@fourlights/strapi-plugin-deep-populate 1.8.0 → 1.9.1-rc.0

package/dist/server/index.js

@@ -23,6 +23,7 @@ require("node:stream");
 const cloneDeep = require("lodash/cloneDeep");
 const unset = require("lodash/unset");
 const get = require("lodash/get");
+const merge$2 = require("lodash/merge");
 const mergeWith = require("lodash/mergeWith");
 const set$2 = require("lodash/set");
 const _interopDefault = (e) => e && e.__esModule ? e : { default: e };
@@ -48,6 +49,7 @@ const require$$0__default$7 = /* @__PURE__ */ _interopDefault(require$$0$8);
 const cloneDeep__default = /* @__PURE__ */ _interopDefault(cloneDeep);
 const unset__default = /* @__PURE__ */ _interopDefault(unset);
 const get__default = /* @__PURE__ */ _interopDefault(get);
+const merge__default = /* @__PURE__ */ _interopDefault(merge$2);
 const mergeWith__default = /* @__PURE__ */ _interopDefault(mergeWith);
 const set__default = /* @__PURE__ */ _interopDefault(set$2);
 const config$1 = {
@@ -18549,6 +18551,20 @@ const cache = ({ strapi: strapi2 }) => ({
     }
   }
 });
+const sanitizeObject = (obj) => {
+  if (obj === null || typeof obj !== "object") return obj;
+  const dangerousProps = ["__proto__", "constructor", "prototype"];
+  const sanitized = {};
+  for (const key in obj) {
+    if (dangerousProps.includes(key)) continue;
+    if (typeof obj[key] === "object" && ___default.isNil(obj[key])) {
+      sanitized[key] = sanitizeObject(obj[key]);
+    } else {
+      sanitized[key] = obj[key];
+    }
+  }
+  return sanitized;
+};
 const getRelations = (model) => {
   const filteredAttributes = /* @__PURE__ */ new Set();
   const { populateCreatorFields } = getOptions(model);
@@ -18616,7 +18632,9 @@ async function _populateDynamicZone({
       inDynamicZone: true,
       ...params
     });
-    set__default.default(resolvedPopulate, [component], componentPopulate);
+    const currentPopulate = get__default.default(resolvedPopulate, [component]);
+    const mergedComponentPopulate = !currentPopulate && componentPopulate === true ? componentPopulate : merge__default.default({}, currentPopulate, sanitizeObject(componentPopulate));
+    set__default.default(resolvedPopulate, [component], mergedComponentPopulate);
   }
   if (isEmpty(resolvedPopulate)) return void 0;
   return { on: resolvedPopulate };
@@ -18648,7 +18666,7 @@ async function _populateRelation({
   }
   const newPopulate = {};
   for (const { documentId } of relations) {
-    const relationPopulate = resolvedRelations.get(documentId);
+    const relationPopulate = sanitizeObject(resolvedRelations.get(documentId));
     mergeWith__default.default(newPopulate, relationPopulate, (existing, proposed) => {
       if (proposed === true && existing) return existing;
       return void 0;
@@ -18667,17 +18685,17 @@ const _resolveValue = ({ document: document2, lookup, attrName }) => {
       throw Error("Nested dynamic zones are not supported");
     }
     const dynamicZoneValue = dynamicZoneLookup.length === 0 ? document2 : get__default.default(document2, dynamicZoneLookup, []);
-    const componentValue = dynamicZoneValue.filter((b) => b.__component === dynamicZoneComponent).map((c) => _resolveValue({ document: c, lookup: componentLookup, attrName }));
-    return (Array.isArray(componentValue) ? componentValue : [componentValue]).find((v) => hasValue(v));
+    const componentValue = dynamicZoneValue.filter((b) => b.__component === dynamicZoneComponent).flatMap((c) => _resolveValue({ document: c, lookup: componentLookup, attrName }));
+    return (Array.isArray(componentValue) ? componentValue : [componentValue]).filter((v) => hasValue(v));
   }
   if (populateIdx !== -1) {
     const parentLookup = lookup.slice(0, populateIdx);
     const childLookup = lookup.slice(populateIdx + 1, lookup.length);
     const parentValue2 = parentLookup.length === 0 ? document2 : get__default.default(document2, parentLookup);
-    const childValue = (Array.isArray(parentValue2) ? parentValue2 : [parentValue2]).map(
+    const childValue = (Array.isArray(parentValue2) ? parentValue2 : [parentValue2]).flatMap(
       (v) => _resolveValue({ document: v, lookup: childLookup, attrName })
     );
-    return childValue.find((v) => hasValue(v));
+    return childValue.filter((v) => hasValue(v));
   }
   const parentValue = lookup.length === 0 ? document2 : get__default.default(document2, lookup);
   if (Array.isArray(parentValue)) {
@@ -18819,7 +18837,7 @@ async function populate$1(params) {
   const { omitEmpty, localizations, contentTypes: contentTypes2 } = strapi.config.get("plugin::deep-populate");
   const contentTypeConfig = has__default.default(contentTypes2, "*") ? get__default.default(contentTypes2, "*") : {};
   if (has__default.default(contentTypes2, params.contentType)) {
-    mergeWith__default.default(contentTypeConfig, get__default.default(contentTypes2, params.contentType));
+    mergeWith__default.default(contentTypeConfig, sanitizeObject(get__default.default(contentTypes2, params.contentType)));
   }
   const { allow, deny } = contentTypeConfig;
   const resolvedRelations = /* @__PURE__ */ new Map();

package/dist/server/index.mjs

@@ -1,6 +1,6 @@
 import isEmpty$1 from "lodash/isEmpty";
 import isObject$2 from "lodash/isObject";
-import ___default from "lodash";
+import ___default, { isNil as isNil$1 } from "lodash";
 import { union as union$1, getOr, curry, isObject as isObject$3, isNil, clone as clone$2, isArray, pick as pick$1, isEmpty as isEmpty$2, cloneDeep, omit as omit$1, isString, trim as trim$1, pipe as pipe$2, split, map as map$2, flatten, first, constant, identity, join, eq, get } from "lodash/fp";
 import require$$1 from "crypto";
 import require$$0$1 from "child_process";
@@ -22,6 +22,7 @@ import "node:stream";
 import cloneDeep$1 from "lodash/cloneDeep";
 import unset from "lodash/unset";
 import get$1 from "lodash/get";
+import merge$2 from "lodash/merge";
 import mergeWith from "lodash/mergeWith";
 import set$2 from "lodash/set";
 const config$1 = {
@@ -18523,6 +18524,20 @@ const cache = ({ strapi: strapi2 }) => ({
     }
   }
 });
+const sanitizeObject = (obj) => {
+  if (obj === null || typeof obj !== "object") return obj;
+  const dangerousProps = ["__proto__", "constructor", "prototype"];
+  const sanitized = {};
+  for (const key in obj) {
+    if (dangerousProps.includes(key)) continue;
+    if (typeof obj[key] === "object" && isNil$1(obj[key])) {
+      sanitized[key] = sanitizeObject(obj[key]);
+    } else {
+      sanitized[key] = obj[key];
+    }
+  }
+  return sanitized;
+};
 const getRelations = (model) => {
   const filteredAttributes = /* @__PURE__ */ new Set();
   const { populateCreatorFields } = getOptions(model);
@@ -18590,7 +18605,9 @@ async function _populateDynamicZone({
       inDynamicZone: true,
       ...params
     });
-    set$2(resolvedPopulate, [component], componentPopulate);
+    const currentPopulate = get$1(resolvedPopulate, [component]);
+    const mergedComponentPopulate = !currentPopulate && componentPopulate === true ? componentPopulate : merge$2({}, currentPopulate, sanitizeObject(componentPopulate));
+    set$2(resolvedPopulate, [component], mergedComponentPopulate);
   }
   if (isEmpty(resolvedPopulate)) return void 0;
   return { on: resolvedPopulate };
@@ -18622,7 +18639,7 @@ async function _populateRelation({
   }
   const newPopulate = {};
   for (const { documentId } of relations) {
-    const relationPopulate = resolvedRelations.get(documentId);
+    const relationPopulate = sanitizeObject(resolvedRelations.get(documentId));
     mergeWith(newPopulate, relationPopulate, (existing, proposed) => {
       if (proposed === true && existing) return existing;
       return void 0;
@@ -18641,17 +18658,17 @@ const _resolveValue = ({ document: document2, lookup, attrName }) => {
       throw Error("Nested dynamic zones are not supported");
     }
     const dynamicZoneValue = dynamicZoneLookup.length === 0 ? document2 : get$1(document2, dynamicZoneLookup, []);
-    const componentValue = dynamicZoneValue.filter((b) => b.__component === dynamicZoneComponent).map((c) => _resolveValue({ document: c, lookup: componentLookup, attrName }));
-    return (Array.isArray(componentValue) ? componentValue : [componentValue]).find((v) => hasValue(v));
+    const componentValue = dynamicZoneValue.filter((b) => b.__component === dynamicZoneComponent).flatMap((c) => _resolveValue({ document: c, lookup: componentLookup, attrName }));
+    return (Array.isArray(componentValue) ? componentValue : [componentValue]).filter((v) => hasValue(v));
   }
   if (populateIdx !== -1) {
     const parentLookup = lookup.slice(0, populateIdx);
     const childLookup = lookup.slice(populateIdx + 1, lookup.length);
     const parentValue2 = parentLookup.length === 0 ? document2 : get$1(document2, parentLookup);
-    const childValue = (Array.isArray(parentValue2) ? parentValue2 : [parentValue2]).map(
+    const childValue = (Array.isArray(parentValue2) ? parentValue2 : [parentValue2]).flatMap(
       (v) => _resolveValue({ document: v, lookup: childLookup, attrName })
     );
-    return childValue.find((v) => hasValue(v));
+    return childValue.filter((v) => hasValue(v));
   }
   const parentValue = lookup.length === 0 ? document2 : get$1(document2, lookup);
   if (Array.isArray(parentValue)) {
@@ -18793,7 +18810,7 @@ async function populate$1(params) {
   const { omitEmpty, localizations, contentTypes: contentTypes2 } = strapi.config.get("plugin::deep-populate");
   const contentTypeConfig = has(contentTypes2, "*") ? get$1(contentTypes2, "*") : {};
   if (has(contentTypes2, params.contentType)) {
-    mergeWith(contentTypeConfig, get$1(contentTypes2, params.contentType));
+    mergeWith(contentTypeConfig, sanitizeObject(get$1(contentTypes2, params.contentType)));
   }
   const { allow, deny } = contentTypeConfig;
   const resolvedRelations = /* @__PURE__ */ new Map();

package/dist/server/src/utils/sanitizeObject.d.ts

@@ -0,0 +1 @@
+export declare const sanitizeObject: (obj: unknown) => unknown;

package/package.json

@@ -1,5 +1,5 @@
 {
-  "version": "1.8.0",
+  "version": "1.9.1-rc.0",
   "keywords": [
     "strapi",
     "strapi-plugin",