@classytic/mongokit 2.0.0 → 2.1.0

package/dist/utils/index.js

@@ -0,0 +1,643 @@
+import mongoose2 from 'mongoose';
+
+// src/utils/field-selection.ts
+function getFieldsForUser(user, preset) {
+  if (!preset) {
+    throw new Error("Field preset is required");
+  }
+  const fields = [...preset.public || []];
+  if (user) {
+    fields.push(...preset.authenticated || []);
+    const roles = Array.isArray(user.roles) ? user.roles : user.roles ? [user.roles] : [];
+    if (roles.includes("admin") || roles.includes("superadmin")) {
+      fields.push(...preset.admin || []);
+    }
+  }
+  return [...new Set(fields)];
+}
+function getMongooseProjection(user, preset) {
+  const fields = getFieldsForUser(user, preset);
+  return fields.join(" ");
+}
+function filterObject(obj, allowedFields) {
+  if (!obj || typeof obj !== "object" || Array.isArray(obj)) {
+    return obj;
+  }
+  const filtered = {};
+  for (const field of allowedFields) {
+    if (field in obj) {
+      filtered[field] = obj[field];
+    }
+  }
+  return filtered;
+}
+function filterResponseData(data, preset, user = null) {
+  const allowedFields = getFieldsForUser(user, preset);
+  if (Array.isArray(data)) {
+    return data.map((item) => filterObject(item, allowedFields));
+  }
+  return filterObject(data, allowedFields);
+}
+function createFieldPreset(config) {
+  return {
+    public: config.public || [],
+    authenticated: config.authenticated || [],
+    admin: config.admin || []
+  };
+}
+var QueryParser = class {
+  operators = {
+    eq: "$eq",
+    ne: "$ne",
+    gt: "$gt",
+    gte: "$gte",
+    lt: "$lt",
+    lte: "$lte",
+    in: "$in",
+    nin: "$nin",
+    like: "$regex",
+    contains: "$regex",
+    regex: "$regex",
+    exists: "$exists",
+    size: "$size",
+    type: "$type"
+  };
+  /**
+   * Dangerous MongoDB operators that should never be accepted from user input
+   * Security: Prevent NoSQL injection attacks
+   */
+  dangerousOperators = ["$where", "$function", "$accumulator", "$expr"];
+  /**
+   * Parse query parameters into MongoDB query format
+   */
+  parseQuery(query) {
+    const {
+      page,
+      limit = 20,
+      sort = "-createdAt",
+      populate,
+      search,
+      after,
+      cursor,
+      ...filters
+    } = query || {};
+    const parsed = {
+      filters: this._parseFilters(filters),
+      limit: parseInt(String(limit), 10),
+      sort: this._parseSort(sort),
+      populate,
+      search
+    };
+    if (after || cursor) {
+      parsed.after = after || cursor;
+    } else if (page !== void 0) {
+      parsed.page = parseInt(String(page), 10);
+    } else {
+      parsed.page = 1;
+    }
+    const orGroup = this._parseOr(query);
+    if (orGroup) {
+      parsed.filters = { ...parsed.filters, $or: orGroup };
+    }
+    parsed.filters = this._enhanceWithBetween(parsed.filters);
+    return parsed;
+  }
+  /**
+   * Parse sort parameter
+   * Converts string like '-createdAt' to { createdAt: -1 }
+   * Handles multiple sorts: '-createdAt,name' → { createdAt: -1, name: 1 }
+   */
+  _parseSort(sort) {
+    if (!sort) return void 0;
+    if (typeof sort === "object") return sort;
+    const sortObj = {};
+    const fields = sort.split(",").map((s) => s.trim());
+    for (const field of fields) {
+      if (field.startsWith("-")) {
+        sortObj[field.substring(1)] = -1;
+      } else {
+        sortObj[field] = 1;
+      }
+    }
+    return sortObj;
+  }
+  /**
+   * Parse standard filter parameter (filter[field]=value)
+   */
+  _parseFilters(filters) {
+    const parsedFilters = {};
+    for (const [key, value] of Object.entries(filters)) {
+      if (this.dangerousOperators.includes(key) || key.startsWith("$") && !["$or", "$and"].includes(key)) {
+        console.warn(`[mongokit] Blocked dangerous operator: ${key}`);
+        continue;
+      }
+      if (["page", "limit", "sort", "populate", "search", "select", "lean", "includeDeleted"].includes(key)) {
+        continue;
+      }
+      const operatorMatch = key.match(/^(.+)\[(.+)\]$/);
+      if (operatorMatch) {
+        const [, , operator] = operatorMatch;
+        if (this.dangerousOperators.includes("$" + operator)) {
+          console.warn(`[mongokit] Blocked dangerous operator: ${operator}`);
+          continue;
+        }
+        this._handleOperatorSyntax(parsedFilters, {}, operatorMatch, value);
+        continue;
+      }
+      if (typeof value === "object" && value !== null && !Array.isArray(value)) {
+        this._handleBracketSyntax(key, value, parsedFilters);
+      } else {
+        parsedFilters[key] = this._convertValue(value);
+      }
+    }
+    return parsedFilters;
+  }
+  /**
+   * Handle operator syntax: field[operator]=value
+   */
+  _handleOperatorSyntax(filters, regexFields, operatorMatch, value) {
+    const [, field, operator] = operatorMatch;
+    if (operator.toLowerCase() === "options" && regexFields[field]) {
+      const fieldValue = filters[field];
+      if (typeof fieldValue === "object" && fieldValue !== null && "$regex" in fieldValue) {
+        fieldValue.$options = value;
+      }
+      return;
+    }
+    if (operator.toLowerCase() === "contains" || operator.toLowerCase() === "like") {
+      filters[field] = { $regex: new RegExp(String(value), "i") };
+      regexFields[field] = true;
+      return;
+    }
+    const mongoOperator = this._toMongoOperator(operator);
+    if (this.dangerousOperators.includes(mongoOperator)) {
+      console.warn(`[mongokit] Blocked dangerous operator in field[${operator}]: ${mongoOperator}`);
+      return;
+    }
+    if (mongoOperator === "$eq") {
+      filters[field] = value;
+    } else if (mongoOperator === "$regex") {
+      filters[field] = { $regex: value };
+      regexFields[field] = true;
+    } else {
+      if (typeof filters[field] !== "object" || filters[field] === null || Array.isArray(filters[field])) {
+        filters[field] = {};
+      }
+      let processedValue;
+      const op = operator.toLowerCase();
+      if (["gt", "gte", "lt", "lte", "size"].includes(op)) {
+        processedValue = parseFloat(String(value));
+        if (isNaN(processedValue)) return;
+      } else if (op === "in" || op === "nin") {
+        processedValue = Array.isArray(value) ? value : String(value).split(",").map((v) => v.trim());
+      } else {
+        processedValue = this._convertValue(value);
+      }
+      filters[field][mongoOperator] = processedValue;
+    }
+  }
+  /**
+   * Handle bracket syntax with object value
+   */
+  _handleBracketSyntax(field, operators, parsedFilters) {
+    if (!parsedFilters[field]) {
+      parsedFilters[field] = {};
+    }
+    for (const [operator, value] of Object.entries(operators)) {
+      if (operator === "between") {
+        parsedFilters[field].between = value;
+        continue;
+      }
+      if (this.operators[operator]) {
+        const mongoOperator = this.operators[operator];
+        let processedValue;
+        if (["gt", "gte", "lt", "lte", "size"].includes(operator)) {
+          processedValue = parseFloat(String(value));
+          if (isNaN(processedValue)) continue;
+        } else if (operator === "in" || operator === "nin") {
+          processedValue = Array.isArray(value) ? value : String(value).split(",").map((v) => v.trim());
+        } else if (operator === "like" || operator === "contains") {
+          processedValue = value !== void 0 && value !== null ? new RegExp(String(value), "i") : /.*/;
+        } else {
+          processedValue = this._convertValue(value);
+        }
+        parsedFilters[field][mongoOperator] = processedValue;
+      }
+    }
+  }
+  /**
+   * Convert operator to MongoDB format
+   */
+  _toMongoOperator(operator) {
+    const op = operator.toLowerCase();
+    return op.startsWith("$") ? op : "$" + op;
+  }
+  /**
+   * Convert values based on operator type
+   */
+  _convertValue(value) {
+    if (value === null || value === void 0) return value;
+    if (Array.isArray(value)) return value.map((v) => this._convertValue(v));
+    if (typeof value === "object") return value;
+    const stringValue = String(value);
+    if (stringValue === "true") return true;
+    if (stringValue === "false") return false;
+    if (mongoose2.Types.ObjectId.isValid(stringValue) && stringValue.length === 24) {
+      return stringValue;
+    }
+    return stringValue;
+  }
+  /**
+   * Parse $or conditions
+   */
+  _parseOr(query) {
+    const orArray = [];
+    const raw = query?.or || query?.OR || query?.$or;
+    if (!raw) return void 0;
+    const items = Array.isArray(raw) ? raw : typeof raw === "object" ? Object.values(raw) : [];
+    for (const item of items) {
+      if (typeof item === "object" && item) {
+        orArray.push(this._parseFilters(item));
+      }
+    }
+    return orArray.length ? orArray : void 0;
+  }
+  /**
+   * Enhance filters with between operator
+   */
+  _enhanceWithBetween(filters) {
+    const output = { ...filters };
+    for (const [key, value] of Object.entries(filters || {})) {
+      if (value && typeof value === "object" && "between" in value) {
+        const between = value.between;
+        const [from, to] = String(between).split(",").map((s) => s.trim());
+        const fromDate = from ? new Date(from) : void 0;
+        const toDate = to ? new Date(to) : void 0;
+        const range = {};
+        if (fromDate && !isNaN(fromDate.getTime())) range.$gte = fromDate;
+        if (toDate && !isNaN(toDate.getTime())) range.$lte = toDate;
+        output[key] = range;
+      }
+    }
+    return output;
+  }
+};
+var queryParser_default = new QueryParser();
+function isMongooseSchema(value) {
+  return value instanceof mongoose2.Schema;
+}
+function isPlainObject(value) {
+  return Object.prototype.toString.call(value) === "[object Object]";
+}
+function isObjectIdType(t) {
+  return t === mongoose2.Schema.Types.ObjectId || t === mongoose2.Types.ObjectId;
+}
+function buildCrudSchemasFromMongooseSchema(mongooseSchema, options = {}) {
+  const tree = mongooseSchema?.obj || {};
+  const jsonCreate = buildJsonSchemaForCreate(tree, options);
+  const jsonUpdate = buildJsonSchemaForUpdate(jsonCreate, options);
+  const jsonParams = {
+    type: "object",
+    properties: { id: { type: "string", pattern: "^[0-9a-fA-F]{24}$" } },
+    required: ["id"]
+  };
+  const jsonQuery = buildJsonSchemaForQuery(tree, options);
+  const crudSchemas = {
+    create: { body: jsonCreate },
+    update: { body: jsonUpdate, params: jsonParams },
+    get: { params: jsonParams },
+    list: { query: jsonQuery },
+    remove: { params: jsonParams }
+  };
+  return { createBody: jsonCreate, updateBody: jsonUpdate, params: jsonParams, listQuery: jsonQuery, crudSchemas };
+}
+function buildCrudSchemasFromModel(mongooseModel, options = {}) {
+  if (!mongooseModel || !mongooseModel.schema) {
+    throw new Error("Invalid mongoose model");
+  }
+  return buildCrudSchemasFromMongooseSchema(mongooseModel.schema, options);
+}
+function getImmutableFields(options = {}) {
+  const immutable = [];
+  const fieldRules = options?.fieldRules || {};
+  Object.entries(fieldRules).forEach(([field, rules]) => {
+    if (rules.immutable || rules.immutableAfterCreate) {
+      immutable.push(field);
+    }
+  });
+  (options?.update?.omitFields || []).forEach((f) => {
+    if (!immutable.includes(f)) immutable.push(f);
+  });
+  return immutable;
+}
+function getSystemManagedFields(options = {}) {
+  const systemManaged = [];
+  const fieldRules = options?.fieldRules || {};
+  Object.entries(fieldRules).forEach(([field, rules]) => {
+    if (rules.systemManaged) {
+      systemManaged.push(field);
+    }
+  });
+  return systemManaged;
+}
+function isFieldUpdateAllowed(fieldName, options = {}) {
+  const immutableFields = getImmutableFields(options);
+  const systemManagedFields = getSystemManagedFields(options);
+  return !immutableFields.includes(fieldName) && !systemManagedFields.includes(fieldName);
+}
+function validateUpdateBody(body = {}, options = {}) {
+  const violations = [];
+  const immutableFields = getImmutableFields(options);
+  const systemManagedFields = getSystemManagedFields(options);
+  Object.keys(body).forEach((field) => {
+    if (immutableFields.includes(field)) {
+      violations.push({ field, reason: "Field is immutable" });
+    } else if (systemManagedFields.includes(field)) {
+      violations.push({ field, reason: "Field is system-managed" });
+    }
+  });
+  return {
+    valid: violations.length === 0,
+    violations
+  };
+}
+function jsonTypeFor(def, options, seen) {
+  if (Array.isArray(def)) {
+    if (def[0] === mongoose2.Schema.Types.Mixed) {
+      return { type: "array", items: { type: "object", additionalProperties: true } };
+    }
+    return { type: "array", items: jsonTypeFor(def[0] ?? String, options, seen) };
+  }
+  if (isPlainObject(def) && "type" in def) {
+    const typedDef = def;
+    if (typedDef.enum && Array.isArray(typedDef.enum) && typedDef.enum.length) {
+      return { type: "string", enum: typedDef.enum.map(String) };
+    }
+    if (Array.isArray(typedDef.type)) {
+      const inner = typedDef.type[0] !== void 0 ? typedDef.type[0] : String;
+      if (inner === mongoose2.Schema.Types.Mixed) {
+        return { type: "array", items: { type: "object", additionalProperties: true } };
+      }
+      return { type: "array", items: jsonTypeFor(inner, options, seen) };
+    }
+    if (typedDef.type === String) return { type: "string" };
+    if (typedDef.type === Number) return { type: "number" };
+    if (typedDef.type === Boolean) return { type: "boolean" };
+    if (typedDef.type === Date) {
+      const mode = options?.dateAs || "datetime";
+      return mode === "date" ? { type: "string", format: "date" } : { type: "string", format: "date-time" };
+    }
+    if (typedDef.type === Map || typedDef.type === mongoose2.Schema.Types.Map) {
+      const ofSchema = jsonTypeFor(typedDef.of || String, options, seen);
+      return { type: "object", additionalProperties: ofSchema };
+    }
+    if (typedDef.type === mongoose2.Schema.Types.Mixed) {
+      return { type: "object", additionalProperties: true };
+    }
+    if (isObjectIdType(typedDef.type)) {
+      return { type: "string", pattern: "^[0-9a-fA-F]{24}$" };
+    }
+    if (isMongooseSchema(typedDef.type)) {
+      const obj = typedDef.type.obj;
+      if (obj && typeof obj === "object") {
+        if (seen.has(obj)) return { type: "object", additionalProperties: true };
+        seen.add(obj);
+        return convertTreeToJsonSchema(obj, options, seen);
+      }
+    }
+  }
+  if (def === String) return { type: "string" };
+  if (def === Number) return { type: "number" };
+  if (def === Boolean) return { type: "boolean" };
+  if (def === Date) {
+    const mode = options?.dateAs || "datetime";
+    return mode === "date" ? { type: "string", format: "date" } : { type: "string", format: "date-time" };
+  }
+  if (isObjectIdType(def)) return { type: "string", pattern: "^[0-9a-fA-F]{24}$" };
+  if (isPlainObject(def)) {
+    if (seen.has(def)) return { type: "object", additionalProperties: true };
+    seen.add(def);
+    return convertTreeToJsonSchema(def, options, seen);
+  }
+  return {};
+}
+function convertTreeToJsonSchema(tree, options, seen = /* @__PURE__ */ new WeakSet()) {
+  if (!tree || typeof tree !== "object") {
+    return { type: "object", properties: {} };
+  }
+  if (seen.has(tree)) {
+    return { type: "object", additionalProperties: true };
+  }
+  seen.add(tree);
+  const properties = {};
+  const required = [];
+  for (const [key, val] of Object.entries(tree || {})) {
+    if (key === "__v" || key === "_id" || key === "id") continue;
+    const cfg = isPlainObject(val) && "type" in val ? val : { };
+    properties[key] = jsonTypeFor(val, options, seen);
+    if (cfg.required === true) required.push(key);
+  }
+  const schema = { type: "object", properties };
+  if (required.length) schema.required = required;
+  return schema;
+}
+function buildJsonSchemaForCreate(tree, options) {
+  const base = convertTreeToJsonSchema(tree, options, /* @__PURE__ */ new WeakSet());
+  const fieldsToOmit = /* @__PURE__ */ new Set(["createdAt", "updatedAt", "__v"]);
+  (options?.create?.omitFields || []).forEach((f) => fieldsToOmit.add(f));
+  const fieldRules = options?.fieldRules || {};
+  Object.entries(fieldRules).forEach(([field, rules]) => {
+    if (rules.systemManaged) {
+      fieldsToOmit.add(field);
+    }
+  });
+  fieldsToOmit.forEach((field) => {
+    if (base.properties?.[field]) {
+      delete base.properties[field];
+    }
+    if (base.required) {
+      base.required = base.required.filter((k) => k !== field);
+    }
+  });
+  const reqOv = options?.create?.requiredOverrides || {};
+  const optOv = options?.create?.optionalOverrides || {};
+  base.required = base.required || [];
+  for (const [k, v] of Object.entries(reqOv)) {
+    if (v && !base.required.includes(k)) base.required.push(k);
+  }
+  for (const [k, v] of Object.entries(optOv)) {
+    if (v && base.required) base.required = base.required.filter((x) => x !== k);
+  }
+  Object.entries(fieldRules).forEach(([field, rules]) => {
+    if (rules.optional && base.required) {
+      base.required = base.required.filter((x) => x !== field);
+    }
+  });
+  const schemaOverrides = options?.create?.schemaOverrides || {};
+  for (const [k, override] of Object.entries(schemaOverrides)) {
+    if (base.properties?.[k]) {
+      base.properties[k] = override;
+    }
+  }
+  if (options?.strictAdditionalProperties === true) {
+    base.additionalProperties = false;
+  }
+  return base;
+}
+function buildJsonSchemaForUpdate(createJson, options) {
+  const clone = JSON.parse(JSON.stringify(createJson));
+  delete clone.required;
+  const fieldsToOmit = /* @__PURE__ */ new Set();
+  (options?.update?.omitFields || []).forEach((f) => fieldsToOmit.add(f));
+  const fieldRules = options?.fieldRules || {};
+  Object.entries(fieldRules).forEach(([field, rules]) => {
+    if (rules.immutable || rules.immutableAfterCreate) {
+      fieldsToOmit.add(field);
+    }
+  });
+  fieldsToOmit.forEach((field) => {
+    if (clone.properties?.[field]) {
+      delete clone.properties[field];
+    }
+  });
+  if (options?.strictAdditionalProperties === true) {
+    clone.additionalProperties = false;
+  }
+  return clone;
+}
+function buildJsonSchemaForQuery(_tree, options) {
+  const basePagination = {
+    type: "object",
+    properties: {
+      page: { type: "string" },
+      limit: { type: "string" },
+      sort: { type: "string" },
+      populate: { type: "string" },
+      search: { type: "string" },
+      select: { type: "string" },
+      lean: { type: "string" },
+      includeDeleted: { type: "string" }
+    },
+    additionalProperties: true
+  };
+  const filterable = options?.query?.filterableFields || {};
+  for (const [k, v] of Object.entries(filterable)) {
+    if (basePagination.properties) {
+      basePagination.properties[k] = v && typeof v === "object" && "type" in v ? v : { type: "string" };
+    }
+  }
+  return basePagination;
+}
+
+// src/utils/error.ts
+function createError(status, message) {
+  const error = new Error(message);
+  error.status = status;
+  return error;
+}
+
+// src/utils/memory-cache.ts
+function createMemoryCache(maxEntries = 1e3) {
+  const cache = /* @__PURE__ */ new Map();
+  function cleanup() {
+    const now = Date.now();
+    for (const [key, entry] of cache) {
+      if (entry.expiresAt < now) {
+        cache.delete(key);
+      }
+    }
+  }
+  function evictOldest() {
+    if (cache.size >= maxEntries) {
+      const firstKey = cache.keys().next().value;
+      if (firstKey) cache.delete(firstKey);
+    }
+  }
+  return {
+    async get(key) {
+      cleanup();
+      const entry = cache.get(key);
+      if (!entry) return null;
+      if (entry.expiresAt < Date.now()) {
+        cache.delete(key);
+        return null;
+      }
+      return entry.value;
+    },
+    async set(key, value, ttl) {
+      cleanup();
+      evictOldest();
+      cache.set(key, {
+        value,
+        expiresAt: Date.now() + ttl * 1e3
+      });
+    },
+    async del(key) {
+      cache.delete(key);
+    },
+    async clear(pattern) {
+      if (!pattern) {
+        cache.clear();
+        return;
+      }
+      const regex = new RegExp(
+        "^" + pattern.replace(/\*/g, ".*").replace(/\?/g, ".") + "$"
+      );
+      for (const key of cache.keys()) {
+        if (regex.test(key)) {
+          cache.delete(key);
+        }
+      }
+    }
+  };
+}
+
+// src/utils/cache-keys.ts
+function hashString(str) {
+  let hash = 5381;
+  for (let i = 0; i < str.length; i++) {
+    hash = (hash << 5) + hash ^ str.charCodeAt(i);
+  }
+  return (hash >>> 0).toString(16);
+}
+function stableStringify(obj) {
+  if (obj === null || obj === void 0) return "";
+  if (typeof obj !== "object") return String(obj);
+  if (Array.isArray(obj)) {
+    return "[" + obj.map(stableStringify).join(",") + "]";
+  }
+  const sorted = Object.keys(obj).sort().map((key) => `${key}:${stableStringify(obj[key])}`);
+  return "{" + sorted.join(",") + "}";
+}
+function byIdKey(prefix, model, id) {
+  return `${prefix}:id:${model}:${id}`;
+}
+function byQueryKey(prefix, model, query, options) {
+  const hashInput = stableStringify({ q: query, s: options?.select, p: options?.populate });
+  return `${prefix}:one:${model}:${hashString(hashInput)}`;
+}
+function listQueryKey(prefix, model, version, params) {
+  const hashInput = stableStringify({
+    f: params.filters,
+    s: params.sort,
+    pg: params.page,
+    lm: params.limit,
+    af: params.after,
+    sl: params.select,
+    pp: params.populate
+  });
+  return `${prefix}:list:${model}:${version}:${hashString(hashInput)}`;
+}
+function versionKey(prefix, model) {
+  return `${prefix}:ver:${model}`;
+}
+function modelPattern(prefix, model) {
+  return `${prefix}:*:${model}:*`;
+}
+function listPattern(prefix, model) {
+  return `${prefix}:list:${model}:*`;
+}
+
+export { buildCrudSchemasFromModel, buildCrudSchemasFromMongooseSchema, byIdKey, byQueryKey, createError, createFieldPreset, createMemoryCache, filterResponseData, getFieldsForUser, getImmutableFields, getMongooseProjection, getSystemManagedFields, isFieldUpdateAllowed, listPattern, listQueryKey, modelPattern, queryParser_default as queryParser, validateUpdateBody, versionKey };
+//# sourceMappingURL=index.js.map
+//# sourceMappingURL=index.js.map