@kalisio/kdk 2.6.4 → 2.7.0

package/coverage/map/api/hooks/hooks.query.js.html

@@ -25,7 +25,7 @@
             <div class='fl pad1y space-right2'>
                 <span class="strong">0% </span>
                 <span class="quiet">Statements</span>
-                <span class='fraction'>0/408</span>
+                <span class='fraction'>0/468</span>
             </div>
         
             
@@ -46,7 +46,7 @@
             <div class='fl pad1y space-right2'>
                 <span class="strong">0% </span>
                 <span class="quiet">Lines</span>
-                <span class='fraction'>0/408</span>
+                <span class='fraction'>0/468</span>
             </div>
         
             
@@ -471,7 +471,127 @@
 <a name='L406'></a><a href='#L406'>406</a>
 <a name='L407'></a><a href='#L407'>407</a>
 <a name='L408'></a><a href='#L408'>408</a>
-<a name='L409'></a><a href='#L409'>409</a></td><td class="line-coverage quiet"><span class="cline-any cline-no">&nbsp;</span>
+<a name='L409'></a><a href='#L409'>409</a>
+<a name='L410'></a><a href='#L410'>410</a>
+<a name='L411'></a><a href='#L411'>411</a>
+<a name='L412'></a><a href='#L412'>412</a>
+<a name='L413'></a><a href='#L413'>413</a>
+<a name='L414'></a><a href='#L414'>414</a>
+<a name='L415'></a><a href='#L415'>415</a>
+<a name='L416'></a><a href='#L416'>416</a>
+<a name='L417'></a><a href='#L417'>417</a>
+<a name='L418'></a><a href='#L418'>418</a>
+<a name='L419'></a><a href='#L419'>419</a>
+<a name='L420'></a><a href='#L420'>420</a>
+<a name='L421'></a><a href='#L421'>421</a>
+<a name='L422'></a><a href='#L422'>422</a>
+<a name='L423'></a><a href='#L423'>423</a>
+<a name='L424'></a><a href='#L424'>424</a>
+<a name='L425'></a><a href='#L425'>425</a>
+<a name='L426'></a><a href='#L426'>426</a>
+<a name='L427'></a><a href='#L427'>427</a>
+<a name='L428'></a><a href='#L428'>428</a>
+<a name='L429'></a><a href='#L429'>429</a>
+<a name='L430'></a><a href='#L430'>430</a>
+<a name='L431'></a><a href='#L431'>431</a>
+<a name='L432'></a><a href='#L432'>432</a>
+<a name='L433'></a><a href='#L433'>433</a>
+<a name='L434'></a><a href='#L434'>434</a>
+<a name='L435'></a><a href='#L435'>435</a>
+<a name='L436'></a><a href='#L436'>436</a>
+<a name='L437'></a><a href='#L437'>437</a>
+<a name='L438'></a><a href='#L438'>438</a>
+<a name='L439'></a><a href='#L439'>439</a>
+<a name='L440'></a><a href='#L440'>440</a>
+<a name='L441'></a><a href='#L441'>441</a>
+<a name='L442'></a><a href='#L442'>442</a>
+<a name='L443'></a><a href='#L443'>443</a>
+<a name='L444'></a><a href='#L444'>444</a>
+<a name='L445'></a><a href='#L445'>445</a>
+<a name='L446'></a><a href='#L446'>446</a>
+<a name='L447'></a><a href='#L447'>447</a>
+<a name='L448'></a><a href='#L448'>448</a>
+<a name='L449'></a><a href='#L449'>449</a>
+<a name='L450'></a><a href='#L450'>450</a>
+<a name='L451'></a><a href='#L451'>451</a>
+<a name='L452'></a><a href='#L452'>452</a>
+<a name='L453'></a><a href='#L453'>453</a>
+<a name='L454'></a><a href='#L454'>454</a>
+<a name='L455'></a><a href='#L455'>455</a>
+<a name='L456'></a><a href='#L456'>456</a>
+<a name='L457'></a><a href='#L457'>457</a>
+<a name='L458'></a><a href='#L458'>458</a>
+<a name='L459'></a><a href='#L459'>459</a>
+<a name='L460'></a><a href='#L460'>460</a>
+<a name='L461'></a><a href='#L461'>461</a>
+<a name='L462'></a><a href='#L462'>462</a>
+<a name='L463'></a><a href='#L463'>463</a>
+<a name='L464'></a><a href='#L464'>464</a>
+<a name='L465'></a><a href='#L465'>465</a>
+<a name='L466'></a><a href='#L466'>466</a>
+<a name='L467'></a><a href='#L467'>467</a>
+<a name='L468'></a><a href='#L468'>468</a>
+<a name='L469'></a><a href='#L469'>469</a></td><td class="line-coverage quiet"><span class="cline-any cline-no">&nbsp;</span>
+<span class="cline-any cline-no">&nbsp;</span>
+<span class="cline-any cline-no">&nbsp;</span>
+<span class="cline-any cline-no">&nbsp;</span>
+<span class="cline-any cline-no">&nbsp;</span>
+<span class="cline-any cline-no">&nbsp;</span>
+<span class="cline-any cline-no">&nbsp;</span>
+<span class="cline-any cline-no">&nbsp;</span>
+<span class="cline-any cline-no">&nbsp;</span>
+<span class="cline-any cline-no">&nbsp;</span>
+<span class="cline-any cline-no">&nbsp;</span>
+<span class="cline-any cline-no">&nbsp;</span>
+<span class="cline-any cline-no">&nbsp;</span>
+<span class="cline-any cline-no">&nbsp;</span>
+<span class="cline-any cline-no">&nbsp;</span>
+<span class="cline-any cline-no">&nbsp;</span>
+<span class="cline-any cline-no">&nbsp;</span>
+<span class="cline-any cline-no">&nbsp;</span>
+<span class="cline-any cline-no">&nbsp;</span>
+<span class="cline-any cline-no">&nbsp;</span>
+<span class="cline-any cline-no">&nbsp;</span>
+<span class="cline-any cline-no">&nbsp;</span>
+<span class="cline-any cline-no">&nbsp;</span>
+<span class="cline-any cline-no">&nbsp;</span>
+<span class="cline-any cline-no">&nbsp;</span>
+<span class="cline-any cline-no">&nbsp;</span>
+<span class="cline-any cline-no">&nbsp;</span>
+<span class="cline-any cline-no">&nbsp;</span>
+<span class="cline-any cline-no">&nbsp;</span>
+<span class="cline-any cline-no">&nbsp;</span>
+<span class="cline-any cline-no">&nbsp;</span>
+<span class="cline-any cline-no">&nbsp;</span>
+<span class="cline-any cline-no">&nbsp;</span>
+<span class="cline-any cline-no">&nbsp;</span>
+<span class="cline-any cline-no">&nbsp;</span>
+<span class="cline-any cline-no">&nbsp;</span>
+<span class="cline-any cline-no">&nbsp;</span>
+<span class="cline-any cline-no">&nbsp;</span>
+<span class="cline-any cline-no">&nbsp;</span>
+<span class="cline-any cline-no">&nbsp;</span>
+<span class="cline-any cline-no">&nbsp;</span>
+<span class="cline-any cline-no">&nbsp;</span>
+<span class="cline-any cline-no">&nbsp;</span>
+<span class="cline-any cline-no">&nbsp;</span>
+<span class="cline-any cline-no">&nbsp;</span>
+<span class="cline-any cline-no">&nbsp;</span>
+<span class="cline-any cline-no">&nbsp;</span>
+<span class="cline-any cline-no">&nbsp;</span>
+<span class="cline-any cline-no">&nbsp;</span>
+<span class="cline-any cline-no">&nbsp;</span>
+<span class="cline-any cline-no">&nbsp;</span>
+<span class="cline-any cline-no">&nbsp;</span>
+<span class="cline-any cline-no">&nbsp;</span>
+<span class="cline-any cline-no">&nbsp;</span>
+<span class="cline-any cline-no">&nbsp;</span>
+<span class="cline-any cline-no">&nbsp;</span>
+<span class="cline-any cline-no">&nbsp;</span>
+<span class="cline-any cline-no">&nbsp;</span>
+<span class="cline-any cline-no">&nbsp;</span>
+<span class="cline-any cline-no">&nbsp;</span>
+<span class="cline-any cline-no">&nbsp;</span>
 <span class="cline-any cline-no">&nbsp;</span>
 <span class="cline-any cline-no">&nbsp;</span>
 <span class="cline-any cline-no">&nbsp;</span>
@@ -880,10 +1000,12 @@
 <span class="cline-any cline-no">&nbsp;</span>
 <span class="cline-any cline-no">&nbsp;</span>
 <span class="cline-any cline-neutral">&nbsp;</span></td><td class="text"><pre class="prettyprint lang-js"><span class="cstat-no" title="statement not covered" ><span class="fstat-no" title="function not covered" ><span class="branch-0 cbranch-no" title="branch not covered" >import _ from 'lodash'</span></span></span>
+<span class="cstat-no" title="statement not covered" >import errors from '@feathersjs/errors'</span>
 <span class="cstat-no" title="statement not covered" >import { marshallGeometry } from '../marshall.js'</span>
 <span class="cstat-no" title="statement not covered" >import makeDebug from 'debug'</span>
 <span class="cstat-no" title="statement not covered" ></span>
 <span class="cstat-no" title="statement not covered" >const debug = makeDebug('kdk:map:query:hooks')</span>
+<span class="cstat-no" title="statement not covered" >const { Forbidden } = errors</span>
 <span class="cstat-no" title="statement not covered" ></span>
 <span class="cstat-no" title="statement not covered" >export function marshallGeometryQuery (hook) {</span>
 <span class="cstat-no" title="statement not covered" >  const query = hook.params.query</span>
@@ -1018,7 +1140,7 @@
 <span class="cstat-no" title="statement not covered" >    const params = hook.params</span>
 <span class="cstat-no" title="statement not covered" >    const query = params.query</span>
 <span class="cstat-no" title="statement not covered" >    if (!options.force &amp;&amp; !params.asGeoJson) return</span>
-<span class="cstat-no" title="statement not covered" >    if (query.$distinct || query.$aggregation) return // Not applicable in this case</span>
+<span class="cstat-no" title="statement not covered" >    if (_.has(query, '$distinct') || _.has(query, '$aggregation')) return // Not applicable in this case</span>
 <span class="cstat-no" title="statement not covered" >    const longitudeProperty = (options.longitudeProperty || 'longitude')</span>
 <span class="cstat-no" title="statement not covered" >    const latitudeProperty = (options.latitudeProperty || 'latitude')</span>
 <span class="cstat-no" title="statement not covered" >    const altitudeProperty = (options.altitudeProperty || 'altitude')</span>
@@ -1119,6 +1241,62 @@
 <span class="cstat-no" title="statement not covered" >  }</span>
 <span class="cstat-no" title="statement not covered" >}</span>
 <span class="cstat-no" title="statement not covered" ></span>
+<span class="cstat-no" title="statement not covered" ></span>
+<span class="cstat-no" title="statement not covered" ></span>
+<span class="cstat-no" title="statement not covered" >// Verifies that only authorized accumulation operators are used</span>
+<span class="cstat-no" title="statement not covered" >function validateGroupExpression(expression) {</span>
+<span class="cstat-no" title="statement not covered" >  // Safe accumulation operators for $group</span>
+<span class="cstat-no" title="statement not covered" >  const SAFE_GROUP_ACCUMULATORS = new Set([</span>
+<span class="cstat-no" title="statement not covered" >    '$sum', '$avg', '$first', '$last', '$max', '$min'</span>
+<span class="cstat-no" title="statement not covered" >  ])</span>
+<span class="cstat-no" title="statement not covered" >  // Safe expression operators usable in $group</span>
+<span class="cstat-no" title="statement not covered" >  const SAFE_GROUP_EXPRESSIONS = new Set([</span>
+<span class="cstat-no" title="statement not covered" >    // Arithmetic operators</span>
+<span class="cstat-no" title="statement not covered" >    '$add', '$subtract', '$multiply', '$divide', '$mod',</span>
+<span class="cstat-no" title="statement not covered" >    '$abs', '$ceil', '$floor', '$round', '$trunc',</span>
+<span class="cstat-no" title="statement not covered" >    '$sqrt', '$pow', '$exp', '$ln', '$log', '$log10',</span>
+<span class="cstat-no" title="statement not covered" >    // Comparison operators</span>
+<span class="cstat-no" title="statement not covered" >    '$eq', '$ne', '$gt', '$gte', '$lt', '$lte', '$cmp',</span>
+<span class="cstat-no" title="statement not covered" >    // Logical operators</span>
+<span class="cstat-no" title="statement not covered" >    '$and', '$or', '$not',</span>
+<span class="cstat-no" title="statement not covered" >    // Date operators</span>
+<span class="cstat-no" title="statement not covered" >    '$dateToString', '$year', '$month', '$dayOfMonth', '$hour',</span>
+<span class="cstat-no" title="statement not covered" >    '$minute', '$second', '$dayOfWeek', '$dayOfYear', '$week',</span>
+<span class="cstat-no" title="statement not covered" >    // Conditional operators</span>
+<span class="cstat-no" title="statement not covered" >    '$cond', '$ifNull', '$switch',</span>
+<span class="cstat-no" title="statement not covered" >    // Type operators</span>
+<span class="cstat-no" title="statement not covered" >    '$toString', '$toInt', '$toDouble'</span>
+<span class="cstat-no" title="statement not covered" >  ])</span>
+<span class="cstat-no" title="statement not covered" >  // Dangerous operators to reject in $group (arbitrary code execution)</span>
+<span class="cstat-no" title="statement not covered" >  const DANGEROUS_GROUP_OPERATORS = new Set([</span>
+<span class="cstat-no" title="statement not covered" >    '$accumulator',  // Custom JavaScript execution</span>
+<span class="cstat-no" title="statement not covered" >    '$function',     // JavaScript function execution</span>
+<span class="cstat-no" title="statement not covered" >    '$where'         // JavaScript code execution</span>
+<span class="cstat-no" title="statement not covered" >  ])</span>
+<span class="cstat-no" title="statement not covered" ></span>
+<span class="cstat-no" title="statement not covered" >  if (_.isNil(expression)) {</span>
+<span class="cstat-no" title="statement not covered" >    return</span>
+<span class="cstat-no" title="statement not covered" >  } else if (Array.isArray(expression)) {</span>
+<span class="cstat-no" title="statement not covered" >    expression.forEach(validateGroupExpression)</span>
+<span class="cstat-no" title="statement not covered" >    return</span>
+<span class="cstat-no" title="statement not covered" >  } else if (typeof expression === 'object') {</span>
+<span class="cstat-no" title="statement not covered" >    for (const [key, value] of Object.entries(expression)) {</span>
+<span class="cstat-no" title="statement not covered" >      // Check if it's an operator</span>
+<span class="cstat-no" title="statement not covered" >      if (key.startsWith('$')) {</span>
+<span class="cstat-no" title="statement not covered" >        if (DANGEROUS_GROUP_OPERATORS.has(key)) throw new Forbidden(`You are not allowed to use ${key} operator`)</span>
+<span class="cstat-no" title="statement not covered" ></span>
+<span class="cstat-no" title="statement not covered" >        // Check if operator is in the allowed list</span>
+<span class="cstat-no" title="statement not covered" >        const isAccumulator = SAFE_GROUP_ACCUMULATORS.has(key)</span>
+<span class="cstat-no" title="statement not covered" >        const isExpression = SAFE_GROUP_EXPRESSIONS.has(key)</span>
+<span class="cstat-no" title="statement not covered" >        if (!isAccumulator &amp;&amp; !isExpression) throw new Forbidden(`You are not allowed to use ${key} operator`)</span>
+<span class="cstat-no" title="statement not covered" >      }</span>
+<span class="cstat-no" title="statement not covered" ></span>
+<span class="cstat-no" title="statement not covered" >      // Recursively validate the value</span>
+<span class="cstat-no" title="statement not covered" >      validateGroupExpression(value)</span>
+<span class="cstat-no" title="statement not covered" >    }</span>
+<span class="cstat-no" title="statement not covered" >  }</span>
+<span class="cstat-no" title="statement not covered" >}</span>
+<span class="cstat-no" title="statement not covered" ></span>
 <span class="cstat-no" title="statement not covered" >export async function aggregateFeaturesQuery (hook) {</span>
 <span class="cstat-no" title="statement not covered" >  const query = hook.params.query</span>
 <span class="cstat-no" title="statement not covered" >  const service = hook.service</span>
@@ -1130,19 +1308,24 @@
 <span class="cstat-no" title="statement not covered" >    let featureId = (service.options ? service.options.featureId : [])</span>
 <span class="cstat-no" title="statement not covered" >    // Support compound ID</span>
 <span class="cstat-no" title="statement not covered" >    featureId = (Array.isArray(featureId) ? featureId : [featureId])</span>
+<span class="cstat-no" title="statement not covered" >    const hasFeatureId = !_.isEmpty(featureId)</span>
 <span class="cstat-no" title="statement not covered" >    let featureIdType = (service.options ? service.options.featureIdType : [])</span>
 <span class="cstat-no" title="statement not covered" >    featureIdType = (Array.isArray(featureIdType) ? featureIdType : [featureIdType])</span>
-<span class="cstat-no" title="statement not covered" >    const ids = typeof query.$groupBy === 'string' // Group by matching ID(s), ie single ID or array of field to create a compound ID</span>
-<span class="cstat-no" title="statement not covered" >      ? { [query.$groupBy]: '$properties.' + query.$groupBy }</span>
-<span class="cstat-no" title="statement not covered" >    // Aggregated in an accumulator to avoid conflict with feature properties</span>
-<span class="cstat-no" title="statement not covered" >      : query.$groupBy.reduce((object, id) =&gt; Object.assign(object, { [id]: '$properties.' + id }), {})</span>
-<span class="cstat-no" title="statement not covered" >    const groupBy = { _id: ids }</span>
-<span class="cstat-no" title="statement not covered" >    let keys = _.keys(ids)</span>
+<span class="cstat-no" title="statement not covered" >    // Default is not to group by UUID</span>
+<span class="cstat-no" title="statement not covered" >    const groupBy = { _id: '$_id' }</span>
+<span class="cstat-no" title="statement not covered" >    let keys = ['_id']</span>
+<span class="cstat-no" title="statement not covered" >    if (query.$groupBy) {</span>
+<span class="cstat-no" title="statement not covered" >      groupBy._id = typeof query.$groupBy === 'string' // Group by matching ID(s), ie single ID or array of field to create a compound ID</span>
+<span class="cstat-no" title="statement not covered" >        ? { [query.$groupBy]: '$properties.' + query.$groupBy }</span>
+<span class="cstat-no" title="statement not covered" >      // Aggregated in an accumulator to avoid conflict with feature properties</span>
+<span class="cstat-no" title="statement not covered" >        : query.$groupBy.reduce((object, id) =&gt; Object.assign(object, { [id]: '$properties.' + id }), {})</span>
+<span class="cstat-no" title="statement not covered" >      keys = _.keys(groupBy._id)</span>
+<span class="cstat-no" title="statement not covered" >    }</span>
 <span class="cstat-no" title="statement not covered" >    // Do we only keep first or last available time ?</span>
 <span class="cstat-no" title="statement not covered" >    const singleTime = (_.toNumber(query.$limit) === 1)</span>
 <span class="cstat-no" title="statement not covered" >    if (singleTime) {</span>
 <span class="cstat-no" title="statement not covered" >      // When single time no aggregation is performed at all so we only have raw features</span>
-<span class="cstat-no" title="statement not covered" >      keys = keys.map(key =&gt; 'properties.' + key)</span>
+<span class="cstat-no" title="statement not covered" >      if (hasFeatureId) keys = keys.map(key =&gt; 'properties.' + key)</span>
 <span class="cstat-no" title="statement not covered" >      // In this case no need to aggregate on each element we simply keep the first feature</span>
 <span class="cstat-no" title="statement not covered" >      // BUG: according to https://jira.mongodb.org/browse/SERVER-9507 MongoDB is not yet</span>
 <span class="cstat-no" title="statement not covered" >      // able to optimize this kind of operations to avoid full index scan</span>
@@ -1170,6 +1353,8 @@
 <span class="cstat-no" title="statement not covered" >    }</span>
 <span class="cstat-no" title="statement not covered" >    // Merge with any additional group expression</span>
 <span class="cstat-no" title="statement not covered" >    const group = _.get(query, '$group', {})</span>
+<span class="cstat-no" title="statement not covered" >    // Check for possible injection</span>
+<span class="cstat-no" title="statement not covered" >    validateGroupExpression(group)</span>
 <span class="cstat-no" title="statement not covered" >    Object.assign(groupBy, group)</span>
 <span class="cstat-no" title="statement not covered" >    // The query contains the match stage except options relevent to the aggregation pipeline</span>
 <span class="cstat-no" title="statement not covered" >    const match = _.omit(query, ['$group', '$groupBy', '$aggregate', '$geoNear', '$sort', '$limit', '$skip'])</span>
@@ -1184,6 +1369,8 @@
 <span class="cstat-no" title="statement not covered" >    // Ensure we do not mix results with/without relevant element values</span>
 <span class="cstat-no" title="statement not covered" >    // by separately querying each element then merging</span>
 <span class="cstat-no" title="statement not covered" >    let aggregatedResults</span>
+<span class="cstat-no" title="statement not covered" >    // Associative map used to optimize merging between aggregated elements</span>
+<span class="cstat-no" title="statement not covered" >    const aggregatedResultsMap = new Map()</span>
 <span class="cstat-no" title="statement not covered" >    const aggregateOptions = {</span>
 <span class="cstat-no" title="statement not covered" >      allowDiskUse: true</span>
 <span class="cstat-no" title="statement not covered" >    }</span>
@@ -1219,29 +1406,10 @@
 <span class="cstat-no" title="statement not covered" >      pipeline.forEach(stage =&gt; {</span>
 <span class="cstat-no" title="statement not covered" >        _.forOwn(stage, (value, key) =&gt; debug('Stage', key, value))</span>
 <span class="cstat-no" title="statement not covered" >      })</span>
-<span class="cstat-no" title="statement not covered" >      // Provide a hint to the aggregation targeting feature ID and aggregation elements.</span>
-<span class="cstat-no" title="statement not covered" >      // The problem with the aggregation hint option is that it should correspond</span>
-<span class="cstat-no" title="statement not covered" >      // exactly to an existing index otherwise it raises an error.</span>
-<span class="cstat-no" title="statement not covered" >      // We use a convention to get the order right: geometry =&gt; feature ID =&gt; aggregated element =&gt; time.</span>
-<span class="cstat-no" title="statement not covered" >      // We check anyway if the index does exist to avoid any error</span>
-<span class="cstat-no" title="statement not covered" >      // FIXME: Instead of assuming the appropriate index is defined in the right order,</span>
-<span class="cstat-no" title="statement not covered" >      // we might select the "best" available index (ie having the most similarities with the required one).</span>
-<span class="cstat-no" title="statement not covered" >      const hint = {}</span>
-<span class="cstat-no" title="statement not covered" >      if (isGeometry || query.$geoNear || match.geometry) Object.assign(hint, { geometry: '2dsphere' })</span>
-<span class="cstat-no" title="statement not covered" >      featureId.forEach(id =&gt; {</span>
-<span class="cstat-no" title="statement not covered" >        hint['properties.' + id] = 1</span>
-<span class="cstat-no" title="statement not covered" >      })</span>
-<span class="cstat-no" title="statement not covered" >      Object.assign(hint, { ['properties.' + element]: 1 })</span>
-<span class="cstat-no" title="statement not covered" >      // Use provided sort time option if any</span>
-<span class="cstat-no" title="statement not covered" >      hint.time = _.get(query, '$sort.time', 1)</span>
-<span class="cstat-no" title="statement not covered" >      const hintIndexName = _.reduce(hint, (name, value, key) =&gt; name ? `${name}_${key}_${value}` : `${key}_${value}`, '')</span>
-<span class="cstat-no" title="statement not covered" >      debug('Best aggregation hint index found', hintIndexName)</span>
-<span class="cstat-no" title="statement not covered" >      const hintIndex = _.find(indexes, { name: hintIndexName })</span>
 <span class="cstat-no" title="statement not covered" >      const aggregateElementOptions = Object.assign({}, aggregateOptions)</span>
-<span class="cstat-no" title="statement not covered" >      if (hintIndex) aggregateElementOptions.hint = hintIndexName</span>
 <span class="cstat-no" title="statement not covered" >      debug('Aggregation options', aggregateElementOptions)</span>
 <span class="cstat-no" title="statement not covered" >      const elementResults = await collection.aggregate(pipeline, aggregateElementOptions).toArray()</span>
-<span class="cstat-no" title="statement not covered" >      debug(`Generated ${elementResults.length} feature(s) for ${element} element`, elementResults)</span>
+<span class="cstat-no" title="statement not covered" >      debug(`Generated ${elementResults.length} feature(s) for ${element} element, picked first two`, elementResults.slice(0,2))</span>
 <span class="cstat-no" title="statement not covered" >      // Rearrange data so that we get ordered arrays indexed by element</span>
 <span class="cstat-no" title="statement not covered" >      elementResults.forEach(result =&gt; {</span>
 <span class="cstat-no" title="statement not covered" >        result.time = { [element]: result.time }</span>
@@ -1257,13 +1425,24 @@
 <span class="cstat-no" title="statement not covered" >      // Now merge with previous element results</span>
 <span class="cstat-no" title="statement not covered" >      if (!aggregatedResults) {</span>
 <span class="cstat-no" title="statement not covered" >        aggregatedResults = elementResults</span>
+<span class="cstat-no" title="statement not covered" >        aggregatedResults.forEach(result =&gt; {</span>
+<span class="cstat-no" title="statement not covered" >          // Keep track of result in map to improve search later</span>
+<span class="cstat-no" title="statement not covered" >          const resultKeys = keys.map(key =&gt; _.get(singleTime ? result : result._id, key))</span>
+<span class="cstat-no" title="statement not covered" >          const resultKey = resultKeys.join('-')</span>
+<span class="cstat-no" title="statement not covered" >          aggregatedResultsMap.set(resultKey, result)</span>
+<span class="cstat-no" title="statement not covered" >        })</span>
 <span class="cstat-no" title="statement not covered" >      } else {</span>
 <span class="cstat-no" title="statement not covered" >        elementResults.forEach(result =&gt; {</span>
-<span class="cstat-no" title="statement not covered" >          const resultKeys = _.pick(result, keys)</span>
+<span class="cstat-no" title="statement not covered" >          // When single time no aggregation is performed at all so we only have raw features</span>
+<span class="cstat-no" title="statement not covered" >          const resultKeys = keys.map(key =&gt; _.get(singleTime ? result : result._id, key))</span>
+<span class="cstat-no" title="statement not covered" >          /* Optimize previous result search with map, kept the naive code here for reference/debug purpose</span>
 <span class="cstat-no" title="statement not covered" >          const previousResult = aggregatedResults.find(aggregatedResult =&gt; {</span>
-<span class="cstat-no" title="statement not covered" >            const aggregatedResultKeys = _.pick(aggregatedResult, keys)</span>
+<span class="cstat-no" title="statement not covered" >            const aggregatedResultKeys = keys.map(key =&gt; _.get(singleTime ? result : result._id, key))</span>
 <span class="cstat-no" title="statement not covered" >            return _.isEqual(aggregatedResultKeys, resultKeys)</span>
 <span class="cstat-no" title="statement not covered" >          })</span>
+<span class="cstat-no" title="statement not covered" >          */</span>
+<span class="cstat-no" title="statement not covered" >          const resultKey = resultKeys.join('-')</span>
+<span class="cstat-no" title="statement not covered" >          const previousResult = aggregatedResultsMap.get(resultKey)</span>
 <span class="cstat-no" title="statement not covered" >          // Merge with previous matching feature if any</span>
 <span class="cstat-no" title="statement not covered" >          if (previousResult) {</span>
 <span class="cstat-no" title="statement not covered" >            Object.assign(previousResult.time, result.time)</span>
@@ -1274,6 +1453,7 @@
 <span class="cstat-no" title="statement not covered" >            _.set(previousResult, prefix + element, _.get(result, prefix + element))</span>
 <span class="cstat-no" title="statement not covered" >          } else {</span>
 <span class="cstat-no" title="statement not covered" >            aggregatedResults.push(result)</span>
+<span class="cstat-no" title="statement not covered" >            aggregatedResultsMap.set(resultKey, result)</span>
 <span class="cstat-no" title="statement not covered" >          }</span>
 <span class="cstat-no" title="statement not covered" >        })</span>
 <span class="cstat-no" title="statement not covered" >      }</span>
@@ -1283,7 +1463,7 @@
 <span class="cstat-no" title="statement not covered" >    delete query.$aggregate</span>
 <span class="cstat-no" title="statement not covered" >    delete query.$geoNear</span>
 <span class="cstat-no" title="statement not covered" >    // Set result to avoid service DB call</span>
-<span class="cstat-no" title="statement not covered" >    hook.result = aggregatedResults</span>
+<span class="cstat-no" title="statement not covered" >    hook.result = aggregatedResults || []</span>
 <span class="cstat-no" title="statement not covered" >  }</span>
 <span class="cstat-no" title="statement not covered" >  return hook</span>
 <span class="cstat-no" title="statement not covered" >}</span>
@@ -1294,7 +1474,7 @@
             <div class='footer quiet pad2 space-top1 center small'>
                 Code coverage generated by
                 <a href="https://istanbul.js.org/" target="_blank" rel="noopener noreferrer">istanbul</a>
-                at 2024-08-13T10:02:04.843Z
+                at 2026-03-10T09:15:24.743Z
             </div>
         <script src="../../../prettify.js"></script>
         <script>

package/coverage/map/api/hooks/index.html

@@ -25,7 +25,7 @@
             <div class='fl pad1y space-right2'>
                 <span class="strong">0% </span>
                 <span class="quiet">Statements</span>
-                <span class='fraction'>0/639</span>
+                <span class='fraction'>0/746</span>
             </div>
         
             
@@ -46,7 +46,7 @@
             <div class='fl pad1y space-right2'>
                 <span class="strong">0% </span>
                 <span class="quiet">Lines</span>
-                <span class='fraction'>0/639</span>
+                <span class='fraction'>0/746</span>
             </div>
         
             
@@ -84,13 +84,13 @@
 	<div class="chart"><div class="cover-fill" style="width: 0%"></div><div class="cover-empty" style="width: 100%"></div></div>
 	</td>
 	<td data-value="0" class="pct low">0%</td>
-	<td data-value="124" class="abs low">0/124</td>
+	<td data-value="171" class="abs low">0/171</td>
 	<td data-value="0" class="pct low">0%</td>
 	<td data-value="1" class="abs low">0/1</td>
 	<td data-value="0" class="pct low">0%</td>
 	<td data-value="1" class="abs low">0/1</td>
 	<td data-value="0" class="pct low">0%</td>
-	<td data-value="124" class="abs low">0/124</td>
+	<td data-value="171" class="abs low">0/171</td>
 	</tr>
 
 <tr>
@@ -114,13 +114,13 @@
 	<div class="chart"><div class="cover-fill" style="width: 0%"></div><div class="cover-empty" style="width: 100%"></div></div>
 	</td>
 	<td data-value="0" class="pct low">0%</td>
-	<td data-value="408" class="abs low">0/408</td>
+	<td data-value="468" class="abs low">0/468</td>
 	<td data-value="0" class="pct low">0%</td>
 	<td data-value="1" class="abs low">0/1</td>
 	<td data-value="0" class="pct low">0%</td>
 	<td data-value="1" class="abs low">0/1</td>
 	<td data-value="0" class="pct low">0%</td>
-	<td data-value="408" class="abs low">0/408</td>
+	<td data-value="468" class="abs low">0/468</td>
 	</tr>
 
 <tr>
@@ -146,7 +146,7 @@
             <div class='footer quiet pad2 space-top1 center small'>
                 Code coverage generated by
                 <a href="https://istanbul.js.org/" target="_blank" rel="noopener noreferrer">istanbul</a>
-                at 2024-08-13T10:02:04.843Z
+                at 2026-03-10T09:15:24.743Z
             </div>
         <script src="../../../prettify.js"></script>
         <script>

package/coverage/map/api/hooks/index.js.html

@@ -79,7 +79,7 @@
             <div class='footer quiet pad2 space-top1 center small'>
                 Code coverage generated by
                 <a href="https://istanbul.js.org/" target="_blank" rel="noopener noreferrer">istanbul</a>
-                at 2024-08-13T10:02:04.843Z
+                at 2026-03-10T09:15:24.743Z
             </div>
         <script src="../../../prettify.js"></script>
         <script>

package/coverage/map/api/index.html

@@ -116,7 +116,7 @@
             <div class='footer quiet pad2 space-top1 center small'>
                 Code coverage generated by
                 <a href="https://istanbul.js.org/" target="_blank" rel="noopener noreferrer">istanbul</a>
-                at 2024-08-13T10:02:04.843Z
+                at 2026-03-10T09:15:24.743Z
             </div>
         <script src="../../prettify.js"></script>
         <script>

package/coverage/map/api/index.js.html

@@ -124,7 +124,7 @@
             <div class='footer quiet pad2 space-top1 center small'>
                 Code coverage generated by
                 <a href="https://istanbul.js.org/" target="_blank" rel="noopener noreferrer">istanbul</a>
-                at 2024-08-13T10:02:04.843Z
+                at 2026-03-10T09:15:24.743Z
             </div>
         <script src="../../prettify.js"></script>
         <script>

package/coverage/map/api/marshall.js.html

@@ -163,7 +163,7 @@
             <div class='footer quiet pad2 space-top1 center small'>
                 Code coverage generated by
                 <a href="https://istanbul.js.org/" target="_blank" rel="noopener noreferrer">istanbul</a>
-                at 2024-08-13T10:02:04.843Z
+                at 2026-03-10T09:15:24.743Z
             </div>
         <script src="../../prettify.js"></script>
         <script>

package/coverage/map/api/models/alerts.model.mongodb.js.html

@@ -91,7 +91,7 @@
             <div class='footer quiet pad2 space-top1 center small'>
                 Code coverage generated by
                 <a href="https://istanbul.js.org/" target="_blank" rel="noopener noreferrer">istanbul</a>
-                at 2024-08-13T10:02:04.843Z
+                at 2026-03-10T09:15:24.743Z
             </div>
         <script src="../../../prettify.js"></script>
         <script>