection(collection, tenant_id);
             if (!colDelete) {
@@ -567,7 +570,8 @@ function initializeApi(app: Hono<{ Variables: HonoVariables }>) {
     // ─── Public config ──────────────────────────────────────────────────
     app.get('/_dnax/config/:tenant_id', (c) => {
         const t = c.get('token');
-        if (!t?.value) {
+        // Faille 6: require a VERIFIED, non-expired token (not just any provided value)
+        if (!t?.decoded || t?.expired || !t?.provided) {
             return c.json({ message: 'Authentication required', code: 'AUTH_REQUIRED' }, 401);
         }
         const { tenant_id } = c.req.param() as { tenant_id: string };

package/server/boot.ts

@@ -17,6 +17,20 @@ import { loadServices } from '../lib/services'
 import { loadSockets } from '../lib/sockets'
 import { syncWorkflows } from '../lib/workflow'
 import { loadTenantsMiddlewares } from '../lib/middleware'
+import crypto from 'node:crypto';
+
+/** Check if a TCP port is already bound */
+async function isPortInUse(port: number): Promise<boolean> {
+    try {
+        const proc = Bun.spawn(['lsof', '-ti', `:${port}`], { stdout: 'pipe' });
+        const output = await new Response(proc.stdout).text();
+        await proc.exited;
+        return output.trim().length > 0;
+    } catch {
+        return false;
+    }
+}
+
 type BootAppOptions = ServerConfig & {
 
 }
@@ -38,17 +52,50 @@ async function bootApp(options: BootAppOptions = {} as BootAppOptions) {
         //******************************* */
 
 
+        // JWT_SECRET check: auto-generate if missing and auth is enabled
+        const hasAuth = cfg.collections?.some((c: any) => c.api?.auth?.enabled);
+        let jwtSecret = cfg.server.jwt?.secret || Bun.env.JWT_SECRET;
+        if (hasAuth && !jwtSecret) {
+            // CSPRNG: crypto.randomBytes (not Math.random — predictable)
+            jwtSecret = crypto.randomBytes(48).toString('base64url');
+            try {
+                const envPath = '.env';
+                const exists = await Bun.file(envPath).exists();
+                const content = exists ? await Bun.file(envPath).text() : '';
+                if (!content.includes('JWT_SECRET=')) {
+                    const suffix = content ? '\n' : '';
+                    await Bun.write(envPath, `${content}${suffix}# Auto-generated on boot\nJWT_SECRET=${jwtSecret}\n`);
+                }
+                Bun.env.JWT_SECRET = jwtSecret;
+                console.log('🔐 JWT_SECRET auto-generated and saved to .env'.gray);
+            } catch {
+                Bun.env.JWT_SECRET = jwtSecret;
+                console.log('⚠ JWT_SECRET auto-generated (in-memory only, could not write .env)'.yellow);
+            }
+        }
+
         const PORT = (cfg.server.port || 4000);
         const NAME = cfg.server.name || process.env.APP_NAME || 'SERVER';
         const useClusterMode = cfg.clusterMode || false;
         const env = process.env.NODE_ENV || Bun.env.NODE_ENV || 'dev';
+        // reusePort: cluster mode ON by default, dev mode OFF to detect zombies
+        const reusePort = cfg.server.reusePort ?? (useClusterMode && env !== 'dev');
+
+        // Detect zombie: check if port is already in use in dev mode
+        if (!reusePort && env === 'dev') {
+            const occupied = await isPortInUse(PORT);
+            if (occupied) {
+                console.error(`\n⚠ Port ${PORT} is already in use. Possible zombie server.\n  → Kill it: lsof -ti :${PORT} | xargs kill -9\n  → Or set server.reusePort: true in config\n`.red.bold);
+                process.exit(1);
+            }
+        }
 
 
         const app = createApp();
 
         const server = Bun.serve({
             port: PORT,
-            reusePort: useClusterMode,
+            reusePort,
             fetch: (req, server) => {
                 const url = new URL(req.url);
 

package/server/hono.ts

@@ -114,11 +114,15 @@ function createApp(): Hono<{ Variables: HonoVariables }> {
 
 
 
+            const requestCtx: Record<string, string> = c.req.header();
+            // Faille 1: never log sensitive headers (JWT, cookies)
+            delete requestCtx.authorization;
+            delete requestCtx.cookie;
             requestCtxStorage.set('meta', {
                 request: {
                     ip: connInfo.remote.address ?? c.req.header('CF-Connecting-IP') ?? c.req.header('True-Client-IP') ?? c.req.header('X-Forwarded-For') ?? 'unknown',
                     user_agent: c.req.header('User-Agent') ?? '',
-                    headers: c.req.header(),
+                    headers: requestCtx,
                     method: c.req.method,
                     path: c.req.path,
                     query: c.req.query(),
@@ -129,15 +133,14 @@ function createApp(): Hono<{ Variables: HonoVariables }> {
             })
             const bearer = c.req.header('Authorization')?.replace('Bearer ', '');
             if (bearer) {
-                const { value, error } = await jwt.verify(bearer);
+                const { value, error, expired } = await jwt.verify(bearer);
                 const isValid = !error && value != null;
-                const isExpired = !!error && error.toLowerCase().includes('exp');
 
                 const tokenData = {
-                    value: bearer,
+                    value: isValid ? bearer : null,
                     decoded: isValid ? (value as Record<string, unknown>) : null,
                     provided: true,
-                    expired: isExpired || (value != null && typeof (value as any)?.exp === 'number' && (value as any).exp * 1000 < Date.now()),
+                    expired: expired || (value != null && typeof (value as any)?.exp === 'number' && (value as any).exp * 1000 < Date.now()),
                 };
 
                 requestCtxStorage.set('token', tokenData);

package/tests/api.test.ts

@@ -11,6 +11,7 @@ let rest: InstanceType<typeof useRest>;
 
 beforeAll(async () => {
     formatConfig({
+        server: { port: 4000 },
         tenants: [{ id: TEST_TENANT, dir: "src", database: { uri: TEST_DB } }],
     });
     await syncTenants();
@@ -45,7 +46,7 @@ describe("insertOne", () => {
         expect(doc._id.length).toBe(24);
     });
     it("sets createdAt and updatedAt", async () => {
-        const doc = await rest.insertOne("items", { title: "ts" });
+        const doc: any = await rest.insertOne("items", { title: "ts" });
         expect(doc.createdAt).toBeString();
         expect(doc.updatedAt).toBeString();
     });
@@ -84,8 +85,8 @@ describe("findOne", () => {
 
 describe("updateOne", () => {
     it("$set title and changes updatedAt", async () => {
-        const doc = await rest.insertOne("items", { title: "old" });
-        const upd = await rest.updateOne("items", doc._id, { $set: { title: "new" } });
+        const doc: any = await rest.insertOne("items", { title: "old" });
+        const upd: any = await rest.updateOne("items", doc._id, { $set: { title: "new" } });
         expect(upd.title).toBe("new");
         expect(upd.updatedAt).not.toBe(doc.updatedAt);
     });
@@ -93,17 +94,18 @@ describe("updateOne", () => {
 
 describe("deleteOne", () => {
     it("deletes and returns _id", async () => {
-        const doc = await rest.insertOne("items", { title: "del-me" });
-        expect((await rest.deleteOne("items", doc._id))._id).toBe(doc._id);
+        const doc: any = await rest.insertOne("items", { title: "del-me" });
+        const deleted: any = await rest.deleteOne("items", doc._id);
+        expect(deleted?._id).toBe(doc._id);
     });
 });
 
 describe("insertMany", () => {
     it("inserts and returns array with _id", async () => {
-        const docs = await rest.insertMany("items", [{ title: "m1" }, { title: "m2" }]);
+        const docs: any[] = await rest.insertMany("items", [{ title: "m1" }, { title: "m2" }]);
         expect(docs.length).toBe(2);
-        expect(docs[0]._id).toBeString();
-        expect(docs[1]._id).toBeString();
+        expect(docs[0]!._id).toBeString();
+        expect(docs[1]!._id).toBeString();
     });
 });
 
@@ -173,7 +175,7 @@ describe("bulkUpdate", () => {
 
 describe("stats", () => {
     it("returns collection stats", async () => {
-        const s = await rest.stats("items");
+        const s: any = await rest.stats();
         expect(s).toBeDefined();
         expect(typeof s).toBe("object");
     });
@@ -184,7 +186,7 @@ describe("audit", () => {
         await rest.audit.addActivities([{
             internal: false,
             trace: { id: crypto.randomUUID() },
-            request: null,
+            request: undefined,
             meta: {},
             operation: {
                 tenant: TEST_TENANT,
@@ -199,7 +201,7 @@ describe("audit", () => {
             },
             ts: new Date(),
         }]);
-        const activities = await rest.audit.getActivities({ $limit: 10 });
+        const activities = await rest.audit.getActivities({ $match: {}, $limit: 10 });
         expect(Array.isArray(activities)).toBe(true);
         expect(activities.length).toBeGreaterThanOrEqual(1);
     });
@@ -266,7 +268,7 @@ describe("transactions", () => {
 
 describe("watch", () => {
     it("returns a change stream", async () => {
-        const stream = await rest.watch("items", [{ $match: { operationType: "insert" } }]);
+        const stream = await rest.watch("items", [{ $match: { operationType: "insert" } }], {} as any);
         expect(stream).toBeDefined();
         await stream.close();
     });

package/tests/ts1011-test.ts

@@ -0,0 +1,15 @@
+import type { Document, ChangeStreamOptions, ChangeStream } from "mongodb";
+
+export class Test {
+  #tenant!: { id: string };
+  @Check()
+  async watch(collection: string, pipeline: any[], options: ChangeStreamOptions): Promise<ChangeStream> {
+    return undefined as any;
+  }
+  @Check()
+  async find(collection: string, params: any = {}, options = {}): Promise<Document[]> {
+    return [];
+  }
+}
+
+function Check() { return (target: any, key: string) => {} }

package/types/api.d.ts

@@ -32,6 +32,17 @@ export type ActionsApiList =
     | "login"
     | "logout"
     | "aggregate"
+    | "watch"
+    | "countDocuments"
+    | "bulkWrite"
+    | "bulkUpdate"
+    | "replaceOne"
+    | "findOneAndUpdate"
+    | "dropCollection"
+    | "dropIndex"
+    | "dropIndexes"
+    | "stats"
+    | "workflows"
     | "*"
 
 

package/types/collection.d.ts

@@ -70,6 +70,8 @@ export type Collection = {
      */
     _tenant_?: string;
     _isTimeSerie_?: boolean;
+    /** Drop MongoDB indexes for fields no longer in the schema (default: false) */
+    purgeOrphanIndexes?: boolean;
     _isCollection_?: boolean;
     _schema_?: Joi.Schema;
     _schemaPartial_?: Joi.Schema;

package/types/config.d.ts

@@ -13,6 +13,7 @@ export type ServerConfig = {
     server: {
         name?: string;
         port: number;
+        reusePort?: boolean;  // override Bun's reusePort (default: clusterMode && not dev)
         body?: {
             maxSize?: number;
         };

package/utils/func.ts

@@ -36,7 +36,7 @@ const jwt = {
         const token = await signer.sign(secret);
         return token;
     },
-    verify: async (token: string): Promise<{ value: Record<string, unknown> | null, error: string | null }> => {
+    verify: async (token: string): Promise<{ value: Record<string, unknown> | null, error: string | null, expired: boolean }> => {
         try {
             if (!token) throw new Error('Token is required');
             let SECRET_ = cfg.server.jwt?.secret || Bun.env.JWT_SECRET
@@ -45,12 +45,17 @@ const jwt = {
             const { payload, protectedHeader } = await Jose.jwtVerify(token, secret);
             return {
                 value: payload,
-                error: null
+                error: null,
+                expired: false,
             }
-        } catch (error) {
+        } catch (error: any) {
+            // Reliable expiry detection via jose error code (not string matching)
+            const isExpired = error?.code === 'ERR_JWT_EXPIRED'
+                || /expired|expiration/i.test(error?.message ?? '');
             return {
                 value: null,
-                error: error instanceof Error ? error.message : 'Invalid token'
+                error: error instanceof Error ? error.message : 'Invalid token',
+                expired: isExpired,
             }
         }
     }
@@ -152,6 +157,48 @@ function pick<T extends DeepRecord>(data: T | T[], keys: string[]): Partial<T> |
     return result as Partial<T>;
 }
 
+/**
+ * Convertit la dot-notation MongoDB en structure imbriquée pour la validation Joi.
+ * Ex: { "address.zip": "BP28", "items.0.name": "x" } → { address: { zip }, items: [{ name }] }
+ * Les clés opérateurs ($inc, $push…) sont laissées telles quelles.
+ */
+function unflattenKeys(input: Record<string, unknown>): Record<string, unknown> {
+    const result: Record<string, unknown> = {};
+    for (const [key, value] of Object.entries(input)) {
+        // Opérateurs Mongo → laisser tel quel (interdits dans $set de toute façon)
+        if (key.startsWith('$')) {
+            result[key] = value;
+            continue;
+        }
+        const parts = key.split('.');
+        let target: any = result;
+        for (let i = 0; i < parts.length - 1; i++) {
+            const part = parts[i]!;
+            const nextPart = parts[i + 1]!;
+            const isArrayIndex = /^\d+$/.test(nextPart);
+            if (typeof target[part] !== 'object' || target[part] === null) {
+                target[part] = isArrayIndex ? [] : {};
+            }
+            target = target[part];
+        }
+        const last = parts[parts.length - 1]!;
+        // Fusion si les deux côtés sont des objets (ex. "a.b" + a: { c })
+        if (
+            target[last] &&
+            typeof target[last] === 'object' &&
+            !Array.isArray(target[last]) &&
+            typeof value === 'object' &&
+            value !== null &&
+            !Array.isArray(value)
+        ) {
+            target[last] = { ...(target[last] as object), ...(value as object) };
+        } else {
+            target[last] = value;
+        }
+    }
+    return result;
+}
+
 function toJson<T>(data: any): T {
     if (data === null || data === undefined) return data;
     try {
@@ -372,7 +419,10 @@ function formatToObjectId<T>(value: T): FormatToObjectIdResult<T> {
         return value as FormatToObjectIdResult<T>;
     }
 
-
+    // Pass through primitives and Date instances untouched
+    if (value instanceof Date) {
+        return value as FormatToObjectIdResult<T>;
+    }
 
     if (typeof value === 'string') {
 
@@ -608,7 +658,15 @@ function collectDateFieldPathsFromCollection(col: Collection): string[] {
 
 function toBson<T>(data: any | any[], _options?: FormatInputOptions): T {
     let data_ = formatToObjectId(data);
-    data_ = formatToDate(data_);
+
+    // Build omitKeys for fields that should NOT be date-converted (random, number, integer)
+    const omitKeys: string[] = [];
+    for (const f of _options?.col?.fields ?? []) {
+        if (f.type === 'random' || f.type === 'number' || f.type === 'integer') {
+            omitKeys.push(f.name);
+        }
+    }
+    data_ = formatToDate(data_, { omitKeys: omitKeys.length > 0 ? omitKeys : undefined });
 
     if (Array.isArray(data)) {
         data.length = 0;
@@ -634,12 +692,34 @@ function buildPipeline(p: FindOptions, options?: {
                 status: 400
             });
         }
+        // Faille 13: bound $regex (ReDoS) and $in/$nin (memory DoS)
+        boundMatchOperators(p.$match);
         pipeline.push({
             $match: p.$match
         })
     }
 
-    // $sort
+    // $sort — Faille 14: values must be 1 or -1
+    if (p?.$sort) {
+        for (const [key, dir] of Object.entries(p.$sort)) {
+            if (dir !== 1 && dir !== -1) {
+                throw new AppError(`Invalid $sort direction for '${key}' (expected 1 or -1)`, {
+                    code: 'INVALID_SORT_DIRECTION',
+                    status: 400
+                });
+            }
+        }
+    }
+
+    // $skip — Faille 14: must be a safe non-negative integer
+    if (p?.$skip !== undefined && p?.$skip !== null) {
+        if (!Number.isSafeInteger(p.$skip) || p.$skip < 0) {
+            throw new AppError('Invalid $skip (expected a non-negative integer)', {
+                code: 'INVALID_SKIP',
+                status: 400
+            });
+        }
+    }
     if (!p?.$sort?.createdAt) {
         pipeline.push({
             $sort: {
@@ -653,20 +733,25 @@ function buildPipeline(p: FindOptions, options?: {
         })
     }
 
-    // $skip
+    // $skip (validated above)
     if (p?.$skip) {
         pipeline.push({
             $skip: p.$skip
         })
     }
 
-    // $limit
+    // $limit — Faille 14: must be a safe integer in (0, MAX_LIMIT]; 0 would mean "no limit"
+    const MAX_LIMIT = 1000;
     p.$limit = p?.$limit ?? 100
-    if (p?.$limit > 0) {
-        pipeline.push({
-            $limit: p.$limit
-        })
+    if (!Number.isSafeInteger(p.$limit) || p.$limit <= 0 || p.$limit > MAX_LIMIT) {
+        throw new AppError(`Invalid $limit (expected an integer between 1 and ${MAX_LIMIT})`, {
+            code: 'INVALID_LIMIT',
+            status: 400
+        });
     }
+    pipeline.push({
+        $limit: p.$limit
+    })
 
     // $include
     if (p?.$include && Array.isArray(p?.$include)) {
@@ -731,6 +816,17 @@ function buildPipeline(p: FindOptions, options?: {
 
                 let as = include.as || include.localField
 
+                // Faille 3: never trust client-supplied $lookup sub-pipeline — scan it
+                if (include.pipeline && Array.isArray(include.pipeline)) {
+                    const check = isSafeAggregatePipeline(include.pipeline as Array<Record<string, unknown>>)
+                    if (!check.isSafe) {
+                        throw check.error ?? new AppError('Unauthorized $include pipeline', {
+                            code: 'UNAUTHORIZED_PIPELINE_KEYS',
+                            status: 400
+                        })
+                    }
+                }
+
                 pipeline.push({
                     $lookup: {
                         from: include.from,
@@ -796,6 +892,46 @@ function clone<T>(data: T): T {
     return data_
 }
 
+/**
+ * Faille 13: bounds dangerous $match operators to prevent ReDoS ($regex) and memory DoS ($in).
+ * Walks nested objects/arrays ($and, $or, $nor, dotted fields).
+ */
+const MAX_REGEX_LENGTH = 1000;
+const MAX_IN_ARRAY_SIZE = 10000;
+
+function boundMatchOperators(node: unknown): void {
+    if (node === null || node === undefined) return;
+
+    if (Array.isArray(node)) {
+        for (const item of node) {
+            boundMatchOperators(item);
+        }
+        return;
+    }
+
+    if (typeof node === 'object') {
+        const obj = node as Record<string, unknown>;
+        for (const [key, value] of Object.entries(obj)) {
+            if (key === '$regex' && typeof value === 'string') {
+                if (value.length > MAX_REGEX_LENGTH) {
+                    throw new AppError(`$regex pattern too long (max ${MAX_REGEX_LENGTH} chars)`, {
+                        code: 'REGEX_TOO_LONG',
+                        status: 400
+                    });
+                }
+            } else if ((key === '$in' || key === '$nin') && Array.isArray(value)) {
+                if (value.length > MAX_IN_ARRAY_SIZE) {
+                    throw new AppError(`$in/$nin too large (max ${MAX_IN_ARRAY_SIZE} items)`, {
+                        code: 'ARRAY_OPERATOR_TOO_LARGE',
+                        status: 400
+                    });
+                }
+            }
+            boundMatchOperators(value);
+        }
+    }
+}
+
 
 
 
@@ -996,14 +1132,18 @@ function countAggregatePipelineStages(pipeline: unknown): number {
 }
 
 
-function isSafeAggregatePipeline(pipeline: Array<Record<string, unknown>>): {
+function isSafeAggregatePipeline(pipeline: Array<Record<string, unknown>>, allowedCollections?: string[]): {
     isSafe: boolean;
     forbiddenKeys: string[];
     error: AppError | null;
 } {
 
-    // Unauthorized pipeline keys
-    const UNAUTHORIZED_PIPELINE_KEYS = ['$out', '$merge', '$function', '$where', '$accumulator'];
+    // Unauthorized pipeline keys — Faille 12: include cross-collection exfiltration stages
+    const UNAUTHORIZED_PIPELINE_KEYS = [
+        '$out', '$merge', '$function', '$where', '$accumulator',
+        '$unionWith', '$collStats', '$indexStats', '$planCacheStats',
+        '$currentOp', '$listLocalSessions', '$listSessions', '$changeStream',
+    ];
     const forbiddenFound = hasUnauthorizedKeys(pipeline, UNAUTHORIZED_PIPELINE_KEYS);
     if (forbiddenFound.length > 0) {
         return {
@@ -1013,6 +1153,28 @@ function isSafeAggregatePipeline(pipeline: Array<Record<string, unknown>>): {
         }
     }
 
+    // Faille 12: restrict $lookup / $graphLookup targets to declared tenant collections
+    if (allowedCollections && allowedCollections.length > 0) {
+        const badTargets: string[] = [];
+        walkAggregatePipeline(pipeline, (stage) => {
+            const lookup = (stage as any).$lookup;
+            if (lookup?.from && !allowedCollections.includes(lookup.from)) {
+                badTargets.push(lookup.from);
+            }
+            const graph = (stage as any).$graphLookup;
+            if (graph?.from && !allowedCollections.includes(graph.from)) {
+                badTargets.push(graph.from);
+            }
+        });
+        if (badTargets.length > 0) {
+            return {
+                isSafe: false,
+                forbiddenKeys: badTargets,
+                error: new AppError('Unauthorized $lookup target collection: ' + [...new Set(badTargets)].join(', '), { code: 'UNAUTHORIZED_LOOKUP_TARGET', status: 400 })
+            };
+        }
+    }
+
     // $project avec renommage : racine + imbriqué ($facet, $lookup.pipeline, …)
     let renameForbiddenKeys: string[] = [];
     let renameError: AppError | null = null;
@@ -1055,6 +1217,7 @@ export {
     reorder,
     omit,
     pick,
+    unflattenKeys,
     toJson,
     stringToBoolean,
     cleanDeep,