@mongoosejs/studio 0.3.11 → 0.4.1

package/backend/helpers/parseProjectionParam.js

@@ -0,0 +1,180 @@
+'use strict';
+
+/**
+ * Parse a raw projection input string into a Query.select()-compatible projection.
+ *
+ * Supports:
+ * - `name email`
+ * - `-password`
+ * - `+email`
+ * - `{ deletedAt: 1 }`
+ * - `{ password: 0 }`
+ *
+ * @param {Object} options
+ * @param {string|undefined} options.projectionInput
+ * @param {string[]} options.schemaPaths
+ * @returns {string|object|null}
+ */
+function parseProjectionParam({ projectionInput, schemaPaths }) {
+  return parseProjectionInput(projectionInput, schemaPaths);
+}
+
+function parseProjectionInput(projectionInput, schemaPaths) {
+  if (projectionInput == null || typeof projectionInput !== 'string') {
+    return null;
+  }
+  const trimmed = projectionInput.trim();
+  if (!trimmed) {
+    return null;
+  }
+
+  if (trimmed.startsWith('{') && trimmed.endsWith('}')) {
+    return parseProjectionObjectNotation(trimmed, schemaPaths);
+  }
+
+  const tokens = normalizeProjectionTokens(trimmed);
+  if (tokens === null || tokens.length === 0) {
+    return null;
+  }
+
+  const includeKeys = [];
+  const excludeKeys = [];
+
+  for (const rawToken of tokens) {
+    const token = rawToken.trim();
+    if (!token) {
+      continue;
+    }
+
+    const prefix = token[0];
+    if (prefix === '-') {
+      const path = token.slice(1).trim();
+      if (!path) {
+        return null;
+      }
+      excludeKeys.push(path);
+    } else if (prefix === '+') {
+      const path = token.slice(1).trim();
+      if (!path) {
+        return null;
+      }
+      includeKeys.push(path);
+    } else {
+      includeKeys.push(token);
+    }
+  }
+
+  if (includeKeys.length > 0 && excludeKeys.length > 0) {
+    const includeSet = new Set(includeKeys);
+    for (const path of excludeKeys) {
+      const ex = path;
+      for (const key of Array.from(includeSet)) {
+        if (key.toLowerCase() === ex.toLowerCase()) {
+          includeSet.delete(key);
+        }
+      }
+    }
+    if (includeSet.size === 0) {
+      return null;
+    }
+    return Array.from(includeSet).join(' ');
+  }
+
+  if (excludeKeys.length > 0) {
+    return excludeKeys.map(path => `-${path}`).join(' ');
+  }
+
+  return includeKeys.join(' ');
+}
+
+function normalizeProjectionTokens(trimmed) {
+  const rawTokens = trimmed.split(/[,\s]+/).filter(Boolean);
+  const tokens = [];
+  for (let i = 0; i < rawTokens.length; i++) {
+    const token = rawTokens[i];
+    if (token === '-' || token === '+') {
+      if (i + 1 >= rawTokens.length) {
+        return null;
+      }
+      tokens.push(token + rawTokens[++i]);
+    } else {
+      tokens.push(token);
+    }
+  }
+  return tokens;
+}
+
+function parseProjectionObjectNotation(trimmed, schemaPaths) {
+  const body = trimmed.slice(1, -1).trim();
+  if (!body) {
+    return null;
+  }
+
+  const pairRe = /(?:^|,)\s*(?:"([^"]+)"|'([^']+)'|([a-zA-Z_$][\w.$]*))\s*:\s*("[^"]*"|'[^']*'|[^,]+?)\s*(?=,|$)/g;
+  const includeKeys = [];
+  const excludeKeys = [];
+  let matchedChars = '';
+  let match;
+
+  while ((match = pairRe.exec(body)) !== null) {
+    matchedChars += match[0];
+    const key = (match[1] || match[2] || match[3] || '').trim();
+    const rawValue = (match[4] || '').trim();
+    if (!key || !rawValue) {
+      return null;
+    }
+    if (key === '__proto__' || key === 'constructor') {
+      throw new Error(`Invalid key: ${key}`);
+    }
+
+    const valueLower = rawValue.replace(/^['"]|['"]$/g, '').trim().toLowerCase();
+    const isInclude = valueLower === '1' || valueLower === 'true';
+    const isExclude = valueLower === '0' || valueLower === 'false';
+    if (!isInclude && !isExclude) {
+      return null;
+    }
+    if (isInclude) {
+      includeKeys.push(key);
+    } else {
+      excludeKeys.push(key);
+    }
+  }
+
+  const normalizedBody = body.replace(/\s+/g, '');
+  const normalizedMatched = matchedChars.replace(/\s+/g, '').replace(/^,/, '');
+  if (!normalizedMatched || normalizedMatched !== normalizedBody) {
+    return null;
+  }
+
+  if (includeKeys.length > 0 && excludeKeys.length > 0) {
+    const includeSet = new Set(includeKeys);
+    for (const path of excludeKeys) {
+      const ex = path;
+      for (const key of Array.from(includeSet)) {
+        if (key.toLowerCase() === ex.toLowerCase()) {
+          includeSet.delete(key);
+        }
+      }
+    }
+    if (includeSet.size === 0) {
+      return null;
+    }
+    return Array.from(includeSet).join(' ');
+  }
+
+  if (excludeKeys.length > 0) {
+    const projection = {};
+    for (const path of excludeKeys) {
+      projection[path] = 0;
+    }
+    return Object.keys(projection).length > 0 ? projection : null;
+  }
+
+  const projection = {};
+  for (const path of includeKeys) {
+    projection[path] = 1;
+  }
+  return Object.keys(projection).length > 0 ? projection : null;
+}
+
+module.exports = parseProjectionParam;

package/backend/integrations/callLLM.js

@@ -3,7 +3,7 @@
 const { createAnthropic } = require('@ai-sdk/anthropic');
 const { createGoogleGenerativeAI } = require('@ai-sdk/google');
 const { createOpenAI } = require('@ai-sdk/openai');
-const { generateText } = require('ai');
+const { generateText, stepCountIs } = require('ai');
 const { defaultMothershipURL } = require('../../constants');
 
 module.exports = async function callLLM(messages, system, options) {
@@ -46,7 +46,9 @@ module.exports = async function callLLM(messages, system, options) {
     return generateText({
       model: provider(model),
       system,
-      messages
+      messages,
+      tools: options?.tools,
+      stopWhen: options?.tools ? stepCountIs(10) : undefined
     });
   }
 

package/backend/integrations/streamLLM.js

@@ -3,7 +3,7 @@
 const { createAnthropic } = require('@ai-sdk/anthropic');
 const { createGoogleGenerativeAI } = require('@ai-sdk/google');
 const { createOpenAI } = require('@ai-sdk/openai');
-const { streamText } = require('ai');
+const { streamText, stepCountIs } = require('ai');
 const { defaultMothershipURL } = require('../../constants');
 
 module.exports = async function* streamLLM(messages, system, options) {
@@ -44,16 +44,24 @@ module.exports = async function* streamLLM(messages, system, options) {
 
   if (provider) {
     let error = null;
-    const { textStream } = streamText({
+    const { fullStream } = streamText({
       model: provider(model),
       system,
       messages,
+      tools: options?.tools,
+      stopWhen: options?.tools ? stepCountIs(10) : undefined,
       onError(err) {
         error = err.error;
       }
     });
-    for await (const chunk of textStream) {
-      yield chunk;
+    for await (const chunk of fullStream) {
+      if (chunk.type === 'text-delta') {
+        yield chunk.text;
+      } else if (chunk.type === 'tool-call') {
+        yield { toolCall: { toolName: chunk.toolName, input: chunk.input } };
+      } else if (chunk.type === 'tool-result') {
+        yield { toolResult: { toolName: chunk.toolName, output: chunk.output } };
+      }
     }
     if (error) {
       throw error;

package/eslint.config.js

@@ -15,7 +15,8 @@ module.exports = defineConfig([
         fetch: true,
         setTimeout: true,
         process: true,
-        console: true
+        console: true,
+        __dirname: true
       }
     },
     extends: [config]

package/express.js

@@ -3,12 +3,17 @@
 const Backend = require('./backend');
 const express = require('express');
 const frontend = require('./frontend');
+const isBindIPConnection = require('./backend/helpers/isBindIPConnection');
+const isLocalhostConnection = require('./backend/helpers/isLocalhostConnection');
+const normalizeBindIPOption = require('./backend/helpers/normalizeBindIPOption');
 const { toRoute, objectRouter } = require('extrovert');
 const { defaultMothershipURL } = require('./constants');
 
 module.exports = async function mongooseStudioExpressApp(apiUrl, conn, options) {
   const router = express.Router();
   options = options ? { changeStream: true, ...options } : { changeStream: true };
+  const hasBindIpOption = Object.prototype.hasOwnProperty.call(options, 'bindIp');
+  const bindIp = normalizeBindIPOption(options.bindIp);
 
   const mothershipUrl = options._mothershipUrl || defaultMothershipURL;
   let workspace = null;
@@ -32,6 +37,17 @@ module.exports = async function mongooseStudioExpressApp(apiUrl, conn, options)
       .then(res => res.json()));
   }
 
+  if (!workspace && bindIp !== null) {
+    router.use((req, res, next) => {
+      const allowed = hasBindIpOption ? isBindIPConnection(req, bindIp) : isLocalhostConnection(req);
+      if (!allowed) {
+        return res.status(403).json({ message: 'Mongoose Studio without an API key only accepts localhost or configured bindIp connections' });
+      }
+
+      next();
+    });
+  }
+
   apiUrl = apiUrl || 'api';
   const backend = Backend(conn, options.studioConnection, options);
   delete backend.services;