@mongoosejs/studio 0.4.0 → 0.4.1

package/README.md

@@ -12,6 +12,7 @@ For local dev, if your app runs on `localhost:3000`, Studio will be on `localhos
 
 By default, Mongoose Studio does **not** provide any authentication or authorization.
 You can use Mongoose Studio for free for local development, but we recommend [Mongoose Studio Pro](https://studio.mongoosejs.io/#pricing) for when you want to go into production.
+When you omit an API key, Mongoose Studio only accepts localhost connections by default.
 
 First, `npm install @mongoosejs/studio`.
 
@@ -43,6 +44,14 @@ opts.googleGeminiAPIKey = process.env.GOOGLE_GEMINI_API_KEY;
 app.use('/studio', await studio('/studio/api', mongoose, opts));
 ```
 
+Without an API key, you can allow access from additional IP addresses with `bindIp`, similar to MongoDB's `bindIp` option. `bindIp` may be a comma-separated string or an array of exact IP addresses. Set `bindIp` to `null` to allow unauthenticated connections from anywhere.
+
+```javascript
+app.use('/studio', await studio('/studio/api', mongoose, {
+  bindIp: '127.0.0.1,192.168.0.10'
+}));
+```
+
 ### Next.js
 
 First, add `withMongooseStudio` to your `next.config.js` file:

package/backend/actions/Model/getDocuments.js

@@ -5,7 +5,7 @@ const removeSpecifiedPaths = require('../../helpers/removeSpecifiedPaths');
 const evaluateFilter = require('../../helpers/evaluateFilter');
 const getRefFromSchemaType = require('../../helpers/getRefFromSchemaType');
 const getSuggestedProjection = require('../../helpers/getSuggestedProjection');
-const parseFieldsParam = require('../../helpers/parseFieldsParam');
+const parseProjectionParam = require('../../helpers/parseProjectionParam');
 const authorize = require('../../authorize');
 
 const GetDocumentsParams = new Archetype({
@@ -32,7 +32,7 @@ const GetDocumentsParams = new Archetype({
   sortDirection: {
     $type: 'number'
   },
-  fields: {
+  projectionInput: {
     $type: 'string'
   },
   roles: {
@@ -45,7 +45,7 @@ module.exports = ({ db }) => async function getDocuments(params) {
   const { roles } = params;
   await authorize('Model.getDocuments', roles);
 
-  const { model, limit, skip, sortKey, sortDirection, searchText, fields } = params;
+  const { model, limit, skip, sortKey, sortDirection, searchText, projectionInput } = params;
 
   const Model = db.models[model];
   if (Model == null) {
@@ -68,7 +68,10 @@ module.exports = ({ db }) => async function getDocuments(params) {
   }
 
   let query = Model.find(filter).limit(limit).skip(skip).sort(sortObj);
-  const projection = parseFieldsParam(fields);
+  const projection = parseProjectionParam({
+    projectionInput,
+    schemaPaths: Object.keys(Model.schema.paths)
+  });
   if (projection != null) {
     query = query.select(projection);
   }

package/backend/actions/Model/getDocumentsStream.js

@@ -5,7 +5,7 @@ const removeSpecifiedPaths = require('../../helpers/removeSpecifiedPaths');
 const evaluateFilter = require('../../helpers/evaluateFilter');
 const getRefFromSchemaType = require('../../helpers/getRefFromSchemaType');
 const getSuggestedProjection = require('../../helpers/getSuggestedProjection');
-const parseFieldsParam = require('../../helpers/parseFieldsParam');
+const parseProjectionParam = require('../../helpers/parseProjectionParam');
 const authorize = require('../../authorize');
 
 const GetDocumentsParams = new Archetype({
@@ -32,7 +32,7 @@ const GetDocumentsParams = new Archetype({
   sortDirection: {
     $type: 'number'
   },
-  fields: {
+  projectionInput: {
     $type: 'string'
   },
   roles: {
@@ -45,7 +45,7 @@ module.exports = ({ db }) => async function* getDocumentsStream(params) {
   const { roles } = params;
   await authorize('Model.getDocumentsStream', roles);
 
-  const { model, limit, skip, sortKey, sortDirection, searchText, fields } = params;
+  const { model, limit, skip, sortKey, sortDirection, searchText, projectionInput } = params;
 
   const Model = db.models[model];
   if (Model == null) {
@@ -68,7 +68,10 @@ module.exports = ({ db }) => async function* getDocumentsStream(params) {
   }
 
   let query = Model.find(filter).limit(limit).skip(skip).sort(sortObj).batchSize(1);
-  const projection = parseFieldsParam(fields);
+  const projection = parseProjectionParam({
+    projectionInput,
+    schemaPaths: Object.keys(Model.schema.paths)
+  });
   if (projection != null) {
     query = query.select(projection);
   }

package/backend/helpers/isBindIPConnection.js

@@ -0,0 +1,8 @@
+'use strict';
+
+module.exports = function isBindIPConnection(req, bindIp) {
+  if (bindIp == null) {
+    return true;
+  }
+  return bindIp.includes(req.ip || '');
+};

package/backend/helpers/isLocalhostConnection.js

@@ -0,0 +1,8 @@
+'use strict';
+
+module.exports = function isLocalhostConnection(req) {
+  const remoteAddress = req.ip || '';
+  return remoteAddress === '127.0.0.1' ||
+    remoteAddress === '::1' ||
+    remoteAddress === '::ffff:127.0.0.1';
+};

package/backend/helpers/normalizeBindIPOption.js

@@ -0,0 +1,16 @@
+'use strict';
+
+module.exports = function normalizeBindIPOption(bindIp) {
+  if (bindIp === null) {
+    return null;
+  }
+  if (bindIp === undefined) {
+    return ['localhost'];
+  }
+
+  const bindIps = Array.isArray(bindIp) ? bindIp : `${bindIp}`.split(',');
+  return bindIps.
+    flatMap(bindIp => `${bindIp}`.split(',')).
+    map(bindIp => bindIp.trim()).
+    filter(bindIp => bindIp.length > 0);
+};

package/backend/helpers/parseProjectionParam.js

@@ -0,0 +1,180 @@
+'use strict';
+
+/**
+ * Parse a raw projection input string into a Query.select()-compatible projection.
+ *
+ * Supports:
+ * - `name email`
+ * - `-password`
+ * - `+email`
+ * - `{ deletedAt: 1 }`
+ * - `{ password: 0 }`
+ *
+ * @param {Object} options
+ * @param {string|undefined} options.projectionInput
+ * @param {string[]} options.schemaPaths
+ * @returns {string|object|null}
+ */
+function parseProjectionParam({ projectionInput, schemaPaths }) {
+  return parseProjectionInput(projectionInput, schemaPaths);
+}
+
+function parseProjectionInput(projectionInput, schemaPaths) {
+  if (projectionInput == null || typeof projectionInput !== 'string') {
+    return null;
+  }
+  const trimmed = projectionInput.trim();
+  if (!trimmed) {
+    return null;
+  }
+
+  if (trimmed.startsWith('{') && trimmed.endsWith('}')) {
+    return parseProjectionObjectNotation(trimmed, schemaPaths);
+  }
+
+  const tokens = normalizeProjectionTokens(trimmed);
+  if (tokens === null || tokens.length === 0) {
+    return null;
+  }
+
+  const includeKeys = [];
+  const excludeKeys = [];
+
+  for (const rawToken of tokens) {
+    const token = rawToken.trim();
+    if (!token) {
+      continue;
+    }
+
+    const prefix = token[0];
+    if (prefix === '-') {
+      const path = token.slice(1).trim();
+      if (!path) {
+        return null;
+      }
+      excludeKeys.push(path);
+    } else if (prefix === '+') {
+      const path = token.slice(1).trim();
+      if (!path) {
+        return null;
+      }
+      includeKeys.push(path);
+    } else {
+      includeKeys.push(token);
+    }
+  }
+
+  if (includeKeys.length > 0 && excludeKeys.length > 0) {
+    const includeSet = new Set(includeKeys);
+    for (const path of excludeKeys) {
+      const ex = path;
+      for (const key of Array.from(includeSet)) {
+        if (key.toLowerCase() === ex.toLowerCase()) {
+          includeSet.delete(key);
+        }
+      }
+    }
+    if (includeSet.size === 0) {
+      return null;
+    }
+    return Array.from(includeSet).join(' ');
+  }
+
+  if (excludeKeys.length > 0) {
+    return excludeKeys.map(path => `-${path}`).join(' ');
+  }
+
+  return includeKeys.join(' ');
+}
+
+function normalizeProjectionTokens(trimmed) {
+  const rawTokens = trimmed.split(/[,\s]+/).filter(Boolean);
+  const tokens = [];
+  for (let i = 0; i < rawTokens.length; i++) {
+    const token = rawTokens[i];
+    if (token === '-' || token === '+') {
+      if (i + 1 >= rawTokens.length) {
+        return null;
+      }
+      tokens.push(token + rawTokens[++i]);
+    } else {
+      tokens.push(token);
+    }
+  }
+  return tokens;
+}
+
+function parseProjectionObjectNotation(trimmed, schemaPaths) {
+  const body = trimmed.slice(1, -1).trim();
+  if (!body) {
+    return null;
+  }
+
+  const pairRe = /(?:^|,)\s*(?:"([^"]+)"|'([^']+)'|([a-zA-Z_$][\w.$]*))\s*:\s*("[^"]*"|'[^']*'|[^,]+?)\s*(?=,|$)/g;
+  const includeKeys = [];
+  const excludeKeys = [];
+  let matchedChars = '';
+  let match;
+
+  while ((match = pairRe.exec(body)) !== null) {
+    matchedChars += match[0];
+    const key = (match[1] || match[2] || match[3] || '').trim();
+    const rawValue = (match[4] || '').trim();
+    if (!key || !rawValue) {
+      return null;
+    }
+    if (key === '__proto__' || key === 'constructor') {
+      throw new Error(`Invalid key: ${key}`);
+    }
+
+    const valueLower = rawValue.replace(/^['"]|['"]$/g, '').trim().toLowerCase();
+    const isInclude = valueLower === '1' || valueLower === 'true';
+    const isExclude = valueLower === '0' || valueLower === 'false';
+    if (!isInclude && !isExclude) {
+      return null;
+    }
+    if (isInclude) {
+      includeKeys.push(key);
+    } else {
+      excludeKeys.push(key);
+    }
+  }
+
+  const normalizedBody = body.replace(/\s+/g, '');
+  const normalizedMatched = matchedChars.replace(/\s+/g, '').replace(/^,/, '');
+  if (!normalizedMatched || normalizedMatched !== normalizedBody) {
+    return null;
+  }
+
+  if (includeKeys.length > 0 && excludeKeys.length > 0) {
+    const includeSet = new Set(includeKeys);
+    for (const path of excludeKeys) {
+      const ex = path;
+      for (const key of Array.from(includeSet)) {
+        if (key.toLowerCase() === ex.toLowerCase()) {
+          includeSet.delete(key);
+        }
+      }
+    }
+    if (includeSet.size === 0) {
+      return null;
+    }
+    return Array.from(includeSet).join(' ');
+  }
+
+  if (excludeKeys.length > 0) {
+    const projection = {};
+    for (const path of excludeKeys) {
+      projection[path] = 0;
+    }
+    return Object.keys(projection).length > 0 ? projection : null;
+  }
+
+  const projection = {};
+  for (const path of includeKeys) {
+    projection[path] = 1;
+  }
+  return Object.keys(projection).length > 0 ? projection : null;
+}
+
+module.exports = parseProjectionParam;

package/express.js

@@ -3,12 +3,17 @@
 const Backend = require('./backend');
 const express = require('express');
 const frontend = require('./frontend');
+const isBindIPConnection = require('./backend/helpers/isBindIPConnection');
+const isLocalhostConnection = require('./backend/helpers/isLocalhostConnection');
+const normalizeBindIPOption = require('./backend/helpers/normalizeBindIPOption');
 const { toRoute, objectRouter } = require('extrovert');
 const { defaultMothershipURL } = require('./constants');
 
 module.exports = async function mongooseStudioExpressApp(apiUrl, conn, options) {
   const router = express.Router();
   options = options ? { changeStream: true, ...options } : { changeStream: true };
+  const hasBindIpOption = Object.prototype.hasOwnProperty.call(options, 'bindIp');
+  const bindIp = normalizeBindIPOption(options.bindIp);
 
   const mothershipUrl = options._mothershipUrl || defaultMothershipURL;
   let workspace = null;
@@ -32,6 +37,17 @@ module.exports = async function mongooseStudioExpressApp(apiUrl, conn, options)
       .then(res => res.json()));
   }
 
+  if (!workspace && bindIp !== null) {
+    router.use((req, res, next) => {
+      const allowed = hasBindIpOption ? isBindIPConnection(req, bindIp) : isLocalhostConnection(req);
+      if (!allowed) {
+        return res.status(403).json({ message: 'Mongoose Studio without an API key only accepts localhost or configured bindIp connections' });
+      }
+
+      next();
+    });
+  }
+
   apiUrl = apiUrl || 'api';
   const backend = Backend(conn, options.studioConnection, options);
   delete backend.services;