@mongoosejs/studio 0.5.0 → 0.5.2

package/backend/actions/Dashboard/getDashboard.js

@@ -2,6 +2,7 @@
 
 const Archetype = require('archetype');
 const authorize = require('../../authorize');
+const createSandbox = require('../../sandbox/createSandbox');
 const mongoose = require('mongoose');
 const { defaultMothershipURL } = require('../../../constants');
 
@@ -27,7 +28,7 @@ const GetDashboardParams = new Archetype({
   }
 }).compile('GetDashboardParams');
 
-module.exports = ({ studioConnection, options }) => async function getDashboard(params) {
+module.exports = ({ db, studioConnection, options }) => async function getDashboard(params) {
   const { $workspaceId, authorization, userId, dashboardId, evaluate, roles } = new GetDashboardParams(params);
   const Dashboard = studioConnection.model('__Studio_Dashboard');
   const DashboardResult = studioConnection.model('__Studio_DashboardResult');
@@ -38,10 +39,12 @@ module.exports = ({ studioConnection, options }) => async function getDashboard(
   const dashboard = await Dashboard.findOne({ _id: dashboardId });
   if (evaluate) {
     let result = null;
+    const sandbox = createSandbox({ db });
     const startExec = startDashboardEvaluate(DashboardResult, dashboardId, $workspaceId, userId);
     startExec.catch(() => {}); // Avoid unhandled promise rejections - we will handle this error later.
     try {
-      result = await dashboard.evaluate();
+      result = await sandbox.runScript({ script: dashboard.code });
+      addDocumentSchemaPaths(result);
     } catch (error) {
       const { dashboardResult } = await startExec.then(({ dashboardResult }) => {
         if (!dashboardResult) {
@@ -56,6 +59,12 @@ module.exports = ({ studioConnection, options }) => async function getDashboard(
         );
       });
       return { dashboard, dashboardResult, error: { message: error.message } };
+    } finally {
+      try {
+        await sandbox.close();
+      } catch (_) {
+        // Ignore sandbox cleanup errors so they do not mask the primary result.
+      }
     }
 
     try {
@@ -170,3 +179,21 @@ function getSortTime(result) {
   const time = new Date(candidate).getTime();
   return Number.isNaN(time) ? 0 : time;
 }
+
+function addDocumentSchemaPaths(result) {
+  const Model = result?.$document?.constructor;
+  if (!Model?.modelName || !Model.schema?.paths) {
+    return;
+  }
+
+  const schemaPaths = {};
+  for (const path of Object.keys(Model.schema.paths)) {
+    schemaPaths[path] = {
+      instance: Model.schema.paths[path].instance,
+      path,
+      ref: Model.schema.paths[path].options?.ref,
+      required: Model.schema.paths[path].options?.required
+    };
+  }
+  result.$document.schemaPaths = schemaPaths;
+}

package/backend/actions/Model/dropCollection.js

@@ -0,0 +1,29 @@
+'use strict';
+
+const Archetype = require('archetype');
+const authorize = require('../../authorize');
+
+const DropCollectionParams = new Archetype({
+  model: {
+    $type: 'string',
+    $required: true
+  },
+  roles: {
+    $type: ['string']
+  }
+}).compile('DropCollectionParams');
+
+module.exports = ({ db }) => async function dropCollection(params) {
+  const { model, roles } = new DropCollectionParams(params);
+
+  await authorize('Model.dropCollection', roles);
+
+  const Model = db.models[model];
+  if (Model == null) {
+    throw new Error(`Model ${model} not found`);
+  }
+
+  await Model.collection.drop();
+
+  return { ok: true };
+};

package/backend/actions/Model/exportQueryResults.js

@@ -62,9 +62,7 @@ module.exports = ({ db }) => async function exportQueryResults(params, req, res)
   }
   const csv = stringify(rows);
 
-  res.set({
-    'Content-Type': 'text/csv',
-    'Content-Disposition': `attachment; filename="${model.toLowerCase()}-export.csv"`
-  });
+  res.setHeader('Content-Type', 'text/csv');
+  res.setHeader('Content-Disposition', `attachment; filename="${model.toLowerCase()}-export.csv"`);
   return csv;
 };

package/backend/actions/Model/index.js

@@ -5,6 +5,7 @@ exports.createChatMessage = require('./createChatMessage');
 exports.createDocument = require('./createDocument');
 exports.deleteDocument = require('./deleteDocument');
 exports.deleteDocuments = require('./deleteDocuments');
+exports.dropCollection = require('./dropCollection');
 exports.dropIndex = require('./dropIndex');
 exports.executeDocumentScript = require('./executeDocumentScript');
 exports.exportQueryResults = require('./exportQueryResults');

package/backend/authorize.js

@@ -17,6 +17,7 @@ const actionsToRequiredRoles = {
   'Model.updateDocument': ['owner', 'admin', 'member'],
   'Model.deleteDocument': ['owner', 'admin', 'member'],
   'Model.deleteDocuments': ['owner', 'admin', 'member'],
+  'Model.dropCollection': ['owner', 'admin'],
   'Model.dropIndex': ['owner', 'admin'],
   'Model.executeDocumentScript': ['owner', 'admin', 'member'],
   'Model.exportQueryResults': ['owner', 'admin', 'member', 'readonly'],

package/backend/db/dashboardSchema.js

@@ -1,8 +1,6 @@
 'use strict';
 
-const MongooseStudioChartColors = require('../constants/mongooseStudioChartColors');
 const mongoose = require('mongoose');
-const vm = require('vm');
 
 const dashboardSchema = new mongoose.Schema({
   title: {
@@ -18,34 +16,4 @@ const dashboardSchema = new mongoose.Schema({
   }
 });
 
-dashboardSchema.methods.evaluate = async function evaluate() {
-  const context = vm.createContext({
-    db: this.constructor.db,
-    setTimeout,
-    ObjectId: mongoose.Types.ObjectId,
-    MongooseStudioChartColors
-  });
-  let result = null;
-  result = await vm.runInContext(formatFunction(this.code), context);
-  if (result.$document?.constructor?.modelName) {
-    const schemaPaths = {};
-    const Model = this.constructor.db.model(result.$document?.constructor?.modelName);
-    for (const path of Object.keys(Model.schema.paths)) {
-      schemaPaths[path] = {
-        instance: Model.schema.paths[path].instance,
-        path,
-        ref: Model.schema.paths[path].options?.ref,
-        required: Model.schema.paths[path].options?.required
-      };
-    }
-    result.$document.schemaPaths = schemaPaths;
-  }
-
-  return result;
-};
-
 module.exports = dashboardSchema;
-
-const formatFunction = code => `(async function() {
-  ${code}
-})();`;

package/backend/index.js

@@ -20,7 +20,7 @@ module.exports = function backend(db, studioConnection, options) {
 
   let changeStream = null;
   if (options?.changeStream) {
-    const conn = db instanceof mongoose.Mongoose ? db.connection : db;
+    const conn = db.connection ? db.connection : db;
     if (conn.readyState !== mongoose.Connection.STATES.connected) {
       conn._waitForConnect().then(() => {
         changeStream = conn.watch();

package/backend/integrations/callLLM.js

@@ -4,7 +4,6 @@ const { createAnthropic } = require('@ai-sdk/anthropic');
 const { createGoogleGenerativeAI } = require('@ai-sdk/google');
 const { createOpenAI } = require('@ai-sdk/openai');
 const { generateText, stepCountIs } = require('ai');
-const { defaultMothershipURL } = require('../../constants');
 
 module.exports = async function callLLM(messages, system, options) {
   let provider = null;
@@ -13,6 +12,7 @@ module.exports = async function callLLM(messages, system, options) {
 
   if (options?.openAIAPIKey) {
     providers.push({
+      name: 'OpenAI',
       provider: createOpenAI({ apiKey: options.openAIAPIKey }),
       model: options?.model ?? 'gpt-4o-mini'
     });
@@ -20,6 +20,7 @@ module.exports = async function callLLM(messages, system, options) {
 
   if (options?.anthropicAPIKey) {
     providers.push({
+      name: 'Anthropic',
       provider: createAnthropic({ apiKey: options.anthropicAPIKey }),
       model: options?.model ?? 'claude-haiku-4-5-20251001'
     });
@@ -27,13 +28,14 @@ module.exports = async function callLLM(messages, system, options) {
 
   if (options?.googleGeminiAPIKey) {
     providers.push({
+      name: 'Gemini',
       provider: createGoogleGenerativeAI({ apiKey: options.googleGeminiAPIKey }),
       model: options?.model ?? 'gemini-2.5-flash'
     });
   }
 
   if (providers.length > 1) {
-    throw new Error('Cannot set multiple LLM API keys');
+    throw new Error(`Cannot set multiple LLM API keys, found ${providers.map(p => p.name).join(', ')}`);
   }
 
   if (providers.length > 0) {
@@ -52,22 +54,5 @@ module.exports = async function callLLM(messages, system, options) {
     });
   }
 
-  const headers = { 'Content-Type': 'application/json' };
-  const response = await fetch(`${defaultMothershipURL}/getChatCompletion`, {
-    method: 'POST',
-    headers,
-    body: JSON.stringify({
-      messages: [{ role: 'system', content: { type: 'text', text: system } }, ...messages],
-      model: options?.model
-    })
-  }).then(response => {
-    if (!response.ok) {
-      return response.json().then(data => {
-        throw new Error(`Mongoose Studio chat completion error: ${data.message}`);
-      });
-    }
-    return response;
-  });
-
-  return await response.json().then(res => ({ text: res.response }));
+  throw new Error('No LLM API key configured. Set one of anthropicAPIKey, googleGeminiAPIKey, or openAIAPIKey.');
 };

package/backend/integrations/streamLLM.js

@@ -4,7 +4,6 @@ const { createAnthropic } = require('@ai-sdk/anthropic');
 const { createGoogleGenerativeAI } = require('@ai-sdk/google');
 const { createOpenAI } = require('@ai-sdk/openai');
 const { streamText, stepCountIs } = require('ai');
-const { defaultMothershipURL } = require('../../constants');
 
 module.exports = async function* streamLLM(messages, system, options) {
   let provider = null;
@@ -13,6 +12,7 @@ module.exports = async function* streamLLM(messages, system, options) {
 
   if (options?.openAIAPIKey) {
     providers.push({
+      name: 'OpenAI',
       provider: createOpenAI({ apiKey: options.openAIAPIKey }),
       model: options?.model ?? 'gpt-4o-mini'
     });
@@ -20,6 +20,7 @@ module.exports = async function* streamLLM(messages, system, options) {
 
   if (options?.anthropicAPIKey) {
     providers.push({
+      name: 'Anthropic',
       provider: createAnthropic({ apiKey: options.anthropicAPIKey }),
       model: options?.model ?? 'claude-haiku-4-5-20251001'
     });
@@ -27,13 +28,14 @@ module.exports = async function* streamLLM(messages, system, options) {
 
   if (options?.googleGeminiAPIKey) {
     providers.push({
+      name: 'Gemini',
       provider: createGoogleGenerativeAI({ apiKey: options.googleGeminiAPIKey }),
       model: options?.model ?? 'gemini-2.5-flash'
     });
   }
 
   if (providers.length > 1) {
-    throw new Error('Cannot set multiple LLM API keys');
+    throw new Error(`Cannot set multiple LLM API keys, found ${providers.map(p => p.name).join(', ')}`);
   }
 
   if (providers.length > 0) {
@@ -69,26 +71,5 @@ module.exports = async function* streamLLM(messages, system, options) {
     return;
   }
 
-  // If not using OpenAI, Anthropic, or Google Gemini, fallback to Mongoose (no streaming)
-  const headers = { 'Content-Type': 'application/json' };
-  const response = await fetch(`${defaultMothershipURL}/getChatCompletion`, {
-    method: 'POST',
-    headers,
-    body: JSON.stringify({
-      messages: [{ role: 'system', content: { type: 'text', text: system } }, ...messages],
-      model: options?.model
-    })
-  }).then(response => {
-    if (!response.ok) {
-      return response.json().then(data => {
-        throw new Error(`Mongoose Studio chat completion error: ${data.message}`);
-      });
-    }
-    return response;
-  });
-
-  const data = await response.json();
-
-  // Simulate streaming by yielding the whole response at once as a single chunk
-  yield data.response;
+  throw new Error('No LLM API key configured. Set one of anthropicAPIKey, googleGeminiAPIKey, or openAIAPIKey.');
 };

package/backend/next.js

@@ -81,8 +81,12 @@ module.exports = function next(conn, options) {
       throw new Error(`Action ${actionName} not found`);
     }
 
-    return actionFn(params)
+    return actionFn(params, req, res)
       .then(result => {
+        if (typeof result === 'string') {
+          res.status(200).send(result);
+          return result;
+        }
         res.status(200).json(result);
         return result;
       })

package/backend/sandbox/createSandbox.js

@@ -7,6 +7,12 @@ const { createScriptDb } = require('./createScriptDb');
 
 module.exports = function createSandbox({ db }) {
   const logs = [];
+
+  // db must be a connection, not a Mongoose instance
+  if (db.connection && db.connections) {
+    db = db.connection;
+  }
+
   const scriptDb = createScriptDb(db);
   if (!scriptDb.db.Types) {
     scriptDb.db.Types = mongoose.Types;

package/backend/vercel.js

@@ -0,0 +1,3 @@
+'use strict';
+
+module.exports = require('./next');

package/frontend/index.js

@@ -35,7 +35,8 @@ module.exports = async function frontend(apiUrl, isLambda, options, workspace) {
     baseURL: apiUrl,
     isLambda,
     mothershipUrl: apiKey ? mothershipUrl : null,
-    workspace: workspaceData
+    workspace: workspaceData,
+    hasLLMAPIKey: [options?.anthropicAPIKey, options?.googleGeminiAPIKey, options?.openAIAPIKey].some(v => v != null)
   };
 
   if (isLambda) {