@rpcbase/server 0.594.0 → 0.595.0

package/dist/queryWindow-DP8zD0lb.js

@@ -0,0 +1,555 @@
+import assert from "assert";
+import { hkdfSync } from "crypto";
+import { models } from "@rpcbase/db";
+import { createHmac, timingSafeEqual } from "node:crypto";
+import { buildAbilityFromSession, getAccessibleByQuery } from "@rpcbase/db/acl";
+//#region src/getDerivedKey.ts
+var getDerivedKey = (masterKey, info, length = 32, salt = "") => {
+	assert(masterKey?.length >= 32, "MASTER_KEY must be 32 chars or longer.");
+	return Buffer.from(hkdfSync("sha256", masterKey, Buffer.from(salt), Buffer.from(info), length)).toString("hex");
+};
+//#endregion
+//#region src/proxyAuth.ts
+var AUTHENTICATED_USER_ID_HEADER = "rb-authenticated-user-id";
+var AUTHENTICATED_TENANT_ID_HEADER = "rb-authenticated-tenant-id";
+var PROXY_AUTH_TIMESTAMP_HEADER = "rb-proxy-auth-timestamp";
+var PROXY_AUTH_SIGNATURE_HEADER = "rb-proxy-auth-signature";
+var MAX_PROXY_AUTH_AGE_MS = 300 * 1e3;
+var normalizeString$2 = (value) => {
+	if (typeof value !== "string") return null;
+	return value.trim() || null;
+};
+var getHeaderValue = (headers, name) => {
+	const value = headers?.[name];
+	if (Array.isArray(value)) return normalizeString$2(value[0]);
+	return normalizeString$2(value);
+};
+var getProxySharedSecret = () => {
+	return process.env.RB_PROXY_SHARED_SECRET?.trim() || null;
+};
+var timingSafeEqualText = (left, right) => {
+	const leftBuffer = Buffer.from(left);
+	const rightBuffer = Buffer.from(right);
+	if (leftBuffer.length !== rightBuffer.length) return false;
+	return timingSafeEqual(leftBuffer, rightBuffer);
+};
+var buildProxyAuthSignature = ({ userId, tenantId, timestamp, secret }) => {
+	return createHmac("sha256", secret).update(`${timestamp}:${userId}:${tenantId}`).digest("hex");
+};
+var getTrustedProxyAuth = (headers) => {
+	const userId = getHeaderValue(headers, AUTHENTICATED_USER_ID_HEADER);
+	const tenantId = getHeaderValue(headers, AUTHENTICATED_TENANT_ID_HEADER);
+	const timestamp = getHeaderValue(headers, PROXY_AUTH_TIMESTAMP_HEADER);
+	const signature = getHeaderValue(headers, PROXY_AUTH_SIGNATURE_HEADER);
+	if (!userId || !tenantId || !timestamp || !signature) return null;
+	const parsedTimestamp = Number(timestamp);
+	if (!Number.isInteger(parsedTimestamp)) return null;
+	if (Math.abs(Date.now() - parsedTimestamp) > MAX_PROXY_AUTH_AGE_MS) return null;
+	const secret = getProxySharedSecret();
+	if (!secret) return null;
+	if (!timingSafeEqualText(signature, buildProxyAuthSignature({
+		userId,
+		tenantId,
+		timestamp,
+		secret
+	}))) return null;
+	return {
+		userId,
+		tenantId
+	};
+};
+//#endregion
+//#region src/syncAuthenticatedSession.ts
+var normalizeString$1 = (value) => {
+	if (typeof value !== "string") return null;
+	return value.trim() || null;
+};
+var normalizeStringArray = (value) => {
+	if (!Array.isArray(value)) return [];
+	return value.map((entry) => normalizeString$1(String(entry))).filter((entry) => Boolean(entry));
+};
+var normalizeRoles = (value) => {
+	if (!Array.isArray(value)) return [];
+	return value.map((entry) => normalizeString$1(entry)).filter((entry) => Boolean(entry));
+};
+var normalizeTenantRoles = (value) => {
+	if (!value || typeof value !== "object") return void 0;
+	if (value instanceof Map) {
+		const entries = Array.from(value.entries()).map(([tenantId, roles]) => {
+			const normalizedTenantId = normalizeString$1(String(tenantId));
+			if (!normalizedTenantId) return null;
+			return [normalizedTenantId, normalizeRoles(roles)];
+		}).filter((entry) => Boolean(entry));
+		return entries.length ? Object.fromEntries(entries) : void 0;
+	}
+	const nextRoles = Object.entries(value).map(([tenantId, roles]) => {
+		const normalizedTenantId = normalizeString$1(tenantId);
+		if (!normalizedTenantId) return null;
+		return [normalizedTenantId, normalizeRoles(roles)];
+	}).filter((entry) => Boolean(entry));
+	return nextRoles.length ? Object.fromEntries(nextRoles) : void 0;
+};
+var isSessionAuthorizedForTenant = (sessionUser, tenantId) => {
+	if (!sessionUser) return false;
+	const signedInTenants = normalizeStringArray(sessionUser.signedInTenants);
+	if (signedInTenants.length > 0) return signedInTenants.includes(tenantId);
+	return normalizeString$1(sessionUser.currentTenantId) === tenantId;
+};
+var loadSessionUser = async (userId, tenantId) => {
+	const user = await (await models.getGlobal("RBUser", { req: { session: null } })).findById(userId, {
+		tenants: 1,
+		tenantRoles: 1
+	}).lean();
+	if (!user) return null;
+	const signedInTenants = normalizeStringArray(user.tenants);
+	if (!signedInTenants.includes(tenantId)) return null;
+	const tenantRoles = normalizeTenantRoles(user.tenantRoles);
+	return {
+		id: userId,
+		currentTenantId: tenantId,
+		signedInTenants,
+		isEntryGateAuthorized: true,
+		...tenantRoles ? { tenantRoles } : {}
+	};
+};
+var syncAuthenticatedSessionFromRequest = async (req) => {
+	const proxyAuth = getTrustedProxyAuth(req.headers);
+	if (!proxyAuth) return;
+	const { userId, tenantId } = proxyAuth;
+	const session = req.session;
+	if (!session) return;
+	const sessionUser = session.user;
+	if (normalizeString$1(sessionUser?.id) === userId && isSessionAuthorizedForTenant(sessionUser, tenantId)) {
+		if (normalizeString$1(sessionUser?.currentTenantId) === tenantId) return;
+		session.user = {
+			...sessionUser && typeof sessionUser === "object" ? sessionUser : {},
+			id: userId,
+			currentTenantId: tenantId,
+			isEntryGateAuthorized: true
+		};
+		return;
+	}
+	const nextSessionUser = await loadSessionUser(userId, tenantId);
+	if (!nextSessionUser) {
+		if (session.user) delete session.user;
+		return;
+	}
+	session.user = nextSessionUser;
+};
+var syncAuthenticatedSessionMiddleware = (req, _res, next) => {
+	syncAuthenticatedSessionFromRequest(req).then(() => {
+		next();
+	}, next);
+};
+//#endregion
+//#region src/rts/queryExecutor.ts
+var QUERY_MAX_LIMIT = 4096;
+var INTERNAL_MODEL_NAMES = /* @__PURE__ */ new Set(["RBRtsChange", "RBRtsCounter"]);
+var DEFAULT_APPROX_COUNT_SAMPLE_SIZE = 1e3;
+var MAX_APPROX_COUNT_SAMPLE_SIZE = 1e4;
+var UNSUPPORTED_APPROX_COUNT_OPERATORS = /* @__PURE__ */ new Set([
+	"$text",
+	"$near",
+	"$nearSphere",
+	"$where"
+]);
+var paginationCursorSigningSecret = null;
+var getPaginationCursorSigningSecret = () => {
+	if (paginationCursorSigningSecret) return paginationCursorSigningSecret;
+	const masterKey = process.env.MASTER_KEY?.trim();
+	if (!masterKey) throw new Error("MASTER_KEY must be defined to derive pagination cursor signing secret");
+	paginationCursorSigningSecret = getDerivedKey(masterKey, "pagination_cursor_signing");
+	return paginationCursorSigningSecret;
+};
+var normalizeTenantId = (value) => {
+	if (typeof value !== "string") return null;
+	const normalized = value.trim();
+	return normalized ? normalized : null;
+};
+var getTenantIdFromRequest = (req) => {
+	return normalizeTenantId((req.session?.user)?.currentTenantId);
+};
+var resolveRtsRequestTenantId = (req) => {
+	return getTenantIdFromRequest(req);
+};
+var isRtsRequestAuthorized = (req, tenantId) => {
+	const sessionUser = req.session?.user;
+	if (!sessionUser) return false;
+	const currentTenantId = normalizeTenantId(sessionUser.currentTenantId);
+	if (!currentTenantId) return false;
+	return currentTenantId === tenantId;
+};
+var buildRtsAbilityFromRequest = async (req, tenantId) => {
+	const sessionUserId = normalizeTenantId((req.session?.user)?.id);
+	if (!sessionUserId) {
+		const currentTenantId = normalizeTenantId((req.session?.user)?.currentTenantId);
+		if (!currentTenantId || currentTenantId !== tenantId) throw new Error("Tenant not authorized for this session");
+		return {
+			ability: buildAbilityFromSession({
+				tenantId,
+				session: req.session
+			}),
+			userId: null
+		};
+	}
+	const currentTenantId = normalizeTenantId((req.session?.user)?.currentTenantId);
+	if (!currentTenantId || currentTenantId !== tenantId) throw new Error("Tenant not authorized for this session");
+	return {
+		ability: buildAbilityFromSession({
+			tenantId,
+			session: req.session
+		}),
+		userId: sessionUserId
+	};
+};
+var getTenantModel = async (tenantId, modelName, ability) => {
+	const ctx = {
+		req: { session: { user: { currentTenantId: tenantId } } },
+		ability
+	};
+	return models.get(modelName, ctx);
+};
+var normalizeLimit = (limit) => {
+	if (typeof limit !== "number") return QUERY_MAX_LIMIT;
+	if (!Number.isFinite(limit)) return QUERY_MAX_LIMIT;
+	return Math.min(QUERY_MAX_LIMIT, Math.abs(limit));
+};
+var normalizeNonNegativeInteger = (value) => {
+	if (typeof value !== "number") return 0;
+	if (!Number.isFinite(value) || value < 0) return 0;
+	return Math.floor(value);
+};
+var getApproxCountSampleSize = () => {
+	const raw = process.env.RB_RTS_APPROX_COUNT_SAMPLE_SIZE?.trim() ?? "";
+	if (!raw) return DEFAULT_APPROX_COUNT_SAMPLE_SIZE;
+	const parsed = Number(raw);
+	if (!Number.isFinite(parsed) || parsed <= 0) return DEFAULT_APPROX_COUNT_SAMPLE_SIZE;
+	return Math.min(MAX_APPROX_COUNT_SAMPLE_SIZE, Math.floor(parsed));
+};
+var findUnsupportedApproxCountOperator = (value) => {
+	if (!value || typeof value !== "object") return null;
+	if (Array.isArray(value)) {
+		for (const entry of value) {
+			const unsupportedOperator = findUnsupportedApproxCountOperator(entry);
+			if (unsupportedOperator) return unsupportedOperator;
+		}
+		return null;
+	}
+	for (const [key, nestedValue] of Object.entries(value)) {
+		if (UNSUPPORTED_APPROX_COUNT_OPERATORS.has(key)) return key;
+		const unsupportedOperator = findUnsupportedApproxCountOperator(nestedValue);
+		if (unsupportedOperator) return unsupportedOperator;
+	}
+	return null;
+};
+var castApproxCountQuery = (model, query) => {
+	const castedQuery = model.find(query).cast(model);
+	if (!castedQuery || typeof castedQuery !== "object" || Array.isArray(castedQuery)) return query;
+	return castedQuery;
+};
+var normalizeString = (value) => {
+	return typeof value === "string" ? value.trim() : "";
+};
+var normalizeObject = (value) => {
+	if (!value || typeof value !== "object" || Array.isArray(value)) return void 0;
+	return value;
+};
+var normalizePagination = (value) => {
+	if (!value || typeof value !== "object" || Array.isArray(value)) return void 0;
+	return value;
+};
+var prepareCursorProjection = (projection, pagination, includeCursors) => {
+	if (!projection || !includeCursors) return {
+		projection,
+		addedPaths: []
+	};
+	const inclusionProjection = Object.entries(projection).some(([, value]) => value === 1);
+	const nextProjection = { ...projection };
+	const addedPaths = [];
+	const sortFields = Array.isArray(pagination.sort) ? pagination.sort.map((entry) => entry?.field).filter((field) => typeof field === "string") : [];
+	const cursorPaths = Array.from(/* @__PURE__ */ new Set([...sortFields, "_id"]));
+	if (!inclusionProjection) {
+		for (const path of cursorPaths) {
+			const excludedPath = Object.entries(projection).find(([projectedPath, value]) => value === 0 && (projectedPath === path || path.startsWith(`${projectedPath}.`)))?.[0];
+			if (!excludedPath) continue;
+			if (excludedPath !== path) throw new Error(`Pagination projection cannot exclude cursor path: ${path}`);
+			delete nextProjection[path];
+			addedPaths.push(path);
+		}
+		return {
+			projection: nextProjection,
+			addedPaths
+		};
+	}
+	for (const path of cursorPaths) {
+		if (path === "_id" ? projection._id !== 0 : Object.entries(projection).some(([projectedPath, value]) => value === 1 && (projectedPath === path || path.startsWith(`${projectedPath}.`)))) continue;
+		nextProjection[path] = 1;
+		addedPaths.push(path);
+	}
+	return {
+		projection: nextProjection,
+		addedPaths
+	};
+};
+var stripPath = (target, path) => {
+	const parts = path.split(".");
+	let current = target;
+	for (let index = 0; index < parts.length - 1; index += 1) {
+		const part = parts[index];
+		const child = current[part];
+		if (!child || typeof child !== "object" || Array.isArray(child)) return;
+		const cloned = { ...child };
+		current[part] = cloned;
+		current = cloned;
+	}
+	delete current[parts[parts.length - 1]];
+};
+var stripAddedProjectionPaths = (nodes, addedPaths) => {
+	if (!addedPaths.length) return nodes;
+	return nodes.map((node) => {
+		if (!node || typeof node !== "object" || Array.isArray(node)) return node;
+		const toObject = node.toObject;
+		const raw = typeof toObject === "function" ? toObject.call(node) : node;
+		if (!raw || typeof raw !== "object" || Array.isArray(raw)) return raw;
+		const projected = { ...raw };
+		for (const path of addedPaths) stripPath(projected, path);
+		return projected;
+	});
+};
+var normalizePopulateSelect = (value) => {
+	if (typeof value === "string") return value.trim() || void 0;
+	return normalizeObject(value);
+};
+var normalizePopulateOptions = (value) => {
+	if (!value || typeof value !== "object" || Array.isArray(value)) return void 0;
+	const raw = value;
+	const normalized = {};
+	if (raw.sort && typeof raw.sort === "object" && !Array.isArray(raw.sort)) normalized.sort = raw.sort;
+	if (typeof raw.limit === "number" && Number.isFinite(raw.limit)) normalized.limit = Math.max(0, Math.floor(Math.abs(raw.limit)));
+	if (!normalized.sort && normalized.limit === void 0) return void 0;
+	return normalized;
+};
+var normalizePopulateObject = (value) => {
+	if (!value || typeof value !== "object" || Array.isArray(value)) return void 0;
+	const raw = value;
+	const path = normalizeString(raw.path);
+	if (!path) return void 0;
+	const normalized = { path };
+	const model = normalizeString(raw.model);
+	if (model) normalized.model = model;
+	const select = normalizePopulateSelect(raw.select);
+	if (select !== void 0) normalized.select = select;
+	const match = normalizeObject(raw.match);
+	if (match) normalized.match = match;
+	const nestedPopulate = normalizeRtsPopulateOption(raw.populate);
+	if (nestedPopulate !== void 0) normalized.populate = nestedPopulate;
+	const options = normalizePopulateOptions(raw.options);
+	if (options) normalized.options = options;
+	return normalized;
+};
+var normalizeRtsPopulateOption = (value) => {
+	if (typeof value === "string") return value.trim() || void 0;
+	if (Array.isArray(value)) {
+		const normalized = value.map((entry) => {
+			if (typeof entry === "string") return entry.trim() || null;
+			return normalizePopulateObject(entry) ?? null;
+		}).filter((entry) => entry !== null);
+		return normalized.length > 0 ? normalized : void 0;
+	}
+	return normalizePopulateObject(value);
+};
+var normalizeModelName = (value) => {
+	if (typeof value !== "string") return null;
+	return value.trim() || null;
+};
+var resolvePopulateRefModelName = (model, path, explicitModelName) => {
+	if (explicitModelName) return explicitModelName;
+	const schema = model.schema;
+	const schemaPath = typeof schema.path === "function" ? schema.path(path) : null;
+	const directRef = normalizeModelName(schemaPath?.options?.ref);
+	if (directRef) return directRef;
+	const arrayRef = normalizeModelName(schemaPath?.caster?.options?.ref);
+	if (arrayRef) return arrayRef;
+	const virtualRef = normalizeModelName((typeof schema.virtualpath === "function" ? schema.virtualpath(path) : null)?.options?.ref);
+	if (virtualRef) return virtualRef;
+	return null;
+};
+var mergePopulateMatchWithAcl = (populateMatch, aclMatch) => {
+	if (!populateMatch || Object.keys(populateMatch).length === 0) return aclMatch;
+	return { $and: [populateMatch, aclMatch] };
+};
+var resolvePopulateSpecForModel = async ({ tenantId, model, ability, populate, allowInternalModels, modelCache, dependencyModelNames }) => {
+	if (!populate) return void 0;
+	const getModelCached = async (targetModelName) => {
+		const cached = modelCache.get(targetModelName);
+		if (cached) return cached;
+		const loaded = await getTenantModel(tenantId, targetModelName, ability);
+		modelCache.set(targetModelName, loaded);
+		return loaded;
+	};
+	const resolveOne = async (entry, parentModel) => {
+		if (typeof entry === "string") {
+			const path = entry.trim();
+			if (!path) return null;
+			const refModelName = resolvePopulateRefModelName(parentModel, path, null);
+			if (!refModelName) return path;
+			if (!allowInternalModels && INTERNAL_MODEL_NAMES.has(refModelName)) throw new Error("Model not allowed");
+			if (!ability.can("read", refModelName)) throw new Error("forbidden");
+			dependencyModelNames.add(refModelName);
+			return {
+				path,
+				match: getAccessibleByQuery(ability, "read", refModelName)
+			};
+		}
+		const path = entry.path.trim();
+		if (!path) return null;
+		const explicitModelName = normalizeModelName(entry.model);
+		const refModelName = resolvePopulateRefModelName(parentModel, path, explicitModelName);
+		let nestedModel = parentModel;
+		const normalizedEntry = { path };
+		if (entry.select !== void 0) normalizedEntry.select = entry.select;
+		if (entry.options !== void 0) normalizedEntry.options = entry.options;
+		if (explicitModelName) normalizedEntry.model = explicitModelName;
+		if (entry.match !== void 0) normalizedEntry.match = entry.match;
+		if (refModelName) {
+			if (!allowInternalModels && INTERNAL_MODEL_NAMES.has(refModelName)) throw new Error("Model not allowed");
+			if (!ability.can("read", refModelName)) throw new Error("forbidden");
+			dependencyModelNames.add(refModelName);
+			nestedModel = await getModelCached(refModelName);
+			const aclMatch = getAccessibleByQuery(ability, "read", refModelName);
+			normalizedEntry.match = mergePopulateMatchWithAcl(normalizedEntry.match, aclMatch);
+		} else if (entry.populate !== void 0) throw new Error("Populate path must reference a model when nested populate is used");
+		const nestedPopulate = await resolvePopulateSpecForModel({
+			tenantId,
+			model: nestedModel,
+			ability,
+			populate: entry.populate,
+			allowInternalModels,
+			modelCache,
+			dependencyModelNames
+		});
+		if (nestedPopulate !== void 0) normalizedEntry.populate = nestedPopulate;
+		return normalizedEntry;
+	};
+	if (Array.isArray(populate)) {
+		const filtered = (await Promise.all(populate.map((entry) => resolveOne(entry, model)))).filter((entry) => entry !== null);
+		return filtered.length > 0 ? filtered : void 0;
+	}
+	return await resolveOne(populate, model) ?? void 0;
+};
+var normalizeRtsQueryOptions = (options) => {
+	if (!options || typeof options !== "object") return {};
+	const normalized = {};
+	if (options.projection && typeof options.projection === "object" && !Array.isArray(options.projection)) normalized.projection = options.projection;
+	if (options.sort && typeof options.sort === "object" && !Array.isArray(options.sort)) normalized.sort = options.sort;
+	normalized.limit = normalizeLimit(options.limit);
+	normalized.populate = normalizeRtsPopulateOption(options.populate);
+	normalized.pagination = normalizePagination(options.pagination);
+	return normalized;
+};
+var resolveRtsQueryDependencyModelNames = async ({ tenantId, ability, modelName, options, allowInternalModels = false }) => {
+	const model = await getTenantModel(tenantId, modelName, ability);
+	const modelCache = /* @__PURE__ */ new Map();
+	modelCache.set(modelName, model);
+	const dependencyModelNames = /* @__PURE__ */ new Set();
+	await resolvePopulateSpecForModel({
+		tenantId,
+		model,
+		ability,
+		populate: options.populate,
+		allowInternalModels,
+		modelCache,
+		dependencyModelNames
+	});
+	return Array.from(dependencyModelNames);
+};
+var runRtsQuery = async ({ tenantId, ability, modelName, query, options, allowInternalModels = false, paginationMaxLimit, includePaginationCursors = true }) => {
+	const { model, finalQuery } = await prepareRtsExecution({
+		tenantId,
+		ability,
+		modelName,
+		query,
+		allowInternalModels
+	});
+	const projection = options.projection ?? void 0;
+	const sort = options.sort;
+	const limit = normalizeLimit(options.limit);
+	const modelCache = /* @__PURE__ */ new Map();
+	modelCache.set(modelName, model);
+	const populate = await resolvePopulateSpecForModel({
+		tenantId,
+		model,
+		ability,
+		populate: options.populate,
+		allowInternalModels,
+		modelCache,
+		dependencyModelNames: /* @__PURE__ */ new Set()
+	});
+	if (options.pagination) {
+		const cursorProjection = prepareCursorProjection(projection, options.pagination, includePaginationCursors);
+		const paginatedQuery = model.find(finalQuery, cursorProjection.projection);
+		if (populate !== void 0) paginatedQuery.populate(populate);
+		const paginatedResult = await paginatedQuery.paginate(options.pagination, {
+			cursor: {
+				signingSecret: getPaginationCursorSigningSecret(),
+				...paginationMaxLimit !== void 0 ? { maxLimit: paginationMaxLimit } : {}
+			},
+			includeCursors: includePaginationCursors
+		});
+		const totalCount = typeof paginatedResult.totalCount === "number" && Number.isFinite(paginatedResult.totalCount) && paginatedResult.totalCount >= 0 ? Math.floor(paginatedResult.totalCount) : void 0;
+		const approximateTotalCount = totalCount === void 0 ? await runApproximateRtsCount(model, finalQuery).catch(() => void 0) : void 0;
+		const resolvedTotalCount = totalCount ?? approximateTotalCount;
+		return {
+			data: Array.isArray(paginatedResult.nodes) ? stripAddedProjectionPaths(paginatedResult.nodes, cursorProjection.addedPaths) : [],
+			pageInfo: paginatedResult.pageInfo,
+			...resolvedTotalCount !== void 0 ? { totalCount: resolvedTotalCount } : {}
+		};
+	}
+	const queryPromise = model.find(finalQuery, projection);
+	if (populate !== void 0) queryPromise.populate(populate);
+	if (sort && Object.keys(sort).length) queryPromise.sort(sort);
+	queryPromise.limit(limit);
+	const data = await queryPromise;
+	return { data: Array.isArray(data) ? data : [] };
+};
+var prepareRtsExecution = async ({ tenantId, ability, modelName, query, allowInternalModels = false }) => {
+	if (!allowInternalModels && INTERNAL_MODEL_NAMES.has(modelName)) throw new Error("Model not allowed");
+	if (!ability.can("read", modelName)) throw new Error("forbidden");
+	return {
+		model: await getTenantModel(tenantId, modelName, ability),
+		finalQuery: { $and: [query, getAccessibleByQuery(ability, "read", modelName)] }
+	};
+};
+var runApproximateRtsCount = async (model, query) => {
+	const unsupportedOperator = findUnsupportedApproxCountOperator(query);
+	if (unsupportedOperator) throw new Error(`Approximate RTS count does not support ${unsupportedOperator} queries`);
+	const castedQuery = castApproxCountQuery(model, query);
+	const estimatedTotal = normalizeNonNegativeInteger(await model.estimatedDocumentCount());
+	if (estimatedTotal === 0) return 0;
+	const sampleSize = Math.min(getApproxCountSampleSize(), estimatedTotal);
+	const sampleMatches = normalizeNonNegativeInteger((await model.aggregate([
+		{ $sample: { size: sampleSize } },
+		{ $match: castedQuery },
+		{ $count: "count" }
+	]))[0]?.count);
+	if (sampleSize >= estimatedTotal) return Math.min(sampleMatches, estimatedTotal);
+	const estimatedMatches = Math.round(estimatedTotal * sampleMatches / sampleSize);
+	return Math.max(0, Math.min(estimatedTotal, estimatedMatches));
+};
+var runRtsCount = async ({ tenantId, ability, modelName, query, allowInternalModels = false }) => {
+	const { model, finalQuery } = await prepareRtsExecution({
+		tenantId,
+		ability,
+		modelName,
+		query,
+		allowInternalModels
+	});
+	return await runApproximateRtsCount(model, finalQuery);
+};
+//#endregion
+//#region src/rts/queryWindow.ts
+var RTS_QUERY_WINDOW_MAX_COUNT = 4096;
+//#endregion
+export { resolveRtsQueryDependencyModelNames as a, runRtsQuery as c, getDerivedKey as d, normalizeRtsQueryOptions as i, syncAuthenticatedSessionFromRequest as l, buildRtsAbilityFromRequest as n, resolveRtsRequestTenantId as o, isRtsRequestAuthorized as r, runRtsCount as s, RTS_QUERY_WINDOW_MAX_COUNT as t, syncAuthenticatedSessionMiddleware as u };
+
+//# sourceMappingURL=queryWindow-DP8zD0lb.js.map