@flowerforce/flowerbase 1.6.2 → 1.6.3-beta.1

package/dist/monitoring/plugin.js

@@ -0,0 +1,1319 @@
+"use strict";
+var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, generator) {
+    function adopt(value) { return value instanceof P ? value : new P(function (resolve) { resolve(value); }); }
+    return new (P || (P = Promise))(function (resolve, reject) {
+        function fulfilled(value) { try { step(generator.next(value)); } catch (e) { reject(e); } }
+        function rejected(value) { try { step(generator["throw"](value)); } catch (e) { reject(e); } }
+        function step(result) { result.done ? resolve(result.value) : adopt(result.value).then(fulfilled, rejected); }
+        step((generator = generator.apply(thisArg, _arguments || [])).next());
+    });
+};
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+const fastify_plugin_1 = __importDefault(require("fastify-plugin"));
+const websocket_1 = __importDefault(require("@fastify/websocket"));
+require("@fastify/websocket");
+const node_fs_1 = __importDefault(require("node:fs"));
+const node_path_1 = __importDefault(require("node:path"));
+const mongodb_1 = require("mongodb");
+const constants_1 = require("../constants");
+const services_1 = require("../services");
+const state_1 = require("../state");
+const handleUserRegistration_1 = __importDefault(require("../shared/handleUserRegistration"));
+const handleUserRegistration_model_1 = require("../shared/models/handleUserRegistration.model");
+const crypto_1 = require("../utils/crypto");
+const context_1 = require("../utils/context");
+const utils_1 = require("../services/mongodb-atlas/utils");
+const utils_2 = require("../utils/roles/machines/utils");
+const DAY_MS = 24 * 60 * 60 * 1000;
+const MAX_DEPTH = 15;
+const MAX_ARRAY = 50;
+const MAX_STRING = 500;
+const COLLECTION_PAGE_SIZE = 50;
+const MONIT_REALM = 'Flowerbase Monitor';
+const isTestEnv = () => process.env.NODE_ENV === 'test' || process.env.JEST_WORKER_ID !== undefined;
+const isPromiseLike = (value) => !!value && typeof value === 'object' && typeof value.then === 'function';
+const isPlainObject = (value) => !!value && typeof value === 'object' && !Array.isArray(value);
+const safeStringify = (value) => {
+    const seen = new WeakSet();
+    try {
+        return JSON.stringify(value, (key, val) => {
+            if (typeof val === 'bigint')
+                return val.toString();
+            if (val && typeof val === 'object') {
+                if (seen.has(val))
+                    return '[Circular]';
+                seen.add(val);
+            }
+            return val;
+        });
+    }
+    catch (_a) {
+        return String(value);
+    }
+};
+const SENSITIVE_KEYS = [
+    /pass(word)?/i,
+    /secret/i,
+    /token/i,
+    /authorization/i,
+    /cookie/i,
+    /api[-_]?key/i,
+    /access[-_]?key/i,
+    /refresh[-_]?token/i,
+    /signature/i,
+    /private/i
+];
+const redactString = (value) => {
+    let result = value;
+    result = result.replace(/(Bearer|Basic)\s+[A-Za-z0-9._+\\/=-]+/gi, '$1 [redacted]');
+    result = result.replace(/(password|pass|pwd|secret|token|api[_-]?key|access[_-]?key|refresh[_-]?token)\s*[=:]\s*[^\\s,;]+/gi, '$1=[redacted]');
+    if (result.length > MAX_STRING) {
+        result = result.slice(0, MAX_STRING) + '...[truncated]';
+    }
+    return result;
+};
+const stripSensitiveFields = (value) => {
+    const out = {};
+    Object.keys(value).forEach((key) => {
+        if (SENSITIVE_KEYS.some((re) => re.test(key)))
+            return;
+        out[key] = value[key];
+    });
+    return out;
+};
+const isErrorLike = (value) => {
+    if (!value || typeof value !== 'object')
+        return false;
+    if (value instanceof Error)
+        return true;
+    const record = value;
+    return (typeof record.message === 'string' ||
+        typeof record.stack === 'string' ||
+        typeof record.name === 'string');
+};
+const sanitizeErrorLike = (value, depth) => {
+    const out = {};
+    const names = new Set(Object.getOwnPropertyNames(value));
+    ['name', 'message', 'stack', 'code', 'statusCode', 'cause'].forEach((key) => names.add(key));
+    names.forEach((key) => {
+        if (SENSITIVE_KEYS.some((re) => re.test(key))) {
+            out[key] = '[redacted]';
+            return;
+        }
+        const raw = value[key];
+        if (raw === value) {
+            out[key] = '[Circular]';
+            return;
+        }
+        if ((key === 'message' || key === 'stack') && typeof raw === 'string') {
+            out[key] = constants_1.DEFAULT_CONFIG.MONIT_REDACT_ERROR_DETAILS ? redactString(raw) : raw;
+            return;
+        }
+        if (typeof raw === 'string') {
+            out[key] = redactString(raw);
+            return;
+        }
+        if (raw !== undefined) {
+            out[key] = sanitize(raw, depth + 1);
+        }
+    });
+    if (value instanceof Error) {
+        if (!out.name)
+            out.name = value.name;
+        if (!out.message) {
+            out.message = constants_1.DEFAULT_CONFIG.MONIT_REDACT_ERROR_DETAILS ? redactString(value.message) : value.message;
+        }
+        if (!out.stack && value.stack) {
+            out.stack = constants_1.DEFAULT_CONFIG.MONIT_REDACT_ERROR_DETAILS ? redactString(value.stack) : value.stack;
+        }
+    }
+    return out;
+};
+const getErrorDetails = (error) => {
+    if (isErrorLike(error)) {
+        const sanitized = sanitizeErrorLike(error, 0);
+        const message = typeof sanitized.message === 'string' && sanitized.message
+            ? sanitized.message
+            : typeof sanitized.name === 'string' && sanitized.name
+                ? sanitized.name
+                : safeStringify(error);
+        const stack = typeof sanitized.stack === 'string' ? sanitized.stack : undefined;
+        return { message, stack };
+    }
+    if (typeof error === 'string')
+        return { message: error };
+    return { message: safeStringify(error) };
+};
+const sanitize = (value, depth = 0) => {
+    if (depth > MAX_DEPTH)
+        return '[max-depth]';
+    if (value === null || value === undefined)
+        return value;
+    if (value instanceof Date)
+        return value.toISOString();
+    if (Buffer.isBuffer(value))
+        return `[buffer ${value.length} bytes]`;
+    if (isErrorLike(value)) {
+        return sanitizeErrorLike(value, depth);
+    }
+    if (typeof value === 'object') {
+        const maybeObjectId = value;
+        if ((maybeObjectId === null || maybeObjectId === void 0 ? void 0 : maybeObjectId._bsontype) === 'ObjectId' && typeof maybeObjectId.toString === 'function') {
+            return maybeObjectId.toString();
+        }
+    }
+    if (typeof value === 'string')
+        return redactString(value);
+    if (typeof value === 'number' || typeof value === 'boolean')
+        return value;
+    if (typeof value === 'bigint')
+        return value.toString();
+    if (Array.isArray(value)) {
+        const items = value.slice(0, MAX_ARRAY).map((item) => sanitize(item, depth + 1));
+        if (value.length > MAX_ARRAY) {
+            items.push(`[+${value.length - MAX_ARRAY} items]`);
+        }
+        return items;
+    }
+    if (typeof value === 'object') {
+        const obj = value;
+        const out = {};
+        Object.keys(obj).forEach((key) => {
+            if (SENSITIVE_KEYS.some((re) => re.test(key))) {
+                out[key] = '[redacted]';
+                return;
+            }
+            out[key] = sanitize(obj[key], depth + 1);
+        });
+        return out;
+    }
+    return value;
+};
+const pickHeaders = (headers) => {
+    const keys = ['user-agent', 'content-type', 'x-forwarded-for', 'host', 'origin', 'referer'];
+    const picked = {};
+    keys.forEach((key) => {
+        const value = headers[key];
+        if (value)
+            picked[key] = value;
+    });
+    return sanitize(picked);
+};
+const createEventStore = (maxAgeMs, maxEvents) => {
+    const events = [];
+    const trim = () => {
+        const cutoff = Date.now() - maxAgeMs;
+        while (events.length && events[0].ts < cutoff) {
+            events.shift();
+        }
+        if (events.length > maxEvents) {
+            events.splice(0, events.length - maxEvents);
+        }
+    };
+    return {
+        add(event) {
+            events.push(event);
+            trim();
+        },
+        list(query) {
+            trim();
+            let result = events.slice();
+            if (query === null || query === void 0 ? void 0 : query.type) {
+                result = result.filter((event) => event.type === query.type);
+            }
+            if (query === null || query === void 0 ? void 0 : query.q) {
+                const q = query.q.toLowerCase();
+                result = result.filter((event) => safeStringify(event).toLowerCase().includes(q));
+            }
+            if ((query === null || query === void 0 ? void 0 : query.limit) && query.limit > 0) {
+                result = result.slice(-query.limit);
+            }
+            return result;
+        },
+        clear() {
+            events.length = 0;
+        }
+    };
+};
+const classifyRequest = (url) => {
+    if (url.includes('/auth') || url.includes('/login') || url.includes('/register') || url.includes('/logout')) {
+        return 'auth';
+    }
+    if (url.includes('/functions'))
+        return 'function';
+    if (url.includes('/endpoint/'))
+        return 'http_endpoint';
+    if (url.includes('/triggers'))
+        return 'trigger';
+    if (url.includes('/api/'))
+        return 'api';
+    return 'http';
+};
+const createEventId = () => `${Date.now().toString(36)}-${Math.random().toString(36).slice(2, 8)}`;
+const buildRulesMeta = (meta) => {
+    var _a, _b, _c;
+    if (!meta || meta.serviceName !== 'mongodb-atlas' || !meta.collection || !meta.rules) {
+        return undefined;
+    }
+    const collectionRules = meta.rules[meta.collection];
+    if (!collectionRules) {
+        return { collection: meta.collection, roles: [], filters: [] };
+    }
+    const filters = (_a = collectionRules.filters) !== null && _a !== void 0 ? _a : [];
+    const roles = (_b = collectionRules.roles) !== null && _b !== void 0 ? _b : [];
+    const user = ((_c = meta.user) !== null && _c !== void 0 ? _c : {});
+    const matchedFilters = (0, utils_1.getValidRule)({ filters, user });
+    const matchedFilterNames = matchedFilters.map((filter) => filter.name);
+    const matchedFilterQueries = matchedFilters.map((filter) => filter.query);
+    const roleCandidates = roles
+        .filter((role) => (0, utils_2.checkApplyWhen)(role.apply_when, user, null))
+        .map((role) => role.name);
+    return {
+        collection: meta.collection,
+        roles: roles.map((role) => role.name),
+        roleCandidates,
+        filters: filters.map((filter) => filter.name),
+        matchedFilters: matchedFilterNames,
+        matchedFilterQueries,
+        runAsSystem: !!meta.runAsSystem
+    };
+};
+const buildCollectionRulesSnapshot = (rules, collection, user, runAsSystem) => {
+    const collectionRules = rules === null || rules === void 0 ? void 0 : rules[collection];
+    return collectionRules !== null && collectionRules !== void 0 ? collectionRules : null;
+};
+const resolveAssetCandidates = (filename, prefix) => {
+    const rootDir = process.cwd();
+    const cleanPrefix = prefix.replace(/^\/+/, '').replace(/\/+$/, '');
+    const candidates = [];
+    const addCandidate = (candidate) => {
+        if (!candidates.includes(candidate))
+            candidates.push(candidate);
+    };
+    if (cleanPrefix) {
+        addCandidate(node_path_1.default.join(rootDir, cleanPrefix, filename));
+    }
+    addCandidate(node_path_1.default.join(rootDir, 'monitoring', filename));
+    // Fallbacks: try package-local assets (works in dev and when bundled).
+    addCandidate(node_path_1.default.join(__dirname, filename));
+    addCandidate(node_path_1.default.join(__dirname, '..', '..', 'src', 'monitoring', filename));
+    return candidates;
+};
+const resolveUserContext = (app, userId, userPayload) => __awaiter(void 0, void 0, void 0, function* () {
+    var _a, _b;
+    if (userPayload && typeof userPayload === 'object') {
+        return stripSensitiveFields(userPayload);
+    }
+    if (!userId)
+        return undefined;
+    const normalizedUserId = userId.trim();
+    const db = app.mongo.client.db(constants_1.DB_NAME);
+    const authCollection = (_a = constants_1.AUTH_CONFIG.authCollection) !== null && _a !== void 0 ? _a : 'auth_users';
+    const userCollection = constants_1.AUTH_CONFIG.userCollection;
+    const userIdField = (_b = constants_1.AUTH_CONFIG.user_id_field) !== null && _b !== void 0 ? _b : 'id';
+    const isObjectId = mongodb_1.ObjectId.isValid(normalizedUserId);
+    const authSelector = isObjectId
+        ? { _id: new mongodb_1.ObjectId(normalizedUserId) }
+        : { id: normalizedUserId };
+    const authUser = yield db.collection(authCollection).findOne(authSelector);
+    let customUser = null;
+    if (userCollection) {
+        const customSelector = { [userIdField]: normalizedUserId };
+        customUser = yield db.collection(userCollection).findOne(customSelector);
+        if (!customUser && isObjectId) {
+            customUser = yield db.collection(userCollection).findOne({ _id: new mongodb_1.ObjectId(normalizedUserId) });
+        }
+    }
+    const id = authUser && typeof authUser._id !== 'undefined'
+        ? String(authUser._id)
+        : (customUser && typeof customUser[userIdField] !== 'undefined'
+            ? String(customUser[userIdField])
+            : normalizedUserId);
+    const user_data = Object.assign(Object.assign({}, (customUser ? stripSensitiveFields(customUser) : {})), { id, _id: id, email: authUser && typeof authUser.email === 'string'
+            ? authUser.email
+            : undefined });
+    const user = {
+        id,
+        user_data,
+        data: user_data,
+        custom_data: user_data
+    };
+    if (isObjectId) {
+        user._id = new mongodb_1.ObjectId(id);
+    }
+    return user;
+});
+const getUserInfo = (resolvedUser) => {
+    var _a;
+    if (!resolvedUser || typeof resolvedUser !== 'object')
+        return undefined;
+    const record = resolvedUser;
+    const id = typeof record.id === 'string' ? record.id : undefined;
+    const email = typeof record.email === 'string'
+        ? record.email
+        : (typeof ((_a = record.user_data) === null || _a === void 0 ? void 0 : _a.email) === 'string' ? record.user_data.email : undefined);
+    if (!id && !email)
+        return undefined;
+    return { id, email };
+};
+const readAsset = (filename, prefix) => {
+    const candidates = resolveAssetCandidates(filename, prefix);
+    for (const candidate of candidates) {
+        try {
+            if (node_fs_1.default.existsSync(candidate)) {
+                return node_fs_1.default.readFileSync(candidate, 'utf8');
+            }
+        }
+        catch (_a) {
+            // ignore and try next
+        }
+    }
+    return '';
+};
+const wrapServicesForMonitoring = (addEvent) => {
+    const wrapped = services_1.services;
+    if (wrapped.__monitWrapped)
+        return;
+    wrapped.__monitWrapped = true;
+    const serviceTypeMap = {
+        api: 'api',
+        aws: 'aws',
+        auth: 'auth',
+        'mongodb-atlas': 'mongo'
+    };
+    const initMethodMap = {
+        aws: new Set(['lambda', 's3']),
+        'mongodb-atlas': new Set(['db', 'collection', 'limit', 'skip', 'toArray'])
+    };
+    const cache = new WeakMap();
+    const wrapValue = (value, path, serviceName, meta) => {
+        if (!value || (typeof value !== 'object' && typeof value !== 'function'))
+            return value;
+        if (isPromiseLike(value))
+            return value;
+        if (cache.has(value)) {
+            return cache.get(value);
+        }
+        const handler = {
+            get(target, prop, receiver) {
+                const propValue = Reflect.get(target, prop, receiver);
+                if (typeof prop === 'symbol')
+                    return propValue;
+                if (prop === 'constructor' || prop === 'toJSON')
+                    return propValue;
+                if (typeof propValue === 'function') {
+                    const propName = String(prop);
+                    const fnPath = `${path}.${propName}`;
+                    const wrappedFn = (...args) => {
+                        var _a, _b;
+                        let nextMeta = meta;
+                        if (serviceName === 'mongodb-atlas') {
+                            if (propName === 'db' && typeof args[0] === 'string') {
+                                nextMeta = Object.assign(Object.assign({}, (meta !== null && meta !== void 0 ? meta : { serviceName })), { dbName: args[0], serviceName });
+                            }
+                            if (propName === 'collection' && typeof args[0] === 'string') {
+                                nextMeta = Object.assign(Object.assign({}, (meta !== null && meta !== void 0 ? meta : { serviceName })), { collection: args[0], serviceName });
+                            }
+                        }
+                        const shouldLog = !((_a = initMethodMap[serviceName]) === null || _a === void 0 ? void 0 : _a.has(propName));
+                        if (shouldLog) {
+                            const ruleInfo = buildRulesMeta(nextMeta !== null && nextMeta !== void 0 ? nextMeta : meta);
+                            addEvent({
+                                id: createEventId(),
+                                ts: Date.now(),
+                                type: (_b = serviceTypeMap[serviceName]) !== null && _b !== void 0 ? _b : 'service',
+                                source: `service:${serviceName}`,
+                                message: fnPath,
+                                data: sanitize({ args, rules: ruleInfo })
+                            });
+                        }
+                        let result;
+                        try {
+                            result = propValue.apply(target, args);
+                        }
+                        catch (error) {
+                            addEvent({
+                                id: createEventId(),
+                                ts: Date.now(),
+                                type: 'error',
+                                source: `service:${serviceName}`,
+                                message: `error ${fnPath}`,
+                                data: sanitize({ error })
+                            });
+                            throw error;
+                        }
+                        if (isPromiseLike(result)) {
+                            return result.catch((error) => {
+                                addEvent({
+                                    id: createEventId(),
+                                    ts: Date.now(),
+                                    type: 'error',
+                                    source: `service:${serviceName}`,
+                                    message: `error ${fnPath}`,
+                                    data: sanitize({ error })
+                                });
+                                throw error;
+                            });
+                        }
+                        return wrapValue(result, fnPath, serviceName, nextMeta);
+                    };
+                    return wrappedFn;
+                }
+                return wrapValue(propValue, `${path}.${String(prop)}`, serviceName, meta);
+            }
+        };
+        const proxied = new Proxy(value, handler);
+        cache.set(value, proxied);
+        return proxied;
+    };
+    Object.keys(services_1.services).forEach((serviceName) => {
+        const original = wrapped[serviceName];
+        wrapped[serviceName] = (app, options) => {
+            const instance = original(app, options);
+            const meta = {
+                serviceName,
+                rules: options.rules,
+                user: options.user,
+                runAsSystem: Boolean(options.run_as_system)
+            };
+            return wrapValue(instance, serviceName, serviceName, meta);
+        };
+    });
+};
+const createMonitoringPlugin = (0, fastify_plugin_1.default)((app_1, ...args_1) => __awaiter(void 0, [app_1, ...args_1], void 0, function* (app, opts = {}) {
+    if (isTestEnv())
+        return;
+    const enabled = constants_1.DEFAULT_CONFIG.MONIT_ENABLED;
+    if (!enabled)
+        return;
+    const rawPrefix = typeof opts.basePath === 'string' ? opts.basePath : '/monit';
+    const normalizedPrefix = rawPrefix.startsWith('/') ? rawPrefix : `/${rawPrefix}`;
+    const prefix = normalizedPrefix.endsWith('/')
+        ? normalizedPrefix.slice(0, -1)
+        : normalizedPrefix;
+    const maxAgeMs = Math.max(1, constants_1.DEFAULT_CONFIG.MONIT_CACHE_HOURS) * 60 * 60 * 1000;
+    const maxEvents = Math.max(1000, constants_1.DEFAULT_CONFIG.MONIT_MAX_EVENTS);
+    const allowedIps = constants_1.DEFAULT_CONFIG.MONIT_ALLOWED_IPS;
+    const rateLimitWindowMs = Math.max(0, constants_1.DEFAULT_CONFIG.MONIT_RATE_LIMIT_WINDOW_MS);
+    const rateLimitMax = Math.max(0, constants_1.DEFAULT_CONFIG.MONIT_RATE_LIMIT_MAX);
+    const allowInvoke = constants_1.DEFAULT_CONFIG.MONIT_ALLOW_INVOKE;
+    const allowEdit = constants_1.DEFAULT_CONFIG.MONIT_ALLOW_EDIT;
+    const eventStore = createEventStore(maxAgeMs || DAY_MS, maxEvents);
+    const functionHistory = [];
+    const maxHistory = 30;
+    const collectionHistory = [];
+    const maxCollectionHistory = 30;
+    const statsState = {
+        lastCpu: process.cpuUsage(),
+        lastHr: process.hrtime.bigint(),
+        maxRssMb: 0,
+        maxCpu: 0
+    };
+    const clients = new Set();
+    const addFunctionHistory = (entry) => {
+        functionHistory.unshift(entry);
+        if (functionHistory.length > maxHistory) {
+            functionHistory.splice(maxHistory);
+        }
+    };
+    const addCollectionHistory = (entry) => {
+        collectionHistory.unshift(entry);
+        if (collectionHistory.length > maxCollectionHistory) {
+            collectionHistory.splice(maxCollectionHistory);
+        }
+    };
+    const rateBucket = new Map();
+    const isRateLimited = (key) => {
+        if (rateLimitMax <= 0 || rateLimitWindowMs <= 0)
+            return false;
+        const now = Date.now();
+        const current = rateBucket.get(key);
+        if (!current || now > current.resetAt) {
+            rateBucket.set(key, { count: 1, resetAt: now + rateLimitWindowMs });
+            return false;
+        }
+        current.count += 1;
+        if (current.count > rateLimitMax) {
+            return true;
+        }
+        return false;
+    };
+    const round1 = (value) => Math.round(value * 10) / 10;
+    const getStats = () => {
+        const mem = process.memoryUsage();
+        const rssMb = mem.rss / (1024 * 1024);
+        const now = process.hrtime.bigint();
+        const currentCpu = process.cpuUsage();
+        const deltaCpu = {
+            user: currentCpu.user - statsState.lastCpu.user,
+            system: currentCpu.system - statsState.lastCpu.system
+        };
+        const deltaTimeMicros = Number(now - statsState.lastHr) / 1000;
+        const cpuPercent = deltaTimeMicros > 0
+            ? ((deltaCpu.user + deltaCpu.system) / deltaTimeMicros) * 100
+            : 0;
+        statsState.lastCpu = currentCpu;
+        statsState.lastHr = now;
+        statsState.maxRssMb = Math.max(statsState.maxRssMb, rssMb);
+        statsState.maxCpu = Math.max(statsState.maxCpu, cpuPercent);
+        return {
+            ramMb: round1(rssMb),
+            cpuPercent: round1(cpuPercent),
+            topRamMb: round1(statsState.maxRssMb),
+            topCpuPercent: round1(statsState.maxCpu),
+            uptimeSec: Math.round(process.uptime())
+        };
+    };
+    const addEvent = (event) => {
+        const sanitizedEvent = Object.assign(Object.assign({}, event), { data: sanitize(event.data), message: redactString(event.message) });
+        eventStore.add(sanitizedEvent);
+        const payload = JSON.stringify({ type: 'event', event: sanitizedEvent });
+        clients.forEach((client) => {
+            if (client.readyState !== 1)
+                return;
+            try {
+                client.send(payload);
+            }
+            catch (_a) {
+                clients.delete(client);
+            }
+        });
+    };
+    wrapServicesForMonitoring(addEvent);
+    if (constants_1.DEFAULT_CONFIG.MONIT_CAPTURE_CONSOLE) {
+        const original = {
+            log: console.log,
+            error: console.error,
+            warn: console.warn
+        };
+        console.log = (...args) => {
+            addEvent({
+                id: createEventId(),
+                ts: Date.now(),
+                type: 'log',
+                source: 'console',
+                message: args.map((item) => (typeof item === 'string' ? item : safeStringify(item))).join(' '),
+                data: sanitize(args)
+            });
+            original.log(...args);
+        };
+        console.error = (...args) => {
+            addEvent({
+                id: createEventId(),
+                ts: Date.now(),
+                type: 'error',
+                source: 'console',
+                message: args.map((item) => (typeof item === 'string' ? item : safeStringify(item))).join(' '),
+                data: sanitize(args)
+            });
+            original.error(...args);
+        };
+        console.warn = (...args) => {
+            addEvent({
+                id: createEventId(),
+                ts: Date.now(),
+                type: 'warn',
+                source: 'console',
+                message: args.map((item) => (typeof item === 'string' ? item : safeStringify(item))).join(' '),
+                data: sanitize(args)
+            });
+            original.warn(...args);
+        };
+    }
+    const hasCredentials = () => constants_1.DEFAULT_CONFIG.MONIT_USER && constants_1.DEFAULT_CONFIG.MONIT_PASSWORD;
+    const isAuthorized = (req) => {
+        if (!hasCredentials())
+            return false;
+        const header = req.headers.authorization;
+        if (!header || !header.startsWith('Basic '))
+            return false;
+        const encoded = header.slice('Basic '.length);
+        const decoded = Buffer.from(encoded, 'base64').toString('utf8');
+        const [user, pass] = decoded.split(':');
+        return user === constants_1.DEFAULT_CONFIG.MONIT_USER && pass === constants_1.DEFAULT_CONFIG.MONIT_PASSWORD;
+    };
+    const isMonitRoute = (url) => {
+        const path = url.split('?')[0];
+        return path === prefix || path.startsWith(`${prefix}/`);
+    };
+    const shouldSkipLog = (req) => isMonitRoute(req.url);
+    app.addHook('onRequest', (req, reply, done) => {
+        if (isMonitRoute(req.url)) {
+            const audit = (status, reason) => {
+                addEvent({
+                    id: createEventId(),
+                    ts: Date.now(),
+                    type: 'auth',
+                    source: 'monit',
+                    message: `monit ${status}`,
+                    data: sanitize({
+                        status,
+                        reason,
+                        ip: req.ip,
+                        method: req.method,
+                        path: req.url
+                    })
+                });
+            };
+            const allowAllIps = allowedIps.includes('0.0.0.0') || allowedIps.includes('*');
+            if (allowedIps.length && !allowAllIps && !allowedIps.includes(req.ip)) {
+                audit('deny', 'ip');
+                reply.code(403).send({ message: 'Forbidden' });
+                return;
+            }
+            if (isRateLimited(req.ip)) {
+                audit('deny', 'rate_limit');
+                reply.code(429).send({ message: 'Too Many Requests' });
+                return;
+            }
+            if (!hasCredentials()) {
+                audit('deny', 'missing_credentials');
+                reply.code(503).send({ message: 'Monitoring credentials not configured' });
+                return;
+            }
+            if (!isAuthorized(req)) {
+                audit('deny', 'basic_auth');
+                reply
+                    .code(401)
+                    .header('WWW-Authenticate', `Basic realm="${MONIT_REALM}"`)
+                    .send({ message: 'Unauthorized' });
+                return;
+            }
+        }
+        ;
+        req.__monitStart = Date.now();
+        done();
+    });
+    app.addHook('onResponse', (req, reply, done) => {
+        var _a, _b, _c;
+        if (shouldSkipLog(req)) {
+            done();
+            return;
+        }
+        const start = (_a = req.__monitStart) !== null && _a !== void 0 ? _a : Date.now();
+        const duration = Date.now() - start;
+        const url = (_b = req.url) !== null && _b !== void 0 ? _b : '';
+        const type = classifyRequest(url);
+        const data = {
+            method: req.method,
+            url,
+            statusCode: reply.statusCode,
+            durationMs: duration,
+            ip: req.ip,
+            query: sanitize(req.query),
+            headers: pickHeaders(req.headers)
+        };
+        if (type === 'function') {
+            const body = req.body;
+            if (body === null || body === void 0 ? void 0 : body.name) {
+                data.function = body.name;
+                data.arguments = sanitize(body.arguments);
+            }
+        }
+        if (type === 'auth') {
+            const body = req.body;
+            if ((body === null || body === void 0 ? void 0 : body.email) || (body === null || body === void 0 ? void 0 : body.username)) {
+                data.user = (_c = body.email) !== null && _c !== void 0 ? _c : body.username;
+            }
+        }
+        addEvent({
+            id: createEventId(),
+            ts: Date.now(),
+            type,
+            source: 'http',
+            message: `${req.method} ${url} -> ${reply.statusCode} (${duration}ms)`,
+            data
+        });
+        done();
+    });
+    app.addHook('onError', (req, reply, error, done) => {
+        var _a;
+        if (!shouldSkipLog(req)) {
+            addEvent({
+                id: createEventId(),
+                ts: Date.now(),
+                type: 'error',
+                source: 'http',
+                message: `${req.method} ${req.url} -> error`,
+                data: sanitize({ error: (_a = error === null || error === void 0 ? void 0 : error.message) !== null && _a !== void 0 ? _a : error })
+            });
+        }
+        done();
+    });
+    yield app.register(websocket_1.default);
+    const sendUi = (_req, reply) => __awaiter(void 0, void 0, void 0, function* () {
+        const raw = readAsset('ui.html', prefix);
+        if (!raw) {
+            const tried = resolveAssetCandidates('ui.html', prefix).join(', ');
+            reply.code(404).send(`ui.html not found. Tried: ${tried}`);
+            return;
+        }
+        const html = raw.replace(/__MONIT_BASE__/g, prefix);
+        reply.header('Cache-Control', 'no-store');
+        reply.type('text/html').send(html);
+    });
+    app.get(prefix, sendUi);
+    app.get(`${prefix}/`, sendUi);
+    app.get(`${prefix}/ui.css`, (_req, reply) => __awaiter(void 0, void 0, void 0, function* () {
+        const css = readAsset('ui.css', prefix);
+        if (!css) {
+            const tried = resolveAssetCandidates('ui.css', prefix).join(', ');
+            reply.code(404).send(`ui.css not found. Tried: ${tried}`);
+            return;
+        }
+        reply.header('Cache-Control', 'no-store');
+        reply.type('text/css').send(css);
+    }));
+    app.get(`${prefix}/ui.js`, (_req, reply) => __awaiter(void 0, void 0, void 0, function* () {
+        const raw = readAsset('ui.js', prefix);
+        if (!raw) {
+            const tried = resolveAssetCandidates('ui.js', prefix).join(', ');
+            reply.code(404).send(`ui.js not found. Tried: ${tried}`);
+            return;
+        }
+        const js = raw.replace(/__MONIT_BASE__/g, prefix);
+        reply.header('Cache-Control', 'no-store');
+        reply.type('application/javascript').send(js);
+    }));
+    app.get(`${prefix}/ws`, { websocket: true }, (connection) => {
+        var _a;
+        const socket = (_a = connection
+            .socket) !== null && _a !== void 0 ? _a : connection;
+        clients.add(socket);
+        socket.send(JSON.stringify({ type: 'init', events: eventStore.list({ limit: maxEvents }) }));
+        addEvent({
+            id: createEventId(),
+            ts: Date.now(),
+            type: 'log',
+            source: 'monit',
+            message: 'websocket connected'
+        });
+        socket.on('close', () => {
+            clients.delete(socket);
+            addEvent({
+                id: createEventId(),
+                ts: Date.now(),
+                type: 'log',
+                source: 'monit',
+                message: 'websocket disconnected'
+            });
+        });
+    });
+    app.get(`${prefix}/api/events`, (req) => __awaiter(void 0, void 0, void 0, function* () {
+        const query = req.query;
+        const limit = query.limit ? Number(query.limit) : undefined;
+        return {
+            items: eventStore.list({
+                q: query.q,
+                type: query.type,
+                limit
+            })
+        };
+    }));
+    app.get(`${prefix}/api/stats`, () => __awaiter(void 0, void 0, void 0, function* () { return getStats(); }));
+    app.get(`${prefix}/api/functions`, () => __awaiter(void 0, void 0, void 0, function* () {
+        const functionsList = state_1.StateManager.select('functions');
+        const items = Object.keys(functionsList || {}).map((name) => {
+            var _a, _b;
+            return ({
+                name,
+                private: !!((_a = functionsList[name]) === null || _a === void 0 ? void 0 : _a.private),
+                run_as_system: !!((_b = functionsList[name]) === null || _b === void 0 ? void 0 : _b.run_as_system)
+            });
+        });
+        return { items };
+    }));
+    app.get(`${prefix}/api/functions/:name`, (req, reply) => __awaiter(void 0, void 0, void 0, function* () {
+        var _a;
+        if (!allowEdit) {
+            reply.code(403);
+            return { error: 'Function code access disabled' };
+        }
+        const params = req.params;
+        const name = params.name;
+        const functionsList = state_1.StateManager.select('functions');
+        const currentFunction = functionsList === null || functionsList === void 0 ? void 0 : functionsList[name];
+        if (!currentFunction) {
+            reply.code(404);
+            return { error: `Function "${name}" not found` };
+        }
+        return {
+            name,
+            code: (_a = currentFunction.code) !== null && _a !== void 0 ? _a : '',
+            private: !!currentFunction.private,
+            run_as_system: !!currentFunction.run_as_system,
+            disable_arg_logs: !!currentFunction.disable_arg_logs
+        };
+    }));
+    app.get(`${prefix}/api/functions/history`, () => __awaiter(void 0, void 0, void 0, function* () {
+        return ({
+            items: functionHistory.slice(0, maxHistory)
+        });
+    }));
+    app.post(`${prefix}/api/functions/invoke`, (req, reply) => __awaiter(void 0, void 0, void 0, function* () {
+        var _a, _b;
+        if (!allowInvoke) {
+            reply.code(403);
+            return { error: 'Function invocation disabled' };
+        }
+        const body = req.body;
+        const name = body === null || body === void 0 ? void 0 : body.name;
+        const args = Array.isArray(body === null || body === void 0 ? void 0 : body.arguments) ? body.arguments : [];
+        if (!name) {
+            reply.code(400);
+            return { error: 'Missing function name' };
+        }
+        const functionsList = state_1.StateManager.select('functions');
+        const rules = state_1.StateManager.select('rules');
+        const appRef = state_1.StateManager.select('app');
+        const services = state_1.StateManager.select('services');
+        const currentFunction = functionsList === null || functionsList === void 0 ? void 0 : functionsList[name];
+        if (!currentFunction) {
+            reply.code(404);
+            return { error: `Function "${name}" not found` };
+        }
+        if (!allowEdit && typeof (body === null || body === void 0 ? void 0 : body.code) === 'string' && body.code.trim()) {
+            reply.code(403);
+            return { error: 'Function override disabled' };
+        }
+        const overrideCode = typeof (body === null || body === void 0 ? void 0 : body.code) === 'string' && body.code.trim()
+            ? body.code
+            : undefined;
+        const effectiveRunAsSystem = (body === null || body === void 0 ? void 0 : body.runAsSystem) !== false;
+        const effectiveFunction = overrideCode
+            ? Object.assign(Object.assign({}, currentFunction), { code: overrideCode, run_as_system: effectiveRunAsSystem }) : Object.assign(Object.assign({}, currentFunction), { run_as_system: effectiveRunAsSystem });
+        const resolvedUser = yield resolveUserContext(app, body === null || body === void 0 ? void 0 : body.userId, body === null || body === void 0 ? void 0 : body.user);
+        const safeArgs = (Array.isArray(args) ? sanitize(args) : sanitize([args]));
+        const resolvedUserRecord = resolvedUser;
+        const userInfo = resolvedUserRecord
+            ? {
+                id: typeof resolvedUserRecord.id === 'string' ? resolvedUserRecord.id : undefined,
+                email: typeof resolvedUserRecord.email === 'string'
+                    ? resolvedUserRecord.email
+                    : (typeof ((_a = resolvedUserRecord.user_data) === null || _a === void 0 ? void 0 : _a.email) === 'string'
+                        ? (_b = resolvedUserRecord.user_data) === null || _b === void 0 ? void 0 : _b.email
+                        : undefined)
+            }
+            : undefined;
+        addFunctionHistory({
+            ts: Date.now(),
+            name,
+            args: safeArgs,
+            runAsSystem: effectiveRunAsSystem,
+            user: userInfo
+        });
+        addEvent({
+            id: createEventId(),
+            ts: Date.now(),
+            type: 'function',
+            source: 'monit',
+            message: `invoke ${name}`,
+            data: sanitize({
+                args,
+                user: userInfo,
+                runAsSystem: effectiveRunAsSystem,
+                override: Boolean(overrideCode)
+            })
+        });
+        try {
+            const result = yield (0, context_1.GenerateContext)({
+                args,
+                app: appRef,
+                rules,
+                user: resolvedUser !== null && resolvedUser !== void 0 ? resolvedUser : { id: 'monitor', role: 'system' },
+                currentFunction: effectiveFunction,
+                functionsList,
+                services,
+                runAsSystem: effectiveRunAsSystem
+            });
+            return { result: sanitize(result) };
+        }
+        catch (error) {
+            addEvent({
+                id: createEventId(),
+                ts: Date.now(),
+                type: 'error',
+                source: 'monit',
+                message: `invoke ${name} failed`,
+                data: sanitize({ error })
+            });
+            reply.code(500);
+            const details = getErrorDetails(error);
+            return { error: details.message, stack: details.stack };
+        }
+    }));
+    app.get(`${prefix}/api/users`, (req) => __awaiter(void 0, void 0, void 0, function* () {
+        var _a, _b, _c, _d, _e, _f, _g, _h, _j;
+        const query = req.query;
+        const scope = (_a = query.scope) !== null && _a !== void 0 ? _a : 'all';
+        const rawSearch = typeof query.q === 'string' ? query.q.trim() : '';
+        const hasSearch = rawSearch.length > 0;
+        const escapeRegex = (value) => value.replace(/[.*+?^${}()|[\]\\]/g, '\\$&');
+        const searchRegex = hasSearch ? new RegExp(escapeRegex(rawSearch), 'i') : null;
+        const searchObjectId = hasSearch && mongodb_1.ObjectId.isValid(rawSearch) ? new mongodb_1.ObjectId(rawSearch) : null;
+        const parsedAuthLimit = Number((_c = (_b = query.authLimit) !== null && _b !== void 0 ? _b : query.limit) !== null && _c !== void 0 ? _c : 100);
+        const parsedCustomLimit = Number((_e = (_d = query.customLimit) !== null && _d !== void 0 ? _d : query.limit) !== null && _e !== void 0 ? _e : 25);
+        const parsedPage = Number((_g = (_f = query.customPage) !== null && _f !== void 0 ? _f : query.page) !== null && _g !== void 0 ? _g : 1);
+        const resolvedAuthLimit = Math.min(Number.isFinite(parsedAuthLimit) && parsedAuthLimit > 0 ? parsedAuthLimit : 100, 500);
+        const resolvedCustomLimit = Math.min(Number.isFinite(parsedCustomLimit) && parsedCustomLimit > 0 ? parsedCustomLimit : 25, 500);
+        const resolvedCustomPage = Math.max(Number.isFinite(parsedPage) && parsedPage > 0 ? parsedPage : 1, 1);
+        const db = app.mongo.client.db(constants_1.DB_NAME);
+        const authCollection = (_h = constants_1.AUTH_CONFIG.authCollection) !== null && _h !== void 0 ? _h : 'auth_users';
+        const userCollection = constants_1.AUTH_CONFIG.userCollection;
+        const response = {
+            meta: {
+                userIdField: constants_1.AUTH_CONFIG.user_id_field,
+                authCollection,
+                customCollection: userCollection
+            }
+        };
+        if (scope === 'all' || scope === 'auth') {
+            const authFilter = hasSearch
+                ? {
+                    $or: [
+                        ...(searchObjectId ? [{ _id: searchObjectId }] : []),
+                        { email: searchRegex },
+                        { status: searchRegex }
+                    ]
+                }
+                : {};
+            const authItems = yield db
+                .collection(authCollection)
+                .find(authFilter)
+                .sort({ createdAt: -1, _id: -1 })
+                .limit(resolvedAuthLimit)
+                .toArray();
+            response.auth = {
+                collection: authCollection,
+                items: authItems.map((doc) => sanitize(doc))
+            };
+        }
+        if ((scope === 'all' || scope === 'custom') && userCollection) {
+            const userIdField = (_j = constants_1.AUTH_CONFIG.user_id_field) !== null && _j !== void 0 ? _j : 'id';
+            const customFilter = hasSearch
+                ? {
+                    $or: [
+                        ...(searchObjectId ? [{ _id: searchObjectId }] : []),
+                        { [userIdField]: searchRegex },
+                        { email: searchRegex },
+                        { name: searchRegex },
+                        { username: searchRegex }
+                    ]
+                }
+                : {};
+            const total = yield db.collection(userCollection).countDocuments(customFilter);
+            const totalPages = Math.max(1, Math.ceil(total / Math.max(resolvedCustomLimit, 1)));
+            const page = Math.min(resolvedCustomPage, totalPages);
+            const skip = Math.max(0, (page - 1) * resolvedCustomLimit);
+            const customItems = yield db
+                .collection(userCollection)
+                .find(customFilter)
+                .sort({ createdAt: -1, _id: -1 })
+                .skip(skip)
+                .limit(resolvedCustomLimit)
+                .toArray();
+            response.custom = {
+                collection: userCollection,
+                items: customItems.map((doc) => sanitize(doc)),
+                pagination: {
+                    page,
+                    pages: totalPages,
+                    total,
+                    pageSize: resolvedCustomLimit
+                }
+            };
+        }
+        return response;
+    }));
+    app.post(`${prefix}/api/users`, (req, reply) => __awaiter(void 0, void 0, void 0, function* () {
+        var _a, _b, _c;
+        const body = req.body;
+        const email = (_a = body === null || body === void 0 ? void 0 : body.email) === null || _a === void 0 ? void 0 : _a.toLowerCase();
+        const password = body === null || body === void 0 ? void 0 : body.password;
+        if (!email || !password) {
+            reply.code(400);
+            return { error: 'Missing email or password' };
+        }
+        const result = yield (0, handleUserRegistration_1.default)(app, {
+            run_as_system: true,
+            provider: handleUserRegistration_model_1.PROVIDER.LOCAL_USERPASS
+        })({ email, password });
+        const userId = (_b = result === null || result === void 0 ? void 0 : result.insertedId) === null || _b === void 0 ? void 0 : _b.toString();
+        if (userId && constants_1.AUTH_CONFIG.userCollection && constants_1.AUTH_CONFIG.user_id_field) {
+            const db = app.mongo.client.db(constants_1.DB_NAME);
+            const customData = (_c = body === null || body === void 0 ? void 0 : body.customData) !== null && _c !== void 0 ? _c : {};
+            yield db.collection(constants_1.AUTH_CONFIG.userCollection).updateOne({ [constants_1.AUTH_CONFIG.user_id_field]: userId }, {
+                $set: Object.assign(Object.assign({}, customData), { [constants_1.AUTH_CONFIG.user_id_field]: userId })
+            }, { upsert: true });
+        }
+        addEvent({
+            id: createEventId(),
+            ts: Date.now(),
+            type: 'auth',
+            source: 'monit',
+            message: 'user created',
+            data: sanitize({ email, userId })
+        });
+        reply.code(201);
+        return { userId };
+    }));
+    app.patch(`${prefix}/api/users/:id/password`, (req, reply) => __awaiter(void 0, void 0, void 0, function* () {
+        var _a;
+        const params = req.params;
+        const body = req.body;
+        const password = body === null || body === void 0 ? void 0 : body.password;
+        if (!password) {
+            reply.code(400);
+            return { error: 'Missing password' };
+        }
+        const db = app.mongo.client.db(constants_1.DB_NAME);
+        const authCollection = (_a = constants_1.AUTH_CONFIG.authCollection) !== null && _a !== void 0 ? _a : 'auth_users';
+        const selector = {};
+        if (params.id && mongodb_1.ObjectId.isValid(params.id)) {
+            selector._id = new mongodb_1.ObjectId(params.id);
+        }
+        else if (body === null || body === void 0 ? void 0 : body.email) {
+            selector.email = body.email.toLowerCase();
+        }
+        else {
+            reply.code(400);
+            return { error: 'Invalid user identifier' };
+        }
+        const hashedPassword = yield (0, crypto_1.hashPassword)(password);
+        const result = yield db.collection(authCollection).updateOne(selector, {
+            $set: { password: hashedPassword }
+        });
+        if (!result.matchedCount) {
+            reply.code(404);
+            return { error: 'User not found' };
+        }
+        addEvent({
+            id: createEventId(),
+            ts: Date.now(),
+            type: 'auth',
+            source: 'monit',
+            message: 'password updated',
+            data: sanitize({ selector })
+        });
+        return { status: 'ok' };
+    }));
+    app.patch(`${prefix}/api/users/:id/status`, (req, reply) => __awaiter(void 0, void 0, void 0, function* () {
+        var _a, _b;
+        const params = req.params;
+        const body = req.body;
+        const db = app.mongo.client.db(constants_1.DB_NAME);
+        const authCollection = (_a = constants_1.AUTH_CONFIG.authCollection) !== null && _a !== void 0 ? _a : 'auth_users';
+        const selector = {};
+        if (params.id && mongodb_1.ObjectId.isValid(params.id)) {
+            selector._id = new mongodb_1.ObjectId(params.id);
+        }
+        else if (body === null || body === void 0 ? void 0 : body.email) {
+            selector.email = body.email.toLowerCase();
+        }
+        else {
+            reply.code(400);
+            return { error: 'Invalid user identifier' };
+        }
+        const status = typeof (body === null || body === void 0 ? void 0 : body.disabled) === 'boolean'
+            ? (body.disabled ? 'disabled' : 'confirmed')
+            : ((_b = body === null || body === void 0 ? void 0 : body.status) !== null && _b !== void 0 ? _b : 'disabled');
+        const result = yield db.collection(authCollection).updateOne(selector, {
+            $set: { status }
+        });
+        if (!result.matchedCount) {
+            reply.code(404);
+            return { error: 'User not found' };
+        }
+        addEvent({
+            id: createEventId(),
+            ts: Date.now(),
+            type: 'auth',
+            source: 'monit',
+            message: `user status ${status}`,
+            data: sanitize({ selector, status })
+        });
+        return { status: 'ok' };
+    }));
+    app.get(`${prefix}/api/collections`, () => __awaiter(void 0, void 0, void 0, function* () {
+        const db = app.mongo.client.db(constants_1.DB_NAME);
+        const collections = yield db.listCollections().toArray();
+        const items = collections
+            .filter((entry) => !entry.name.startsWith('system.'))
+            .map((entry) => ({
+            name: entry.name,
+            type: entry.type
+        }));
+        return { items };
+    }));
+    app.get(`${prefix}/api/collections/:name/rules`, (req) => __awaiter(void 0, void 0, void 0, function* () {
+        const params = req.params;
+        const query = req.query;
+        const rules = state_1.StateManager.select('rules');
+        const runAsSystem = (query === null || query === void 0 ? void 0 : query.runAsSystem) === 'true';
+        const resolvedUser = yield resolveUserContext(app, query === null || query === void 0 ? void 0 : query.userId);
+        return buildCollectionRulesSnapshot(rules, params.name, resolvedUser, runAsSystem);
+    }));
+    app.get(`${prefix}/api/collections/history`, () => __awaiter(void 0, void 0, void 0, function* () {
+        return ({
+            items: collectionHistory.slice(0, maxCollectionHistory)
+        });
+    }));
+    app.post(`${prefix}/api/collections/query`, (req, reply) => __awaiter(void 0, void 0, void 0, function* () {
+        var _a, _b;
+        const body = req.body;
+        const collection = body === null || body === void 0 ? void 0 : body.collection;
+        if (!collection) {
+            reply.code(400);
+            return { error: 'Missing collection name' };
+        }
+        const rawQuery = (_a = body === null || body === void 0 ? void 0 : body.query) !== null && _a !== void 0 ? _a : {};
+        if (Array.isArray(rawQuery) || typeof rawQuery !== 'object' || rawQuery === null) {
+            reply.code(400);
+            return { error: 'Query must be an object' };
+        }
+        const sort = body === null || body === void 0 ? void 0 : body.sort;
+        if (sort !== undefined && !isPlainObject(sort)) {
+            reply.code(400);
+            return { error: 'Sort must be an object' };
+        }
+        const page = Math.max(1, Math.floor(Number((_b = body === null || body === void 0 ? void 0 : body.page) !== null && _b !== void 0 ? _b : 1) || 1));
+        const skip = (page - 1) * COLLECTION_PAGE_SIZE;
+        const rules = state_1.StateManager.select('rules');
+        const services = state_1.StateManager.select('services');
+        const resolvedUser = yield resolveUserContext(app, body === null || body === void 0 ? void 0 : body.userId);
+        const runAsSystem = (body === null || body === void 0 ? void 0 : body.runAsSystem) !== false;
+        const recordHistory = (body === null || body === void 0 ? void 0 : body.recordHistory) !== false;
+        try {
+            const mongoService = services['mongodb-atlas'](app, {
+                rules,
+                user: resolvedUser !== null && resolvedUser !== void 0 ? resolvedUser : {},
+                run_as_system: runAsSystem
+            });
+            const options = {};
+            if (isPlainObject(sort))
+                options.sort = sort;
+            const cursor = mongoService
+                .db(constants_1.DB_NAME)
+                .collection(collection)
+                .find(rawQuery, undefined, Object.keys(options).length ? options : undefined)
+                .skip(skip)
+                .limit(COLLECTION_PAGE_SIZE + 1);
+            const countPromise = mongoService
+                .db(constants_1.DB_NAME)
+                .collection(collection)
+                .count(rawQuery);
+            const [items, total] = yield Promise.all([cursor.toArray(), countPromise]);
+            const hasMore = page * COLLECTION_PAGE_SIZE < total;
+            const pageItems = items.length > COLLECTION_PAGE_SIZE
+                ? items.slice(0, COLLECTION_PAGE_SIZE)
+                : items;
+            if (recordHistory) {
+                addCollectionHistory({
+                    ts: Date.now(),
+                    collection,
+                    mode: 'query',
+                    query: sanitize(rawQuery),
+                    sort: sort ? sanitize(sort) : undefined,
+                    runAsSystem,
+                    user: getUserInfo(resolvedUser),
+                    page
+                });
+            }
+            return {
+                items: sanitize(pageItems),
+                count: pageItems.length,
+                total,
+                page,
+                pageSize: COLLECTION_PAGE_SIZE,
+                hasMore
+            };
+        }
+        catch (error) {
+            const details = getErrorDetails(error);
+            reply.code(500);
+            return { error: details.message, stack: details.stack };
+        }
+    }));
+    app.post(`${prefix}/api/collections/aggregate`, (req, reply) => __awaiter(void 0, void 0, void 0, function* () {
+        var _a, _b, _c, _d;
+        const body = req.body;
+        const collection = body === null || body === void 0 ? void 0 : body.collection;
+        if (!collection) {
+            reply.code(400);
+            return { error: 'Missing collection name' };
+        }
+        const rawPipeline = (_a = body === null || body === void 0 ? void 0 : body.pipeline) !== null && _a !== void 0 ? _a : [];
+        if (!Array.isArray(rawPipeline)) {
+            reply.code(400);
+            return { error: 'Aggregate pipeline must be an array' };
+        }
+        const sort = body === null || body === void 0 ? void 0 : body.sort;
+        if (sort !== undefined && !isPlainObject(sort)) {
+            reply.code(400);
+            return { error: 'Sort must be an object' };
+        }
+        const page = Math.max(1, Math.floor(Number((_b = body === null || body === void 0 ? void 0 : body.page) !== null && _b !== void 0 ? _b : 1) || 1));
+        const skip = (page - 1) * COLLECTION_PAGE_SIZE;
+        const rules = state_1.StateManager.select('rules');
+        const services = state_1.StateManager.select('services');
+        const resolvedUser = yield resolveUserContext(app, body === null || body === void 0 ? void 0 : body.userId);
+        const runAsSystem = (body === null || body === void 0 ? void 0 : body.runAsSystem) !== false;
+        const recordHistory = (body === null || body === void 0 ? void 0 : body.recordHistory) !== false;
+        try {
+            const pipeline = [...rawPipeline];
+            if (sort)
+                pipeline.push({ $sort: sort });
+            if (skip > 0)
+                pipeline.push({ $skip: skip });
+            pipeline.push({ $limit: COLLECTION_PAGE_SIZE + 1 });
+            const mongoService = services['mongodb-atlas'](app, {
+                rules,
+                user: resolvedUser !== null && resolvedUser !== void 0 ? resolvedUser : {},
+                run_as_system: runAsSystem
+            });
+            const cursor = mongoService
+                .db(constants_1.DB_NAME)
+                .collection(collection)
+                .aggregate(pipeline, undefined, true);
+            const countCursor = mongoService
+                .db(constants_1.DB_NAME)
+                .collection(collection)
+                .aggregate([...rawPipeline, { $count: 'total' }], undefined, true);
+            const [items, totalResult] = yield Promise.all([cursor.toArray(), countCursor.toArray()]);
+            const total = (_d = (_c = totalResult === null || totalResult === void 0 ? void 0 : totalResult[0]) === null || _c === void 0 ? void 0 : _c.total) !== null && _d !== void 0 ? _d : 0;
+            const hasMore = page * COLLECTION_PAGE_SIZE < total;
+            const pageItems = items.length > COLLECTION_PAGE_SIZE
+                ? items.slice(0, COLLECTION_PAGE_SIZE)
+                : items;
+            if (recordHistory) {
+                addCollectionHistory({
+                    ts: Date.now(),
+                    collection,
+                    mode: 'aggregate',
+                    pipeline: sanitize(rawPipeline),
+                    sort: sort ? sanitize(sort) : undefined,
+                    runAsSystem,
+                    user: getUserInfo(resolvedUser),
+                    page
+                });
+            }
+            return {
+                items: sanitize(pageItems),
+                count: pageItems.length,
+                total,
+                page,
+                pageSize: COLLECTION_PAGE_SIZE,
+                hasMore
+            };
+        }
+        catch (error) {
+            const details = getErrorDetails(error);
+            reply.code(500);
+            return { error: details.message, stack: details.stack };
+        }
+    }));
+}), { name: 'monitoring' });
+exports.default = createMonitoringPlugin;