@rapidrest/service-core 1.0.0-rc.9 → 1.0.0

package/dist/lib/models/ModelUtils.js

@@ -6,8 +6,10 @@ import { RecoverableBaseEntity } from "./RecoverableBaseEntity.js";
 import { ApiErrorMessages, ApiErrors } from "../ApiErrors.js";
 const logger = Logger();
 const REGEX_QUERY_PARAM_VALUE = new RegExp(/^([a-zA-Z]+)\((.*)\)$/, "i");
-const REGEX_RESERVED_QUERY_PARAMS = new RegExp("(jwt_|oauth_|auth_|cache).*", "i");
-const REGEX_QUERY_LIMITS = new RegExp("(limit|page|sort).*", "i");
+// Anchored at the start so these only match the intended reserved parameter names/prefixes and not any
+// field that merely contains one as a substring (e.g. "sortOrder", "rateLimit", "packageId", "homepage").
+const REGEX_RESERVED_QUERY_PARAMS = new RegExp("^(jwt_|oauth_|auth_|cache).*", "i");
+const REGEX_QUERY_LIMITS = new RegExp("^(limit|page|sort)$", "i");
 const REGEX_QUERY_SORT_STRING = new RegExp(/^\{.*\}$/, "i");
 // Apparently calling JSON.stringify on RegExp returns an empty set. So the recommended way to
 // overcome this is by adding a `toJSON` method that uses the `toString` instead which will
@@ -21,7 +23,7 @@ RegExp.prototype.toJSON = RegExp.prototype.toString;
 export class ModelUtils {
     /**
      * Provides the `typeorm` module to use when building SQL queries. This is called automatically when a SQL
-     * datastore connection is established.
+     * datasource connection is established.
      *
      * @param module The `typeorm` module.
      */
@@ -33,7 +35,7 @@ export class ModelUtils {
      */
     static get orm() {
         if (!ModelUtils.typeOrm) {
-            throw new Error("SQL query construction requires the optional peer dependency 'typeorm' but no SQL datastore has been initialized.");
+            throw new Error("SQL query construction requires the optional peer dependency 'typeorm' but no SQL datasource has been initialized.");
         }
         return ModelUtils.typeOrm;
     }
@@ -65,6 +67,34 @@ export class ModelUtils {
         ModelUtils.idPropertyCache.set(modelClass, results);
         return results;
     }
+    /**
+     * Retrieves a list of all of the specified class's properties that have the @ReadOnly decorator applied.
+     *
+     * @param modelClass The class definition to search for read-only properties from.
+     * @returns The list of all property names that have the @ReadOnly decorator applied.
+     */
+    static getReadOnlyPropertyNames(modelClass) {
+        const results = [];
+        if (ModelUtils.readOnlyPropertyCache.has(modelClass)) {
+            return ModelUtils.readOnlyPropertyCache.get(modelClass);
+        }
+        // The props don't show up correctly on the class def. So instantiate a dummy object that we can read the props
+        // from and look for read-only fields.
+        let proto = Object.getPrototypeOf(new modelClass());
+        while (proto) {
+            const props = Object.getOwnPropertyNames(proto);
+            for (const prop of props) {
+                const isReadOnly = Reflect.getMetadata("rrst:readOnly", proto, prop);
+                if (isReadOnly) {
+                    results.push(prop);
+                }
+            }
+            proto = Object.getPrototypeOf(proto);
+        }
+        // Cache the results so we're not always having to walk the class structure
+        ModelUtils.readOnlyPropertyCache.set(modelClass, results);
+        return results;
+    }
     /**
      * Builds a query object for use with `find` functions of the given repository for retrieving objects matching the
      * specified unique identifier.
@@ -73,14 +103,19 @@ export class ModelUtils {
      * @param modelClass The class definition of the data model to build a search query for.
      * @param id The unique identifier to search for.
      * @param version The version number of the document to search for.
+     * @param includeDeleted Set to false to exclude soft-deleted `RecoverableBaseEntity` records from matching.
+     * Defaults to true (matches regardless of deleted state) to preserve existing lookup/validation behavior;
+     * callers that expose a record by id to an API client (e.g. `findOne`, `exists`) should pass false so a
+     * soft-deleted record doesn't remain fully readable/resurrectable, the same way `buildSearchQuery` already
+     * excludes deleted records by default for list-style queries.
      * @returns An object that can be passed to a TypeORM `find` function.
      */
-    static buildIdSearchQuery(repo, modelClass, id, version) {
+    static buildIdSearchQuery(repo, modelClass, id, version, includeDeleted = true) {
         if (repo instanceof MongoRepository) {
-            return ModelUtils.buildIdSearchQueryMongo(modelClass, id, version);
+            return ModelUtils.buildIdSearchQueryMongo(modelClass, id, version, includeDeleted);
         }
         else {
-            return ModelUtils.buildIdSearchQuerySQL(modelClass, id, version);
+            return ModelUtils.buildIdSearchQuerySQL(modelClass, id, version, includeDeleted);
         }
     }
     /**
@@ -92,8 +127,9 @@ export class ModelUtils {
      * @param version The version number of the document to search for.
      * @returns An object that can be passed to a TypeORM `find` function.
      */
-    static buildIdSearchQuerySQL(modelClass, id, version) {
+    static buildIdSearchQuerySQL(modelClass, id, version, includeDeleted = true) {
         const props = ModelUtils.getIdPropertyNames(modelClass);
+        const isRecoverable = new modelClass() instanceof RecoverableBaseEntity;
         // Create the where in SQL syntax. We only care about one of the identifier field's matching.
         // e.g. WHERE idField1 = :idField1 OR idField2 = :idField2 ...
         const where = [];
@@ -102,6 +138,11 @@ export class ModelUtils {
             if (version !== undefined) {
                 q.version = version;
             }
+            // By default we don't want an id-based lookup to match a soft-deleted recoverable object,
+            // matching the same default `buildSearchQuery` applies to list-style queries.
+            if (isRecoverable && !includeDeleted) {
+                q.deleted = false;
+            }
             where.push(q);
         }
         return { where };
@@ -113,10 +154,12 @@ export class ModelUtils {
      * @param modelClass The class definition of the data model to build a search query for.
      * @param id The unique identifier to search for.
      * @param version The version number of the document to search for.
+     * @param includeDeleted Set to true to also match soft-deleted `RecoverableBaseEntity` records.
      * @returns An object that can be passed to a MongoDB `find` function.
      */
-    static buildIdSearchQueryMongo(modelClass, id, version) {
+    static buildIdSearchQueryMongo(modelClass, id, version, includeDeleted = true) {
         const props = ModelUtils.getIdPropertyNames(modelClass);
+        const isRecoverable = new modelClass() instanceof RecoverableBaseEntity;
         // We want to performa case-insensitive search. We used to convert strings to RegEx but this is _very_
         // slow. Instead, we use case-insenstive indexes that are configured using the `collation` option. Now
         // we only need to pass in the raw string. So we skip this section but we retain the code for historical
@@ -138,6 +181,11 @@ export class ModelUtils {
             if (version !== undefined) {
                 q.version = version;
             }
+            // By default we don't want an id-based lookup to match a soft-deleted recoverable object,
+            // matching the same default `buildSearchQuery` applies to list-style queries.
+            if (isRecoverable && !includeDeleted) {
+                q.deleted = false;
+            }
             query.push(q);
         }
         return { $or: query };
@@ -179,7 +227,9 @@ export class ModelUtils {
                     case "gte":
                         return MoreThanOrEqual(value);
                     case "in": {
-                        const args = value.split(",");
+                        // Split the raw match text, not `value`: a comma-joined list like "1,5" can itself parse
+                        // as a valid `Date` above (e.g. "1,5" -> Jan 5), leaving `value` a Date with no `.split()`.
+                        const args = matches[2].split(",");
                         return In(args);
                     }
                     case "like":
@@ -191,8 +241,14 @@ export class ModelUtils {
                     case "ne":
                     case "not":
                         return Not(value);
+                    case "nin": {
+                        // See "in" above for why this splits `matches[2]` instead of `value`.
+                        const args = matches[2].split(",");
+                        return Not(In(args));
+                    }
                     case "range": {
-                        const args = value.split(",");
+                        // See "in" above for why this splits `matches[2]` instead of `value`.
+                        const args = matches[2].split(",");
                         if (args.length !== 2) {
                             const msg = StringUtils.findAndReplace(ApiErrorMessages.SEARCH_INVALID_RANGE, {
                                 value,
@@ -228,6 +284,45 @@ export class ModelUtils {
             return param;
         }
     }
+    /**
+     * Recursively verifies that no key in the given value (at any depth, including keys of objects nested inside
+     * arrays) is a MongoDB operator (starts with `$`) or uses dot-notation field addressing (contains `.`). Client
+     * input is only ever meant to supply plain field values/comparison operands — never raw Mongo query operators —
+     * so any such key indicates an attempt to inject arbitrary query behavior (e.g. `$where`, `$expr`, or reaching
+     * into a field the API doesn't expose via dot-notation).
+     *
+     * @param value The value to check, typically a parsed query parameter.
+     * @throws {ApiError} If an operator-like or dotted key is found anywhere in `value`.
+     */
+    static assertNoOperatorInjection(value) {
+        if (Array.isArray(value)) {
+            for (const item of value) {
+                ModelUtils.assertNoOperatorInjection(item);
+            }
+        }
+        else if (value && typeof value === "object") {
+            for (const key of Object.keys(value)) {
+                if (key.startsWith("$") || key.includes(".")) {
+                    throw new ApiError(ApiErrors.INVALID_REQUEST, 400, ApiErrorMessages.INVALID_REQUEST);
+                }
+                ModelUtils.assertNoOperatorInjection(value[key]);
+            }
+        }
+    }
+    /**
+     * Best-effort check for regex patterns vulnerable to catastrophic backtracking (ReDoS). Rejects patterns that
+     * are unreasonably long, or that contain a quantified group whose contents are themselves quantified (e.g.
+     * `(a+)+`, `(a*)*`) — the classic shape that causes exponential backtracking in JS's regex engine. This is not
+     * an exhaustive defense; it catches the common cases a client would realistically send.
+     *
+     * @param pattern The user-supplied `like()` pattern.
+     */
+    static isUnsafeRegexPattern(pattern) {
+        if (pattern.length > ModelUtils.MAX_LIKE_PATTERN_LENGTH) {
+            return true;
+        }
+        return /\([^()]*[+*]\)[+*{]/.test(pattern);
+    }
     /**
      * Given a string containing a parameter value and/or a comparison operation return a MongoDB compatible find value.
      * e.g.
@@ -256,6 +351,11 @@ export class ModelUtils {
                         value = matches[2];
                     }
                 }
+                // `value` is the client-supplied comparison operand — reject any Mongo operator/dotted key hidden
+                // inside it, regardless of which (trusted, framework-constructed) operator wrapper it ends up
+                // under below. Must run *after* the parse fallback above, not inside its try/catch, so a
+                // rejection here isn't silently swallowed as a "not valid JSON" case.
+                ModelUtils.assertNoOperatorInjection(value);
                 switch (opName) {
                     case "eq":
                         return value;
@@ -264,15 +364,23 @@ export class ModelUtils {
                     case "gte":
                         return { $gte: value };
                     case "in": {
-                        const args = value.split(",");
+                        // Split the raw match text, not `value`: a comma-joined list like "1,5" can itself parse
+                        // as a valid `Date` above (e.g. "1,5" -> Jan 5), leaving `value` a Date with no `.split()`.
+                        const args = matches[2].split(",");
                         return { $in: args };
                     }
                     case "nin": {
-                        const args = value.split(",");
+                        // See "in" above for why this splits `matches[2]` instead of `value`.
+                        const args = matches[2].split(",");
                         return { $nin: args };
                     }
-                    case "like":
-                        return { $regex: value, $options: "i" };
+                    case "like": {
+                        const pattern = String(value);
+                        if (ModelUtils.isUnsafeRegexPattern(pattern)) {
+                            throw new ApiError(ApiErrors.INVALID_REQUEST, 400, ApiErrorMessages.INVALID_REQUEST);
+                        }
+                        return { $regex: pattern, $options: "i" };
+                    }
                     case "lt":
                         return { $lt: value };
                     case "lte":
@@ -282,7 +390,8 @@ export class ModelUtils {
                     case "not":
                         return { $not: value };
                     case "range": {
-                        const args = value.split(",");
+                        // See "in" above for why this splits `matches[2]` instead of `value`.
+                        const args = matches[2].split(",");
                         if (args.length !== 2) {
                             const msg = StringUtils.findAndReplace(ApiErrorMessages.SEARCH_INVALID_RANGE, {
                                 value,
@@ -290,31 +399,45 @@ export class ModelUtils {
                             });
                             throw new ApiError(ApiErrors.SEARCH_INVALID_RANGE, 400, msg);
                         }
+                        // Attempt to parse the range values to native types, falling back to the raw strings
+                        let gte = args[0];
+                        let lte = args[1];
                         try {
-                            // Attempt to parse the range values to native types
-                            return { $gte: JSON.parse(args[0]), $lte: JSON.parse(args[1]) };
+                            gte = JSON.parse(args[0]);
+                            lte = JSON.parse(args[1]);
                         }
                         catch (err) {
-                            return { $gte: args[0], $lte: args[1] };
+                            // Not valid JSON — fall back to the raw strings assigned above.
                         }
+                        ModelUtils.assertNoOperatorInjection(gte);
+                        ModelUtils.assertNoOperatorInjection(lte);
+                        return { $gte: gte, $lte: lte };
                     }
                     default:
                         return value;
                 }
             }
             else {
+                // Attempt to parse the value to a native type, falling back to a date/string if it's not valid JSON
+                let parsed;
                 try {
-                    // Attempt to parse the value to a native type
-                    return JSON.parse(param);
+                    parsed = JSON.parse(param);
                 }
                 catch (err) {
-                    // If an error occurred it's because the value is a string or date, not another type.
                     const date = new Date(param);
                     return !isNaN(date.valueOf()) ? date : param;
                 }
+                ModelUtils.assertNoOperatorInjection(parsed);
+                return parsed;
             }
         }
         else {
+            // A non-string value only reaches here when the caller already parsed the raw query into native
+            // types itself (e.g. the `q` base64-encoded JSON query parameter in RouteUtils.wrapMiddleware) —
+            // it never passed through the string-only checks above, so it must be validated here instead.
+            // Without this, a client could smuggle a raw Mongo operator (e.g. `{"$ne": null}`) straight into
+            // the query by supplying it as a JSON object rather than an `op(value)`-encoded string.
+            ModelUtils.assertNoOperatorInjection(param);
             return param;
         }
     }
@@ -338,25 +461,24 @@ export class ModelUtils {
      *
      * @param modelClass The class definition of the data model to build a search query for.
      * @param repo The repository to build a search query for.
-     * @param {any} params The URI parameters for the endpoint that was requested.
-     * @param {any} queryParams The URI query parameters that were included in the request.
+     * @param {any} query The search query parameters to include.
      * @param {bool} exactMatch Set to true to create a query where parameters are to be matched exactly, otherwise set to false to use a 'contains' search.
      * @param {any} user The user that is performing the request.
      * @returns {object} The TypeORM compatible query object.
      */
-    static buildSearchQuery(modelClass, repo, params, queryParams, exactMatch = false, user) {
+    static buildSearchQuery(modelClass, repo, query = {}, exactMatch = false, user) {
         // By default we don't want to return deleted recoverable objects unless explicitly requested
         if (new modelClass() instanceof RecoverableBaseEntity) {
-            queryParams = {
-                ...queryParams,
-                deleted: queryParams && "deleted" in queryParams ? queryParams.deleted : false,
+            query = {
+                ...query,
+                deleted: query && "deleted" in query ? query.deleted : false,
             };
         }
         if (repo instanceof MongoRepository) {
-            return ModelUtils.buildSearchQueryMongo(modelClass, params, queryParams, exactMatch, user);
+            return ModelUtils.buildSearchQueryMongo(modelClass, query, exactMatch, user);
         }
         else {
-            return ModelUtils.buildSearchQuerySQL(modelClass, params, queryParams, exactMatch, user);
+            return ModelUtils.buildSearchQuerySQL(modelClass, query, exactMatch, user);
         }
     }
     /**
@@ -376,26 +498,22 @@ export class ModelUtils {
      * When no operator is provided the comparison will always be evaluated as `eq`.
      *
      * @param modelClass The class definition of the data model to build a search query for.
-     * @param {any} params The URI parameters for the endpoint that was requested.
-     * @param {any} queryParams The URI query parameters that were included in the request.
+     * @param {any} query The search query parameters to include.
      * @param {bool} exactMatch Set to true to create a query where parameters are to be matched exactly, otherwise set to false to use a 'contains' search.
      * @param {any} user The user that is performing the request.
      * @returns {object} The TypeORM compatible query object.
      */
-    static buildSearchQuerySQL(modelClass, params, queryParams, exactMatch = false, user) {
-        const query = {};
-        query.where = [];
-        // Add the URL parameters
-        for (const key in params) {
+    static buildSearchQuerySQL(modelClass, query = {}, exactMatch = false, user) {
+        const result = {};
+        result.where = [];
+        // Pre-process any query values (e.g. the `me` identifier)
+        for (const key in query) {
             // If the value is 'me' that's a special keyword to reference the user ID.
-            if (params[key] === "me") {
+            if (query[key] === "me") {
                 if (!user) {
                     throw new ApiError(ApiErrors.SEARCH_INVALID_ME_REFERENCE, 403, ApiErrorMessages.SEARCH_INVALID_ME_REFERENCE);
                 }
-                query.where[key] = user.uid;
-            }
-            else {
-                query.where[key] = params[key];
+                query[key] = user.uid;
             }
         }
         // Query parameters can be a single value or multiple. In the case of multiple we want to perform an OR
@@ -403,8 +521,8 @@ export class ModelUtils {
         // the parameters as well.
         // So first let's find out how many queries in total we are going to need.
         let numQueries = 1;
-        for (const key in queryParams) {
-            const value = queryParams[key];
+        for (const key in query) {
+            const value = query[key];
             if (Array.isArray(value)) {
                 if (value.length > numQueries) {
                     numQueries = value.length;
@@ -414,20 +532,20 @@ export class ModelUtils {
         // logger?.debug(`Query params: ${JSON.stringify(queryParams)}`);
         // Now go through each query paramater. If the parameter is a single value, add it to each query object. If it's an array,
         // add only one value to each query object.
-        for (let key in queryParams) {
+        for (let key in query) {
             // Ignore reserved query parameters
             if (key.match(REGEX_RESERVED_QUERY_PARAMS)) {
                 continue;
             }
             // Limit, page and sort are reserved for specifying query limits
             if (key.match(REGEX_QUERY_LIMITS)) {
-                let value = queryParams[key];
+                let value = query[key];
                 if (key === "limit") {
                     key = "take";
-                    query[key] = Number(value);
+                    result[key] = Number(value);
                 }
                 else if (key === "page") {
-                    query[key] = Number(value);
+                    result[key] = Number(value);
                 }
                 else if (key === "sort") {
                     key = "order";
@@ -442,42 +560,45 @@ export class ModelUtils {
                             value = newValue;
                         }
                     }
-                    query[key] = value;
+                    result[key] = value;
                 }
                 continue;
             }
-            if (Array.isArray(queryParams[key])) {
-                // Add each value in the array to each corresponding query
-                let i = 0;
-                for (const value of queryParams[key]) {
-                    if (!query.where[i]) {
-                        query.where[i] = {};
+            if (Array.isArray(query[key])) {
+                // Add each value in the array to each corresponding query. Multi-valued keys are "zipped"
+                // together via `numQueries` above; if this key's array is shorter than another key's, pad the
+                // remaining branches by repeating this key's own last value rather than leaving the key unset —
+                // an unset key would match ANY value, silently dropping this filter from those branches.
+                const values = query[key];
+                for (let i = 0; i < numQueries; i++) {
+                    if (!result.where[i]) {
+                        result.where[i] = {};
                     }
-                    query.where[i][key] = ModelUtils.getQueryParamValue(value);
-                    i++;
+                    const value = i < values.length ? values[i] : values[values.length - 1];
+                    result.where[i][key] = ModelUtils.getQueryParamValue(value);
                 }
             }
             else {
                 // Add the parameter to every query
                 for (let i = 0; i < numQueries; i++) {
-                    if (!query.where[i]) {
-                        query.where[i] = {};
+                    if (!result.where[i]) {
+                        result.where[i] = {};
                     }
-                    query.where[i][key] = ModelUtils.getQueryParamValue(queryParams[key]);
+                    result.where[i][key] = ModelUtils.getQueryParamValue(query[key]);
                 }
             }
         }
-        if (query.where.length === 0) {
-            delete query.where;
+        if (result.where.length === 0) {
+            delete result.where;
         }
-        if (query.take) {
-            query.take = Math.min(query.take, 1000);
+        if (result.take) {
+            result.take = Math.min(result.take, 1000);
         }
         else {
-            query.take = 100;
+            result.take = 100;
         }
-        query.page = query.page ? query.page : 0;
-        return query;
+        result.page = result.page ? result.page : 0;
+        return result;
     }
     /**
      * Builds a MongoDB compatible query object for the given criteria. Query params can have a value containing a
@@ -498,37 +619,47 @@ export class ModelUtils {
      * NOTE: The result of this function is only compatible with the `aggregate()` function.
      *
      * @param modelClass The class definition of the data model to build a search query for.
-     * @param {any} params The URI parameters for the endpoint that was requested.
-     * @param {any} queryParams The URI query parameters that were included in the request.
+     * @param {any} query The search query parameters to include.
      * @param {bool} exactMatch Set to true to create a query where parameters are to be matched exactly, otherwise set to false to use a 'contains' search.
      * @param {any} user The user that is performing the request.
-     * @returns {object} The TypeORM compatible query object.
+     * @returns {object} The MongoDB compatible query object.
      */
-    static buildSearchQueryMongo(modelClass, params, queryParams, exactMatch = false, user) {
+    static buildSearchQueryMongo(modelClass, query = {}, exactMatch = false, user) {
         const queries = [{}];
         let sort = undefined;
-        // Add the URL parameters
-        for (const key in params) {
-            // If the value is 'me' that's a special keyword to reference the user ID.
-            if (params[key] === "me") {
-                if (!user) {
-                    throw new ApiError(ApiErrors.SEARCH_INVALID_ME_REFERENCE, 403, ApiErrorMessages.SEARCH_INVALID_ME_REFERENCE);
-                }
-                queries[0][key] = user.uid;
+        // logger?.debug(`Query params: ${JSON.stringify(queryParams)}`);
+        // Query parameters can be a single value or multiple. In the case of multiple we want to perform an OR
+        // operation for each value, "zipped" together with any other multi-valued parameters (see the equivalent
+        // two-pass logic in buildSearchQuerySQL) — so first determine how many OR branches we need in total and
+        // pre-allocate them, before any key gets applied to a subset of branches.
+        let numQueries = 1;
+        for (const key in query) {
+            if (key === "$or" || key.match(REGEX_RESERVED_QUERY_PARAMS) || key.match(REGEX_QUERY_LIMITS)) {
+                continue;
             }
-            else {
-                queries[0][key] = params[key];
+            const value = query[key];
+            if (Array.isArray(value) && value.length > numQueries) {
+                numQueries = value.length;
             }
         }
-        // logger?.debug(`Query params: ${JSON.stringify(queryParams)}`);
-        for (const key in queryParams) {
+        for (let i = 1; i < numQueries; i++) {
+            queries[i] = {};
+        }
+        for (const key in query) {
             // Ignore reserved query parameters
             if (key.match(REGEX_RESERVED_QUERY_PARAMS)) {
                 continue;
             }
+            // If the value is 'me' that's a special keyword to reference the user ID.
+            if (query[key] === "me") {
+                if (!user) {
+                    throw new ApiError(ApiErrors.SEARCH_INVALID_ME_REFERENCE, 403, ApiErrorMessages.SEARCH_INVALID_ME_REFERENCE);
+                }
+                query[key] = user.uid;
+            }
             // Limit, page and sort are reserved for specifying query limits
             if (key.match(REGEX_QUERY_LIMITS)) {
-                let value = queryParams[key];
+                let value = query[key];
                 if (key === "sort") {
                     if (typeof value === "string") {
                         if (value.match(REGEX_QUERY_SORT_STRING)) {
@@ -554,6 +685,9 @@ export class ModelUtils {
                         if (typeof value === "number") {
                             sort[key] = value;
                         }
+                        else if (typeof value !== "string") {
+                            return;
+                        }
                         else if (value.toUpperCase() === "ASC") {
                             sort[key] = 1;
                         }
@@ -564,35 +698,45 @@ export class ModelUtils {
                 }
                 continue;
             }
+            // Reject any other Mongo operator key or dot-notation field path outright — client input may only
+            // supply plain field names, never raw query operators (`$or` is the one deliberate exception, handled
+            // just below; its sub-queries are validated recursively when they're built).
+            if (key !== "$or" && (key.startsWith("$") || key.includes("."))) {
+                throw new ApiError(ApiErrors.INVALID_REQUEST, 400, ApiErrorMessages.INVALID_REQUEST);
+            }
             if (key === "$or") {
                 // Array of OR queries
                 let orResults = [];
-                for (const query of queryParams[key]) {
-                    const subQueryOrResult = this.buildSearchQueryMongo(modelClass, undefined, query, exactMatch, user);
+                for (const q of query[key]) {
+                    const subQueryOrResult = this.buildSearchQueryMongo(modelClass, q, exactMatch, user);
                     const validSubQueryResult = Array.isArray(subQueryOrResult) && subQueryOrResult.length > 0
                         ? subQueryOrResult[0]["$match"]
                         : subQueryOrResult["$match"];
                     validSubQueryResult && orResults.push(validSubQueryResult);
                 }
-                queries[0] = { $or: orResults };
+                // Merge into whatever conditions earlier keys (including the injected soft-delete filter)
+                // already placed on each branch — replacing outright would silently discard them, and merging
+                // only into queries[0] would silently drop the $or constraint from any other zipped branch.
+                for (let i = 0; i < numQueries; i++) {
+                    queries[i] = { ...queries[i], $or: orResults };
+                }
                 continue;
             }
-            if (Array.isArray(queryParams[key])) {
-                // Add each value in the array to each corresponding query
-                const conditions = [];
-                for (let i = 0; i < queryParams[key].length; i++) {
-                    const value = ModelUtils.getQueryParamValueMongo(queryParams[key][i]);
-                    if (!queries[i]) {
-                        queries[i] = {
-                            ...queries[0],
-                        };
-                    }
-                    queries[i][key] = value;
+            if (Array.isArray(query[key])) {
+                // Add each value in the array to each corresponding query, zipped per `numQueries` above. If
+                // this key's array is shorter than another key's, pad the remaining branches by repeating this
+                // key's own last value rather than leaving the key unset — an unset key would match ANY value,
+                // silently dropping this filter from those branches. Injection safety is already enforced
+                // inside getQueryParamValueMongo() itself, at the point the client-supplied value is parsed.
+                const values = query[key];
+                for (let i = 0; i < numQueries; i++) {
+                    const raw = i < values.length ? values[i] : values[values.length - 1];
+                    queries[i][key] = ModelUtils.getQueryParamValueMongo(raw);
                 }
             }
             else {
-                const value = ModelUtils.getQueryParamValueMongo(queryParams[key]);
-                for (let i = 0; i < queries.length; i++) {
+                const value = ModelUtils.getQueryParamValueMongo(query[key]);
+                for (let i = 0; i < numQueries; i++) {
                     queries[i][key] = value;
                 }
             }
@@ -635,7 +779,7 @@ export class ModelUtils {
                 await classLoader.load();
                 // Go through each class and determine which ones implements the `@Model` decorator.
                 classLoader.getClasses().forEach((clazz, name) => {
-                    const isModel = Reflect.getMetadata("rrst:datastore", clazz) !== undefined;
+                    const isModel = Reflect.getMetadata("rrst:datasource", clazz) !== undefined;
                     if (isModel) {
                         result.set(name, clazz);
                     }
@@ -649,4 +793,7 @@ export class ModelUtils {
     }
 }
 ModelUtils.idPropertyCache = new Map();
+ModelUtils.readOnlyPropertyCache = new Map();
+/** Maximum accepted length of a client-supplied `like()` search pattern. */
+ModelUtils.MAX_LIKE_PATTERN_LENGTH = 100;
 //# sourceMappingURL=ModelUtils.js.map