@rpcbase/server 0.594.0 → 0.595.0

package/dist/queryWindow-Cdr7K-S1.js

@@ -1,714 +0,0 @@
-import { models } from "@rpcbase/db";
-import { createHmac, timingSafeEqual } from "node:crypto";
-import { getAccessibleByQuery, buildAbilityFromSession } from "@rpcbase/db/acl";
-import assert from "assert";
-import { hkdfSync } from "crypto";
-const getDerivedKey = (masterKey, info, length = 32, salt = "") => {
-  assert(masterKey?.length >= 32, "MASTER_KEY must be 32 chars or longer.");
-  return Buffer.from(hkdfSync("sha256", masterKey, Buffer.from(salt), Buffer.from(info), length)).toString("hex");
-};
-const AUTHENTICATED_USER_ID_HEADER = "rb-authenticated-user-id";
-const AUTHENTICATED_TENANT_ID_HEADER = "rb-authenticated-tenant-id";
-const PROXY_AUTH_TIMESTAMP_HEADER = "rb-proxy-auth-timestamp";
-const PROXY_AUTH_SIGNATURE_HEADER = "rb-proxy-auth-signature";
-const MAX_PROXY_AUTH_AGE_MS = 5 * 60 * 1e3;
-const normalizeString$2 = (value) => {
-  if (typeof value !== "string") return null;
-  const normalized = value.trim();
-  return normalized || null;
-};
-const getHeaderValue = (headers, name) => {
-  const value = headers?.[name];
-  if (Array.isArray(value)) return normalizeString$2(value[0]);
-  return normalizeString$2(value);
-};
-const getProxySharedSecret = () => {
-  const secret = process.env.RB_PROXY_SHARED_SECRET?.trim();
-  return secret || null;
-};
-const timingSafeEqualText = (left, right) => {
-  const leftBuffer = Buffer.from(left);
-  const rightBuffer = Buffer.from(right);
-  if (leftBuffer.length !== rightBuffer.length) return false;
-  return timingSafeEqual(leftBuffer, rightBuffer);
-};
-const buildProxyAuthSignature = ({
-  userId,
-  tenantId,
-  timestamp,
-  secret
-}) => {
-  return createHmac("sha256", secret).update(`${timestamp}:${userId}:${tenantId}`).digest("hex");
-};
-const getTrustedProxyAuth = (headers) => {
-  const userId = getHeaderValue(headers, AUTHENTICATED_USER_ID_HEADER);
-  const tenantId = getHeaderValue(headers, AUTHENTICATED_TENANT_ID_HEADER);
-  const timestamp = getHeaderValue(headers, PROXY_AUTH_TIMESTAMP_HEADER);
-  const signature = getHeaderValue(headers, PROXY_AUTH_SIGNATURE_HEADER);
-  if (!userId || !tenantId || !timestamp || !signature) return null;
-  const parsedTimestamp = Number(timestamp);
-  if (!Number.isInteger(parsedTimestamp)) return null;
-  const now = Date.now();
-  if (Math.abs(now - parsedTimestamp) > MAX_PROXY_AUTH_AGE_MS) return null;
-  const secret = getProxySharedSecret();
-  if (!secret) return null;
-  const expectedSignature = buildProxyAuthSignature({
-    userId,
-    tenantId,
-    timestamp,
-    secret
-  });
-  if (!timingSafeEqualText(signature, expectedSignature)) return null;
-  return {
-    userId,
-    tenantId
-  };
-};
-const normalizeString$1 = (value) => {
-  if (typeof value !== "string") return null;
-  const normalized = value.trim();
-  return normalized || null;
-};
-const normalizeStringArray = (value) => {
-  if (!Array.isArray(value)) return [];
-  return value.map((entry) => normalizeString$1(String(entry))).filter((entry) => Boolean(entry));
-};
-const normalizeRoles = (value) => {
-  if (!Array.isArray(value)) return [];
-  return value.map((entry) => normalizeString$1(entry)).filter((entry) => Boolean(entry));
-};
-const normalizeTenantRoles = (value) => {
-  if (!value || typeof value !== "object") return void 0;
-  if (value instanceof Map) {
-    const entries = Array.from(value.entries()).map(([tenantId, roles]) => {
-      const normalizedTenantId = normalizeString$1(String(tenantId));
-      if (!normalizedTenantId) return null;
-      return [normalizedTenantId, normalizeRoles(roles)];
-    }).filter((entry) => Boolean(entry));
-    return entries.length ? Object.fromEntries(entries) : void 0;
-  }
-  const nextRoles = Object.entries(value).map(([tenantId, roles]) => {
-    const normalizedTenantId = normalizeString$1(tenantId);
-    if (!normalizedTenantId) return null;
-    return [normalizedTenantId, normalizeRoles(roles)];
-  }).filter((entry) => Boolean(entry));
-  return nextRoles.length ? Object.fromEntries(nextRoles) : void 0;
-};
-const isSessionAuthorizedForTenant = (sessionUser, tenantId) => {
-  if (!sessionUser) return false;
-  const signedInTenants = normalizeStringArray(sessionUser.signedInTenants);
-  if (signedInTenants.length > 0) {
-    return signedInTenants.includes(tenantId);
-  }
-  const currentTenantId = normalizeString$1(sessionUser.currentTenantId);
-  return currentTenantId === tenantId;
-};
-const loadSessionUser = async (userId, tenantId) => {
-  const ctx = {
-    req: {
-      session: null
-    }
-  };
-  const User = await models.getGlobal("RBUser", ctx);
-  const user = await User.findById(userId, {
-    tenants: 1,
-    tenantRoles: 1
-  }).lean();
-  if (!user) return null;
-  const signedInTenants = normalizeStringArray(user.tenants);
-  if (!signedInTenants.includes(tenantId)) return null;
-  const tenantRoles = normalizeTenantRoles(user.tenantRoles);
-  return {
-    id: userId,
-    currentTenantId: tenantId,
-    signedInTenants,
-    isEntryGateAuthorized: true,
-    ...tenantRoles ? {
-      tenantRoles
-    } : {}
-  };
-};
-const syncAuthenticatedSessionFromRequest = async (req) => {
-  const proxyAuth = getTrustedProxyAuth(req.headers);
-  if (!proxyAuth) return;
-  const {
-    userId,
-    tenantId
-  } = proxyAuth;
-  const session = req.session;
-  if (!session) return;
-  const sessionUser = session.user;
-  const sessionUserId = normalizeString$1(sessionUser?.id);
-  if (sessionUserId === userId && isSessionAuthorizedForTenant(sessionUser, tenantId)) {
-    const currentTenantId = normalizeString$1(sessionUser?.currentTenantId);
-    if (currentTenantId === tenantId) return;
-    const baseUser = sessionUser && typeof sessionUser === "object" ? sessionUser : {};
-    session.user = {
-      ...baseUser,
-      id: userId,
-      currentTenantId: tenantId,
-      isEntryGateAuthorized: true
-    };
-    return;
-  }
-  const nextSessionUser = await loadSessionUser(userId, tenantId);
-  if (!nextSessionUser) {
-    if (session.user) {
-      delete session.user;
-    }
-    return;
-  }
-  session.user = nextSessionUser;
-};
-const syncAuthenticatedSessionMiddleware = (req, _res, next) => {
-  void syncAuthenticatedSessionFromRequest(req).then(() => {
-    next();
-  }, next);
-};
-const QUERY_MAX_LIMIT = 4096;
-const INTERNAL_MODEL_NAMES = /* @__PURE__ */ new Set(["RBRtsChange", "RBRtsCounter"]);
-const DEFAULT_APPROX_COUNT_SAMPLE_SIZE = 1e3;
-const MAX_APPROX_COUNT_SAMPLE_SIZE = 1e4;
-const UNSUPPORTED_APPROX_COUNT_OPERATORS = /* @__PURE__ */ new Set(["$text", "$near", "$nearSphere", "$where"]);
-let paginationCursorSigningSecret = null;
-const getPaginationCursorSigningSecret = () => {
-  if (paginationCursorSigningSecret) return paginationCursorSigningSecret;
-  const masterKey = process.env.MASTER_KEY?.trim();
-  if (!masterKey) {
-    throw new Error("MASTER_KEY must be defined to derive pagination cursor signing secret");
-  }
-  paginationCursorSigningSecret = getDerivedKey(masterKey, "pagination_cursor_signing");
-  return paginationCursorSigningSecret;
-};
-const normalizeTenantId = (value) => {
-  if (typeof value !== "string") return null;
-  const normalized = value.trim();
-  return normalized ? normalized : null;
-};
-const getTenantIdFromRequest = (req) => {
-  return normalizeTenantId(req.session?.user?.currentTenantId);
-};
-const resolveRtsRequestTenantId = (req) => {
-  return getTenantIdFromRequest(req);
-};
-const isRtsRequestAuthorized = (req, tenantId) => {
-  const sessionUser = req.session?.user;
-  if (!sessionUser) return false;
-  const currentTenantId = normalizeTenantId(sessionUser.currentTenantId);
-  if (!currentTenantId) return false;
-  return currentTenantId === tenantId;
-};
-const buildRtsAbilityFromRequest = async (req, tenantId) => {
-  const sessionUserId = normalizeTenantId(req.session?.user?.id);
-  if (!sessionUserId) {
-    const currentTenantId2 = normalizeTenantId(req.session?.user?.currentTenantId);
-    if (!currentTenantId2 || currentTenantId2 !== tenantId) {
-      throw new Error("Tenant not authorized for this session");
-    }
-    return {
-      ability: buildAbilityFromSession({
-        tenantId,
-        session: req.session
-      }),
-      userId: null
-    };
-  }
-  const currentTenantId = normalizeTenantId(req.session?.user?.currentTenantId);
-  if (!currentTenantId || currentTenantId !== tenantId) {
-    throw new Error("Tenant not authorized for this session");
-  }
-  return {
-    ability: buildAbilityFromSession({
-      tenantId,
-      session: req.session
-    }),
-    userId: sessionUserId
-  };
-};
-const getTenantModel = async (tenantId, modelName, ability) => {
-  const ctx = {
-    req: {
-      session: {
-        user: {
-          currentTenantId: tenantId
-        }
-      }
-    },
-    ability
-  };
-  return models.get(modelName, ctx);
-};
-const normalizeLimit = (limit) => {
-  if (typeof limit !== "number") return QUERY_MAX_LIMIT;
-  if (!Number.isFinite(limit)) return QUERY_MAX_LIMIT;
-  return Math.min(QUERY_MAX_LIMIT, Math.abs(limit));
-};
-const normalizeNonNegativeInteger = (value) => {
-  if (typeof value !== "number") return 0;
-  if (!Number.isFinite(value) || value < 0) return 0;
-  return Math.floor(value);
-};
-const getApproxCountSampleSize = () => {
-  const raw = process.env.RB_RTS_APPROX_COUNT_SAMPLE_SIZE?.trim() ?? "";
-  if (!raw) return DEFAULT_APPROX_COUNT_SAMPLE_SIZE;
-  const parsed = Number(raw);
-  if (!Number.isFinite(parsed) || parsed <= 0) return DEFAULT_APPROX_COUNT_SAMPLE_SIZE;
-  return Math.min(MAX_APPROX_COUNT_SAMPLE_SIZE, Math.floor(parsed));
-};
-const findUnsupportedApproxCountOperator = (value) => {
-  if (!value || typeof value !== "object") return null;
-  if (Array.isArray(value)) {
-    for (const entry of value) {
-      const unsupportedOperator = findUnsupportedApproxCountOperator(entry);
-      if (unsupportedOperator) return unsupportedOperator;
-    }
-    return null;
-  }
-  for (const [key, nestedValue] of Object.entries(value)) {
-    if (UNSUPPORTED_APPROX_COUNT_OPERATORS.has(key)) {
-      return key;
-    }
-    const unsupportedOperator = findUnsupportedApproxCountOperator(nestedValue);
-    if (unsupportedOperator) return unsupportedOperator;
-  }
-  return null;
-};
-const castApproxCountQuery = (model, query) => {
-  const castedQuery = model.find(query).cast(model);
-  if (!castedQuery || typeof castedQuery !== "object" || Array.isArray(castedQuery)) {
-    return query;
-  }
-  return castedQuery;
-};
-const normalizeString = (value) => {
-  return typeof value === "string" ? value.trim() : "";
-};
-const normalizeObject = (value) => {
-  if (!value || typeof value !== "object" || Array.isArray(value)) return void 0;
-  return value;
-};
-const normalizePagination = (value) => {
-  if (!value || typeof value !== "object" || Array.isArray(value)) return void 0;
-  return value;
-};
-const prepareCursorProjection = (projection, pagination, includeCursors) => {
-  if (!projection || !includeCursors) return {
-    projection,
-    addedPaths: []
-  };
-  const inclusionProjection = Object.entries(projection).some(([, value]) => value === 1);
-  const nextProjection = {
-    ...projection
-  };
-  const addedPaths = [];
-  const sortFields = Array.isArray(pagination.sort) ? pagination.sort.map((entry) => entry?.field).filter((field) => typeof field === "string") : [];
-  const cursorPaths = Array.from(/* @__PURE__ */ new Set([...sortFields, "_id"]));
-  if (!inclusionProjection) {
-    for (const path of cursorPaths) {
-      const excludedPath = Object.entries(projection).find(([projectedPath, value]) => value === 0 && (projectedPath === path || path.startsWith(`${projectedPath}.`)))?.[0];
-      if (!excludedPath) continue;
-      if (excludedPath !== path) {
-        throw new Error(`Pagination projection cannot exclude cursor path: ${path}`);
-      }
-      delete nextProjection[path];
-      addedPaths.push(path);
-    }
-    return {
-      projection: nextProjection,
-      addedPaths
-    };
-  }
-  for (const path of cursorPaths) {
-    const isIncluded = path === "_id" ? projection._id !== 0 : Object.entries(projection).some(([projectedPath, value]) => value === 1 && (projectedPath === path || path.startsWith(`${projectedPath}.`)));
-    if (isIncluded) continue;
-    nextProjection[path] = 1;
-    addedPaths.push(path);
-  }
-  return {
-    projection: nextProjection,
-    addedPaths
-  };
-};
-const stripPath = (target, path) => {
-  const parts = path.split(".");
-  let current = target;
-  for (let index = 0; index < parts.length - 1; index += 1) {
-    const part = parts[index];
-    const child = current[part];
-    if (!child || typeof child !== "object" || Array.isArray(child)) return;
-    const cloned = {
-      ...child
-    };
-    current[part] = cloned;
-    current = cloned;
-  }
-  delete current[parts[parts.length - 1]];
-};
-const stripAddedProjectionPaths = (nodes, addedPaths) => {
-  if (!addedPaths.length) return nodes;
-  return nodes.map((node) => {
-    if (!node || typeof node !== "object" || Array.isArray(node)) return node;
-    const toObject = node.toObject;
-    const raw = typeof toObject === "function" ? toObject.call(node) : node;
-    if (!raw || typeof raw !== "object" || Array.isArray(raw)) return raw;
-    const projected = {
-      ...raw
-    };
-    for (const path of addedPaths) stripPath(projected, path);
-    return projected;
-  });
-};
-const normalizePopulateSelect = (value) => {
-  if (typeof value === "string") {
-    const normalized = value.trim();
-    return normalized || void 0;
-  }
-  return normalizeObject(value);
-};
-const normalizePopulateOptions = (value) => {
-  if (!value || typeof value !== "object" || Array.isArray(value)) return void 0;
-  const raw = value;
-  const normalized = {};
-  if (raw.sort && typeof raw.sort === "object" && !Array.isArray(raw.sort)) {
-    normalized.sort = raw.sort;
-  }
-  if (typeof raw.limit === "number" && Number.isFinite(raw.limit)) {
-    normalized.limit = Math.max(0, Math.floor(Math.abs(raw.limit)));
-  }
-  if (!normalized.sort && normalized.limit === void 0) return void 0;
-  return normalized;
-};
-const normalizePopulateObject = (value) => {
-  if (!value || typeof value !== "object" || Array.isArray(value)) return void 0;
-  const raw = value;
-  const path = normalizeString(raw.path);
-  if (!path) return void 0;
-  const normalized = {
-    path
-  };
-  const model = normalizeString(raw.model);
-  if (model) normalized.model = model;
-  const select = normalizePopulateSelect(raw.select);
-  if (select !== void 0) normalized.select = select;
-  const match = normalizeObject(raw.match);
-  if (match) normalized.match = match;
-  const nestedPopulate = normalizeRtsPopulateOption(raw.populate);
-  if (nestedPopulate !== void 0) normalized.populate = nestedPopulate;
-  const options = normalizePopulateOptions(raw.options);
-  if (options) normalized.options = options;
-  return normalized;
-};
-const normalizeRtsPopulateOption = (value) => {
-  if (typeof value === "string") {
-    const normalized = value.trim();
-    return normalized || void 0;
-  }
-  if (Array.isArray(value)) {
-    const normalized = value.map((entry) => {
-      if (typeof entry === "string") {
-        const path = entry.trim();
-        return path || null;
-      }
-      return normalizePopulateObject(entry) ?? null;
-    }).filter((entry) => entry !== null);
-    return normalized.length > 0 ? normalized : void 0;
-  }
-  return normalizePopulateObject(value);
-};
-const normalizeModelName = (value) => {
-  if (typeof value !== "string") return null;
-  const normalized = value.trim();
-  return normalized || null;
-};
-const resolvePopulateRefModelName = (model, path, explicitModelName) => {
-  if (explicitModelName) return explicitModelName;
-  const schema = model.schema;
-  const schemaPath = typeof schema.path === "function" ? schema.path(path) : null;
-  const directRef = normalizeModelName(schemaPath?.options?.ref);
-  if (directRef) return directRef;
-  const arrayRef = normalizeModelName(schemaPath?.caster?.options?.ref);
-  if (arrayRef) return arrayRef;
-  const virtualPath = typeof schema.virtualpath === "function" ? schema.virtualpath(path) : null;
-  const virtualRef = normalizeModelName(virtualPath?.options?.ref);
-  if (virtualRef) return virtualRef;
-  return null;
-};
-const mergePopulateMatchWithAcl = (populateMatch, aclMatch) => {
-  if (!populateMatch || Object.keys(populateMatch).length === 0) return aclMatch;
-  return {
-    $and: [populateMatch, aclMatch]
-  };
-};
-const resolvePopulateSpecForModel = async ({
-  tenantId,
-  model,
-  ability,
-  populate,
-  allowInternalModels,
-  modelCache,
-  dependencyModelNames
-}) => {
-  if (!populate) return void 0;
-  const getModelCached = async (targetModelName) => {
-    const cached = modelCache.get(targetModelName);
-    if (cached) return cached;
-    const loaded = await getTenantModel(tenantId, targetModelName, ability);
-    modelCache.set(targetModelName, loaded);
-    return loaded;
-  };
-  const resolveOne = async (entry, parentModel) => {
-    if (typeof entry === "string") {
-      const path2 = entry.trim();
-      if (!path2) return null;
-      const refModelName2 = resolvePopulateRefModelName(parentModel, path2, null);
-      if (!refModelName2) return path2;
-      if (!allowInternalModels && INTERNAL_MODEL_NAMES.has(refModelName2)) {
-        throw new Error("Model not allowed");
-      }
-      if (!ability.can("read", refModelName2)) {
-        throw new Error("forbidden");
-      }
-      dependencyModelNames.add(refModelName2);
-      const aclMatch = getAccessibleByQuery(ability, "read", refModelName2);
-      return {
-        path: path2,
-        match: aclMatch
-      };
-    }
-    const path = entry.path.trim();
-    if (!path) return null;
-    const explicitModelName = normalizeModelName(entry.model);
-    const refModelName = resolvePopulateRefModelName(parentModel, path, explicitModelName);
-    let nestedModel = parentModel;
-    const normalizedEntry = {
-      path
-    };
-    if (entry.select !== void 0) normalizedEntry.select = entry.select;
-    if (entry.options !== void 0) normalizedEntry.options = entry.options;
-    if (explicitModelName) normalizedEntry.model = explicitModelName;
-    if (entry.match !== void 0) normalizedEntry.match = entry.match;
-    if (refModelName) {
-      if (!allowInternalModels && INTERNAL_MODEL_NAMES.has(refModelName)) {
-        throw new Error("Model not allowed");
-      }
-      if (!ability.can("read", refModelName)) {
-        throw new Error("forbidden");
-      }
-      dependencyModelNames.add(refModelName);
-      nestedModel = await getModelCached(refModelName);
-      const aclMatch = getAccessibleByQuery(ability, "read", refModelName);
-      normalizedEntry.match = mergePopulateMatchWithAcl(normalizedEntry.match, aclMatch);
-    } else if (entry.populate !== void 0) {
-      throw new Error("Populate path must reference a model when nested populate is used");
-    }
-    const nestedPopulate = await resolvePopulateSpecForModel({
-      tenantId,
-      model: nestedModel,
-      ability,
-      populate: entry.populate,
-      allowInternalModels,
-      modelCache,
-      dependencyModelNames
-    });
-    if (nestedPopulate !== void 0) normalizedEntry.populate = nestedPopulate;
-    return normalizedEntry;
-  };
-  if (Array.isArray(populate)) {
-    const resolved2 = await Promise.all(populate.map((entry) => resolveOne(entry, model)));
-    const filtered = resolved2.filter((entry) => entry !== null);
-    return filtered.length > 0 ? filtered : void 0;
-  }
-  const resolved = await resolveOne(populate, model);
-  return resolved ?? void 0;
-};
-const normalizeRtsQueryOptions = (options) => {
-  if (!options || typeof options !== "object") return {};
-  const normalized = {};
-  if (options.projection && typeof options.projection === "object" && !Array.isArray(options.projection)) {
-    normalized.projection = options.projection;
-  }
-  if (options.sort && typeof options.sort === "object" && !Array.isArray(options.sort)) {
-    normalized.sort = options.sort;
-  }
-  normalized.limit = normalizeLimit(options.limit);
-  normalized.populate = normalizeRtsPopulateOption(options.populate);
-  normalized.pagination = normalizePagination(options.pagination);
-  return normalized;
-};
-const resolveRtsQueryDependencyModelNames = async ({
-  tenantId,
-  ability,
-  modelName,
-  options,
-  allowInternalModels = false
-}) => {
-  const model = await getTenantModel(tenantId, modelName, ability);
-  const modelCache = /* @__PURE__ */ new Map();
-  modelCache.set(modelName, model);
-  const dependencyModelNames = /* @__PURE__ */ new Set();
-  await resolvePopulateSpecForModel({
-    tenantId,
-    model,
-    ability,
-    populate: options.populate,
-    allowInternalModels,
-    modelCache,
-    dependencyModelNames
-  });
-  return Array.from(dependencyModelNames);
-};
-const runRtsQuery = async ({
-  tenantId,
-  ability,
-  modelName,
-  query,
-  options,
-  allowInternalModels = false,
-  paginationMaxLimit,
-  includePaginationCursors = true
-}) => {
-  const {
-    model,
-    finalQuery
-  } = await prepareRtsExecution({
-    tenantId,
-    ability,
-    modelName,
-    query,
-    allowInternalModels
-  });
-  const projection = options.projection ?? void 0;
-  const sort = options.sort;
-  const limit = normalizeLimit(options.limit);
-  const modelCache = /* @__PURE__ */ new Map();
-  modelCache.set(modelName, model);
-  const populate = await resolvePopulateSpecForModel({
-    tenantId,
-    model,
-    ability,
-    populate: options.populate,
-    allowInternalModels,
-    modelCache,
-    dependencyModelNames: /* @__PURE__ */ new Set()
-  });
-  if (options.pagination) {
-    const cursorProjection = prepareCursorProjection(projection, options.pagination, includePaginationCursors);
-    const paginatedQuery = model.find(finalQuery, cursorProjection.projection);
-    if (populate !== void 0) {
-      paginatedQuery.populate(populate);
-    }
-    const paginatedResult = await paginatedQuery.paginate(options.pagination, {
-      cursor: {
-        signingSecret: getPaginationCursorSigningSecret(),
-        ...paginationMaxLimit !== void 0 ? {
-          maxLimit: paginationMaxLimit
-        } : {}
-      },
-      includeCursors: includePaginationCursors
-    });
-    const totalCount = typeof paginatedResult.totalCount === "number" && Number.isFinite(paginatedResult.totalCount) && paginatedResult.totalCount >= 0 ? Math.floor(paginatedResult.totalCount) : void 0;
-    const approximateTotalCount = totalCount === void 0 ? await runApproximateRtsCount(model, finalQuery).catch(() => void 0) : void 0;
-    const resolvedTotalCount = totalCount ?? approximateTotalCount;
-    return {
-      data: Array.isArray(paginatedResult.nodes) ? stripAddedProjectionPaths(paginatedResult.nodes, cursorProjection.addedPaths) : [],
-      pageInfo: paginatedResult.pageInfo,
-      ...resolvedTotalCount !== void 0 ? {
-        totalCount: resolvedTotalCount
-      } : {}
-    };
-  }
-  const queryPromise = model.find(finalQuery, projection);
-  if (populate !== void 0) {
-    queryPromise.populate(populate);
-  }
-  if (sort && Object.keys(sort).length) {
-    queryPromise.sort(sort);
-  }
-  queryPromise.limit(limit);
-  const data = await queryPromise;
-  return {
-    data: Array.isArray(data) ? data : []
-  };
-};
-const prepareRtsExecution = async ({
-  tenantId,
-  ability,
-  modelName,
-  query,
-  allowInternalModels = false
-}) => {
-  if (!allowInternalModels && INTERNAL_MODEL_NAMES.has(modelName)) {
-    throw new Error("Model not allowed");
-  }
-  if (!ability.can("read", modelName)) {
-    throw new Error("forbidden");
-  }
-  const model = await getTenantModel(tenantId, modelName, ability);
-  const accessQuery = getAccessibleByQuery(ability, "read", modelName);
-  const finalQuery = {
-    $and: [query, accessQuery]
-  };
-  return {
-    model,
-    finalQuery
-  };
-};
-const runApproximateRtsCount = async (model, query) => {
-  const unsupportedOperator = findUnsupportedApproxCountOperator(query);
-  if (unsupportedOperator) {
-    throw new Error(`Approximate RTS count does not support ${unsupportedOperator} queries`);
-  }
-  const castedQuery = castApproxCountQuery(model, query);
-  const estimatedTotal = normalizeNonNegativeInteger(await model.estimatedDocumentCount());
-  if (estimatedTotal === 0) return 0;
-  const sampleSize = Math.min(getApproxCountSampleSize(), estimatedTotal);
-  const sampleResult = await model.aggregate([{
-    $sample: {
-      size: sampleSize
-    }
-  }, {
-    $match: castedQuery
-  }, {
-    $count: "count"
-  }]);
-  const sampleMatches = normalizeNonNegativeInteger(sampleResult[0]?.count);
-  if (sampleSize >= estimatedTotal) {
-    return Math.min(sampleMatches, estimatedTotal);
-  }
-  const estimatedMatches = Math.round(estimatedTotal * sampleMatches / sampleSize);
-  return Math.max(0, Math.min(estimatedTotal, estimatedMatches));
-};
-const runRtsCount = async ({
-  tenantId,
-  ability,
-  modelName,
-  query,
-  allowInternalModels = false
-}) => {
-  const {
-    model,
-    finalQuery
-  } = await prepareRtsExecution({
-    tenantId,
-    ability,
-    modelName,
-    query,
-    allowInternalModels
-  });
-  return await runApproximateRtsCount(model, finalQuery);
-};
-const RTS_QUERY_WINDOW_MAX_COUNT = 4096;
-export {
-  RTS_QUERY_WINDOW_MAX_COUNT as R,
-  runRtsQuery as a,
-  buildRtsAbilityFromRequest as b,
-  runRtsCount as c,
-  syncAuthenticatedSessionFromRequest as d,
-  resolveRtsQueryDependencyModelNames as e,
-  getDerivedKey as g,
-  isRtsRequestAuthorized as i,
-  normalizeRtsQueryOptions as n,
-  resolveRtsRequestTenantId as r,
-  syncAuthenticatedSessionMiddleware as s
-};
-//# sourceMappingURL=queryWindow-Cdr7K-S1.js.map