@strapi/utils 5.12.1 → 5.12.3

package/dist/validate/validators.js

@@ -0,0 +1,369 @@
+'use strict';
+
+var fp = require('lodash/fp');
+var async = require('../async.js');
+var contentTypes = require('../content-types.js');
+var queryFilters = require('../traverse/query-filters.js');
+var querySort = require('../traverse/query-sort.js');
+var queryPopulate = require('../traverse/query-populate.js');
+var queryFields = require('../traverse/query-fields.js');
+var throwPassword = require('./visitors/throw-password.js');
+var throwPrivate = require('./visitors/throw-private.js');
+var utils = require('./utils.js');
+var throwMorphToRelations = require('./visitors/throw-morph-to-relations.js');
+var throwDynamicZones = require('./visitors/throw-dynamic-zones.js');
+require('./visitors/throw-unrecognized-fields.js');
+var operators = require('../operators.js');
+var parseType = require('../parse-type.js');
+
+const { ID_ATTRIBUTE, DOC_ID_ATTRIBUTE } = contentTypes.constants;
+const FILTER_TRAVERSALS = [
+    'nonAttributesOperators',
+    'dynamicZones',
+    'morphRelations',
+    'passwords',
+    'private'
+];
+const validateFilters = utils.asyncCurry(async (ctx, filters, include)=>{
+    // TODO: schema checks should check that it is a valid schema with yup
+    if (!ctx.schema) {
+        throw new Error('Missing schema in defaultValidateFilters');
+    }
+    // Build the list of functions conditionally
+    const functionsToApply = [];
+    // keys that are not attributes or valid operators
+    if (include.includes('nonAttributesOperators')) {
+        functionsToApply.push(queryFilters(({ key, attribute, path })=>{
+            // ID is not an attribute per se, so we need to make
+            // an extra check to ensure we're not removing it
+            if ([
+                ID_ATTRIBUTE,
+                DOC_ID_ATTRIBUTE
+            ].includes(key)) {
+                return;
+            }
+            const isAttribute = !!attribute;
+            if (!isAttribute && !operators.isOperator(key)) {
+                utils.throwInvalidKey({
+                    key,
+                    path: path.attribute
+                });
+            }
+        }, ctx));
+    }
+    if (include.includes('dynamicZones')) {
+        functionsToApply.push(queryFilters(throwDynamicZones, ctx));
+    }
+    if (include.includes('morphRelations')) {
+        functionsToApply.push(queryFilters(throwMorphToRelations, ctx));
+    }
+    if (include.includes('passwords')) {
+        functionsToApply.push(queryFilters(throwPassword, ctx));
+    }
+    if (include.includes('private')) {
+        functionsToApply.push(queryFilters(throwPrivate, ctx));
+    }
+    // Return directly if no validation functions are provided
+    if (functionsToApply.length === 0) {
+        return filters;
+    }
+    return async.pipe(...functionsToApply)(filters);
+});
+const defaultValidateFilters = utils.asyncCurry(async (ctx, filters)=>{
+    return validateFilters(ctx, filters, FILTER_TRAVERSALS);
+});
+const SORT_TRAVERSALS = [
+    'nonAttributesOperators',
+    'dynamicZones',
+    'morphRelations',
+    'passwords',
+    'private',
+    'nonScalarEmptyKeys'
+];
+const validateSort = utils.asyncCurry(async (ctx, sort, include)=>{
+    if (!ctx.schema) {
+        throw new Error('Missing schema in defaultValidateSort');
+    }
+    // Build the list of functions conditionally based on the include array
+    const functionsToApply = [];
+    // Validate non attribute keys
+    if (include.includes('nonAttributesOperators')) {
+        functionsToApply.push(querySort(({ key, attribute, path })=>{
+            // ID is not an attribute per se, so we need to make
+            // an extra check to ensure we're not removing it
+            if ([
+                ID_ATTRIBUTE,
+                DOC_ID_ATTRIBUTE
+            ].includes(key)) {
+                return;
+            }
+            if (!attribute) {
+                utils.throwInvalidKey({
+                    key,
+                    path: path.attribute
+                });
+            }
+        }, ctx));
+    }
+    // Validate dynamic zones from sort
+    if (include.includes('dynamicZones')) {
+        functionsToApply.push(querySort(throwDynamicZones, ctx));
+    }
+    // Validate morphTo relations from sort
+    if (include.includes('morphRelations')) {
+        functionsToApply.push(querySort(throwMorphToRelations, ctx));
+    }
+    // Validate passwords from sort
+    if (include.includes('passwords')) {
+        functionsToApply.push(querySort(throwPassword, ctx));
+    }
+    // Validate private from sort
+    if (include.includes('private')) {
+        functionsToApply.push(querySort(throwPrivate, ctx));
+    }
+    // Validate non-scalar empty keys
+    if (include.includes('nonScalarEmptyKeys')) {
+        functionsToApply.push(querySort(({ key, attribute, value, path })=>{
+            // ID is not an attribute per se, so we need to make
+            // an extra check to ensure we're not removing it
+            if ([
+                ID_ATTRIBUTE,
+                DOC_ID_ATTRIBUTE
+            ].includes(key)) {
+                return;
+            }
+            if (!contentTypes.isScalarAttribute(attribute) && fp.isEmpty(value)) {
+                utils.throwInvalidKey({
+                    key,
+                    path: path.attribute
+                });
+            }
+        }, ctx));
+    }
+    // Return directly if no validation functions are provided
+    if (functionsToApply.length === 0) {
+        return sort;
+    }
+    return async.pipe(...functionsToApply)(sort);
+});
+const defaultValidateSort = utils.asyncCurry(async (ctx, sort)=>{
+    return validateSort(ctx, sort, SORT_TRAVERSALS);
+});
+const FIELDS_TRAVERSALS = [
+    'scalarAttributes',
+    'privateFields',
+    'passwordFields'
+];
+const validateFields = utils.asyncCurry(async (ctx, fields, include)=>{
+    if (!ctx.schema) {
+        throw new Error('Missing schema in defaultValidateFields');
+    }
+    // Build the list of functions conditionally based on the include array
+    const functionsToApply = [];
+    // Only allow scalar attributes
+    if (include.includes('scalarAttributes')) {
+        functionsToApply.push(queryFields(({ key, attribute, path })=>{
+            // ID is not an attribute per se, so we need to make
+            // an extra check to ensure we're not throwing because of it
+            if ([
+                ID_ATTRIBUTE,
+                DOC_ID_ATTRIBUTE
+            ].includes(key)) {
+                return;
+            }
+            if (fp.isNil(attribute) || !contentTypes.isScalarAttribute(attribute)) {
+                utils.throwInvalidKey({
+                    key,
+                    path: path.attribute
+                });
+            }
+        }, ctx));
+    }
+    // Private fields
+    if (include.includes('privateFields')) {
+        functionsToApply.push(queryFields(throwPrivate, ctx));
+    }
+    // Password fields
+    if (include.includes('passwordFields')) {
+        functionsToApply.push(queryFields(throwPassword, ctx));
+    }
+    // Return directly if no validation functions are provided
+    if (functionsToApply.length === 0) {
+        return fields;
+    }
+    return async.pipe(...functionsToApply)(fields);
+});
+const defaultValidateFields = utils.asyncCurry(async (ctx, fields)=>{
+    return validateFields(ctx, fields, FIELDS_TRAVERSALS);
+});
+const POPULATE_TRAVERSALS = [
+    'nonAttributesOperators',
+    'private'
+];
+const validatePopulate = utils.asyncCurry(async (ctx, populate, includes)=>{
+    if (!ctx.schema) {
+        throw new Error('Missing schema in defaultValidatePopulate');
+    }
+    // Build the list of functions conditionally based on the include array
+    const functionsToApply = [];
+    // Always include the main traversal function
+    functionsToApply.push(queryPopulate(async ({ key, path, value, schema, attribute, getModel, parent }, { set })=>{
+        /**
+           * NOTE: The parent check is done to support "filters" (and the rest of keys) as valid attribute names.
+           *
+           * The parent will not be an attribute when its a "populate" / "filters" / "sort" ... key.
+           * Only in those scenarios the node will be an attribute.
+           */ if (!parent?.attribute && attribute) {
+            const isPopulatableAttribute = [
+                'relation',
+                'dynamiczone',
+                'component',
+                'media'
+            ].includes(attribute.type);
+            // Throw on non-populate attributes
+            if (!isPopulatableAttribute) {
+                utils.throwInvalidKey({
+                    key,
+                    path: path.raw
+                });
+            }
+            // Valid populatable attribute, so return
+            return;
+        }
+        // If we're looking at a populate fragment, ensure its target is valid
+        if (key === 'on') {
+            // Populate fragment should always be an object
+            if (!fp.isObject(value)) {
+                return utils.throwInvalidKey({
+                    key,
+                    path: path.raw
+                });
+            }
+            const targets = Object.keys(value);
+            for (const target of targets){
+                const model = getModel(target);
+                // If a target is invalid (no matching model), then raise an error
+                if (!model) {
+                    utils.throwInvalidKey({
+                        key: target,
+                        path: `${path.raw}.${target}`
+                    });
+                }
+            }
+            // If the fragment's target is fine, then let it pass
+            return;
+        }
+        // Ignore plain wildcards
+        if (key === '' && value === '*') {
+            return;
+        }
+        // Ensure count is a boolean
+        if (key === 'count') {
+            try {
+                parseType({
+                    type: 'boolean',
+                    value
+                });
+                return;
+            } catch  {
+                utils.throwInvalidKey({
+                    key,
+                    path: path.attribute
+                });
+            }
+        }
+        // Allowed boolean-like keywords should be ignored
+        try {
+            parseType({
+                type: 'boolean',
+                value: key
+            });
+            // Key is an allowed boolean-like keyword, skipping validation...
+            return;
+        } catch  {
+        // Continue, because it's not a boolean-like
+        }
+        // Handle nested `sort` validation with custom or default traversals
+        if (key === 'sort') {
+            set(key, await validateSort({
+                schema,
+                getModel
+            }, value, includes?.sort || SORT_TRAVERSALS));
+            return;
+        }
+        // Handle nested `filters` validation with custom or default traversals
+        if (key === 'filters') {
+            set(key, await validateFilters({
+                schema,
+                getModel
+            }, value, includes?.filters || FILTER_TRAVERSALS));
+            return;
+        }
+        // Handle nested `fields` validation with custom or default traversals
+        if (key === 'fields') {
+            set(key, await validateFields({
+                schema,
+                getModel
+            }, value, includes?.fields || FIELDS_TRAVERSALS));
+            return;
+        }
+        // Handle recursive nested `populate` validation with the same include object
+        if (key === 'populate') {
+            set(key, await validatePopulate({
+                schema,
+                getModel,
+                parent: {
+                    key,
+                    path,
+                    schema,
+                    attribute
+                },
+                path
+            }, value, includes // pass down the same includes object
+            ));
+            return;
+        }
+        // Throw an error if non-attribute operators are included in the populate array
+        if (includes?.populate?.includes('nonAttributesOperators')) {
+            utils.throwInvalidKey({
+                key,
+                path: path.attribute
+            });
+        }
+    }, ctx));
+    // Conditionally traverse for private fields only if 'private' is included
+    if (includes?.populate?.includes('private')) {
+        functionsToApply.push(queryPopulate(throwPrivate, ctx));
+    }
+    // Return directly if no validation functions are provided
+    if (functionsToApply.length === 0) {
+        return populate;
+    }
+    return async.pipe(...functionsToApply)(populate);
+});
+const defaultValidatePopulate = utils.asyncCurry(async (ctx, populate)=>{
+    if (!ctx.schema) {
+        throw new Error('Missing schema in defaultValidatePopulate');
+    }
+    // Call validatePopulate and include all validations by passing in full traversal arrays
+    return validatePopulate(ctx, populate, {
+        filters: FILTER_TRAVERSALS,
+        sort: SORT_TRAVERSALS,
+        fields: FIELDS_TRAVERSALS,
+        populate: POPULATE_TRAVERSALS
+    });
+});
+
+exports.FIELDS_TRAVERSALS = FIELDS_TRAVERSALS;
+exports.FILTER_TRAVERSALS = FILTER_TRAVERSALS;
+exports.POPULATE_TRAVERSALS = POPULATE_TRAVERSALS;
+exports.SORT_TRAVERSALS = SORT_TRAVERSALS;
+exports.defaultValidateFields = defaultValidateFields;
+exports.defaultValidateFilters = defaultValidateFilters;
+exports.defaultValidatePopulate = defaultValidatePopulate;
+exports.defaultValidateSort = defaultValidateSort;
+exports.validateFields = validateFields;
+exports.validateFilters = validateFilters;
+exports.validatePopulate = validatePopulate;
+exports.validateSort = validateSort;
+//# sourceMappingURL=validators.js.map

package/dist/validate/validators.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"validators.js","sources":["../../src/validate/validators.ts"],"sourcesContent":["import { isEmpty, isNil, isObject } from 'lodash/fp';\n\nimport { pipe as pipeAsync } from '../async';\nimport { isScalarAttribute, constants } from '../content-types';\nimport {\n  traverseQueryFilters,\n  traverseQuerySort,\n  traverseQueryFields,\n  traverseQueryPopulate,\n} from '../traverse';\nimport { throwPassword, throwPrivate, throwDynamicZones, throwMorphToRelations } from './visitors';\nimport { isOperator } from '../operators';\nimport { asyncCurry, throwInvalidKey } from './utils';\nimport type { Model } from '../types';\nimport parseType from '../parse-type';\nimport type { Parent, Path } from '../traverse/factory';\n\nconst { ID_ATTRIBUTE, DOC_ID_ATTRIBUTE } = constants;\n\ninterface Context {\n  schema: Model;\n  getModel: (model: string) => Model;\n}\n\ninterface PopulateContext extends Context {\n  path?: Path;\n  parent?: Parent;\n}\n\ntype AnyFunc = (...args: any[]) => any;\n\nexport const FILTER_TRAVERSALS = [\n  'nonAttributesOperators',\n  'dynamicZones',\n  'morphRelations',\n  'passwords',\n  'private',\n];\n\nexport const validateFilters = asyncCurry(\n  async (ctx: Context, filters: unknown, include: (typeof FILTER_TRAVERSALS)[number][]) => {\n    // TODO: schema checks should check that it is a valid schema with yup\n    if (!ctx.schema) {\n      throw new Error('Missing schema in defaultValidateFilters');\n    }\n\n    // Build the list of functions conditionally\n    const functionsToApply: Array<AnyFunc> = [];\n\n    // keys that are not attributes or valid operators\n    if (include.includes('nonAttributesOperators')) {\n      functionsToApply.push(\n        traverseQueryFilters(({ key, attribute, path }) => {\n          // ID is not an attribute per se, so we need to make\n          // an extra check to ensure we're not removing it\n          if ([ID_ATTRIBUTE, DOC_ID_ATTRIBUTE].includes(key)) {\n            return;\n          }\n\n          const isAttribute = !!attribute;\n\n          if (!isAttribute && !isOperator(key)) {\n            throwInvalidKey({ key, path: path.attribute });\n          }\n        }, ctx)\n      );\n    }\n\n    if (include.includes('dynamicZones')) {\n      functionsToApply.push(traverseQueryFilters(throwDynamicZones, ctx));\n    }\n\n    if (include.includes('morphRelations')) {\n      functionsToApply.push(traverseQueryFilters(throwMorphToRelations, ctx));\n    }\n\n    if (include.includes('passwords')) {\n      functionsToApply.push(traverseQueryFilters(throwPassword, ctx));\n    }\n\n    if (include.includes('private')) {\n      functionsToApply.push(traverseQueryFilters(throwPrivate, ctx));\n    }\n\n    // Return directly if no validation functions are provided\n    if (functionsToApply.length === 0) {\n      return filters;\n    }\n\n    return pipeAsync(...functionsToApply)(filters);\n  }\n);\n\nexport const defaultValidateFilters = asyncCurry(async (ctx: Context, filters: unknown) => {\n  return validateFilters(ctx, filters, FILTER_TRAVERSALS);\n});\n\nexport const SORT_TRAVERSALS = [\n  'nonAttributesOperators',\n  'dynamicZones',\n  'morphRelations',\n  'passwords',\n  'private',\n  'nonScalarEmptyKeys',\n];\n\nexport const validateSort = asyncCurry(\n  async (ctx: Context, sort: unknown, include: (typeof SORT_TRAVERSALS)[number][]) => {\n    if (!ctx.schema) {\n      throw new Error('Missing schema in defaultValidateSort');\n    }\n\n    // Build the list of functions conditionally based on the include array\n    const functionsToApply: Array<AnyFunc> = [];\n\n    // Validate non attribute keys\n    if (include.includes('nonAttributesOperators')) {\n      functionsToApply.push(\n        traverseQuerySort(({ key, attribute, path }) => {\n          // ID is not an attribute per se, so we need to make\n          // an extra check to ensure we're not removing it\n          if ([ID_ATTRIBUTE, DOC_ID_ATTRIBUTE].includes(key)) {\n            return;\n          }\n\n          if (!attribute) {\n            throwInvalidKey({ key, path: path.attribute });\n          }\n        }, ctx)\n      );\n    }\n\n    // Validate dynamic zones from sort\n    if (include.includes('dynamicZones')) {\n      functionsToApply.push(traverseQuerySort(throwDynamicZones, ctx));\n    }\n\n    // Validate morphTo relations from sort\n    if (include.includes('morphRelations')) {\n      functionsToApply.push(traverseQuerySort(throwMorphToRelations, ctx));\n    }\n\n    // Validate passwords from sort\n    if (include.includes('passwords')) {\n      functionsToApply.push(traverseQuerySort(throwPassword, ctx));\n    }\n\n    // Validate private from sort\n    if (include.includes('private')) {\n      functionsToApply.push(traverseQuerySort(throwPrivate, ctx));\n    }\n\n    // Validate non-scalar empty keys\n    if (include.includes('nonScalarEmptyKeys')) {\n      functionsToApply.push(\n        traverseQuerySort(({ key, attribute, value, path }) => {\n          // ID is not an attribute per se, so we need to make\n          // an extra check to ensure we're not removing it\n          if ([ID_ATTRIBUTE, DOC_ID_ATTRIBUTE].includes(key)) {\n            return;\n          }\n\n          if (!isScalarAttribute(attribute) && isEmpty(value)) {\n            throwInvalidKey({ key, path: path.attribute });\n          }\n        }, ctx)\n      );\n    }\n\n    // Return directly if no validation functions are provided\n    if (functionsToApply.length === 0) {\n      return sort;\n    }\n\n    return pipeAsync(...functionsToApply)(sort);\n  }\n);\n\nexport const defaultValidateSort = asyncCurry(async (ctx: Context, sort: unknown) => {\n  return validateSort(ctx, sort, SORT_TRAVERSALS);\n});\n\nexport const FIELDS_TRAVERSALS = ['scalarAttributes', 'privateFields', 'passwordFields'];\n\nexport const validateFields = asyncCurry(\n  async (ctx: Context, fields: unknown, include: (typeof FIELDS_TRAVERSALS)[number][]) => {\n    if (!ctx.schema) {\n      throw new Error('Missing schema in defaultValidateFields');\n    }\n    // Build the list of functions conditionally based on the include array\n    const functionsToApply: Array<AnyFunc> = [];\n\n    // Only allow scalar attributes\n    if (include.includes('scalarAttributes')) {\n      functionsToApply.push(\n        traverseQueryFields(({ key, attribute, path }) => {\n          // ID is not an attribute per se, so we need to make\n          // an extra check to ensure we're not throwing because of it\n          if ([ID_ATTRIBUTE, DOC_ID_ATTRIBUTE].includes(key)) {\n            return;\n          }\n\n          if (isNil(attribute) || !isScalarAttribute(attribute)) {\n            throwInvalidKey({ key, path: path.attribute });\n          }\n        }, ctx)\n      );\n    }\n\n    // Private fields\n    if (include.includes('privateFields')) {\n      functionsToApply.push(traverseQueryFields(throwPrivate, ctx));\n    }\n\n    // Password fields\n    if (include.includes('passwordFields')) {\n      functionsToApply.push(traverseQueryFields(throwPassword, ctx));\n    }\n\n    // Return directly if no validation functions are provided\n    if (functionsToApply.length === 0) {\n      return fields;\n    }\n\n    return pipeAsync(...functionsToApply)(fields);\n  }\n);\n\nexport const defaultValidateFields = asyncCurry(async (ctx: Context, fields: unknown) => {\n  return validateFields(ctx, fields, FIELDS_TRAVERSALS);\n});\n\nexport const POPULATE_TRAVERSALS = ['nonAttributesOperators', 'private'];\n\nexport const validatePopulate = asyncCurry(\n  async (\n    ctx: PopulateContext,\n    populate: unknown,\n    includes: {\n      fields?: (typeof FIELDS_TRAVERSALS)[number][];\n      sort?: (typeof SORT_TRAVERSALS)[number][];\n      filters?: (typeof FILTER_TRAVERSALS)[number][];\n      populate?: (typeof POPULATE_TRAVERSALS)[number][];\n    }\n  ) => {\n    if (!ctx.schema) {\n      throw new Error('Missing schema in defaultValidatePopulate');\n    }\n    // Build the list of functions conditionally based on the include array\n    const functionsToApply: Array<AnyFunc> = [];\n\n    // Always include the main traversal function\n    functionsToApply.push(\n      traverseQueryPopulate(\n        async ({ key, path, value, schema, attribute, getModel, parent }, { set }) => {\n          /**\n           * NOTE: The parent check is done to support \"filters\" (and the rest of keys) as valid attribute names.\n           *\n           * The parent will not be an attribute when its a \"populate\" / \"filters\" / \"sort\" ... key.\n           * Only in those scenarios the node will be an attribute.\n           */\n          if (!parent?.attribute && attribute) {\n            const isPopulatableAttribute = [\n              'relation',\n              'dynamiczone',\n              'component',\n              'media',\n            ].includes(attribute.type);\n\n            // Throw on non-populate attributes\n            if (!isPopulatableAttribute) {\n              throwInvalidKey({ key, path: path.raw });\n            }\n\n            // Valid populatable attribute, so return\n            return;\n          }\n\n          // If we're looking at a populate fragment, ensure its target is valid\n          if (key === 'on') {\n            // Populate fragment should always be an object\n            if (!isObject(value)) {\n              return throwInvalidKey({ key, path: path.raw });\n            }\n\n            const targets = Object.keys(value);\n\n            for (const target of targets) {\n              const model = getModel(target);\n\n              // If a target is invalid (no matching model), then raise an error\n              if (!model) {\n                throwInvalidKey({ key: target, path: `${path.raw}.${target}` });\n              }\n            }\n\n            // If the fragment's target is fine, then let it pass\n            return;\n          }\n\n          // Ignore plain wildcards\n          if (key === '' && value === '*') {\n            return;\n          }\n\n          // Ensure count is a boolean\n          if (key === 'count') {\n            try {\n              parseType({ type: 'boolean', value });\n              return;\n            } catch {\n              throwInvalidKey({ key, path: path.attribute });\n            }\n          }\n\n          // Allowed boolean-like keywords should be ignored\n          try {\n            parseType({ type: 'boolean', value: key });\n            // Key is an allowed boolean-like keyword, skipping validation...\n            return;\n          } catch {\n            // Continue, because it's not a boolean-like\n          }\n\n          // Handle nested `sort` validation with custom or default traversals\n          if (key === 'sort') {\n            set(\n              key,\n              await validateSort(\n                {\n                  schema,\n                  getModel,\n                },\n                value, // pass the sort value\n                includes?.sort || SORT_TRAVERSALS\n              )\n            );\n            return;\n          }\n\n          // Handle nested `filters` validation with custom or default traversals\n          if (key === 'filters') {\n            set(\n              key,\n              await validateFilters(\n                {\n                  schema,\n                  getModel,\n                },\n                value, // pass the filters value\n                includes?.filters || FILTER_TRAVERSALS\n              )\n            );\n            return;\n          }\n\n          // Handle nested `fields` validation with custom or default traversals\n          if (key === 'fields') {\n            set(\n              key,\n              await validateFields(\n                {\n                  schema,\n                  getModel,\n                },\n                value, // pass the fields value\n                includes?.fields || FIELDS_TRAVERSALS\n              )\n            );\n            return;\n          }\n\n          // Handle recursive nested `populate` validation with the same include object\n          if (key === 'populate') {\n            set(\n              key,\n              await validatePopulate(\n                {\n                  schema,\n                  getModel,\n                  parent: { key, path, schema, attribute },\n                  path,\n                },\n                value, // pass the nested populate value\n                includes // pass down the same includes object\n              )\n            );\n            return;\n          }\n\n          // Throw an error if non-attribute operators are included in the populate array\n          if (includes?.populate?.includes('nonAttributesOperators')) {\n            throwInvalidKey({ key, path: path.attribute });\n          }\n        },\n        ctx\n      )\n    );\n\n    // Conditionally traverse for private fields only if 'private' is included\n    if (includes?.populate?.includes('private')) {\n      functionsToApply.push(traverseQueryPopulate(throwPrivate, ctx));\n    }\n\n    // Return directly if no validation functions are provided\n    if (functionsToApply.length === 0) {\n      return populate;\n    }\n\n    return pipeAsync(...functionsToApply)(populate);\n  }\n);\n\nexport const defaultValidatePopulate = asyncCurry(async (ctx: Context, populate: unknown) => {\n  if (!ctx.schema) {\n    throw new Error('Missing schema in defaultValidatePopulate');\n  }\n\n  // Call validatePopulate and include all validations by passing in full traversal arrays\n  return validatePopulate(ctx, populate, {\n    filters: FILTER_TRAVERSALS,\n    sort: SORT_TRAVERSALS,\n    fields: FIELDS_TRAVERSALS,\n    populate: POPULATE_TRAVERSALS,\n  });\n});\n"],"names":["ID_ATTRIBUTE","DOC_ID_ATTRIBUTE","constants","FILTER_TRAVERSALS","validateFilters","asyncCurry","ctx","filters","include","schema","Error","functionsToApply","includes","push","traverseQueryFilters","key","attribute","path","isAttribute","isOperator","throwInvalidKey","throwDynamicZones","throwMorphToRelations","throwPassword","throwPrivate","length","pipeAsync","defaultValidateFilters","SORT_TRAVERSALS","validateSort","sort","traverseQuerySort","value","isScalarAttribute","isEmpty","defaultValidateSort","FIELDS_TRAVERSALS","validateFields","fields","traverseQueryFields","isNil","defaultValidateFields","POPULATE_TRAVERSALS","validatePopulate","populate","traverseQueryPopulate","getModel","parent","set","isPopulatableAttribute","type","raw","isObject","targets","Object","keys","target","model","parseType","defaultValidatePopulate"],"mappings":";;;;;;;;;;;;;;;;;;AAiBA,MAAM,EAAEA,YAAY,EAAEC,gBAAgB,EAAE,GAAGC,sBAAAA;MAc9BC,iBAAoB,GAAA;AAC/B,IAAA,wBAAA;AACA,IAAA,cAAA;AACA,IAAA,gBAAA;AACA,IAAA,WAAA;AACA,IAAA;;AAGWC,MAAAA,eAAAA,GAAkBC,gBAC7B,CAAA,OAAOC,KAAcC,OAAkBC,EAAAA,OAAAA,GAAAA;;IAErC,IAAI,CAACF,GAAIG,CAAAA,MAAM,EAAE;AACf,QAAA,MAAM,IAAIC,KAAM,CAAA,0CAAA,CAAA;AAClB;;AAGA,IAAA,MAAMC,mBAAmC,EAAE;;IAG3C,IAAIH,OAAAA,CAAQI,QAAQ,CAAC,wBAA2B,CAAA,EAAA;QAC9CD,gBAAiBE,CAAAA,IAAI,CACnBC,YAAAA,CAAqB,CAAC,EAAEC,GAAG,EAAEC,SAAS,EAAEC,IAAI,EAAE,GAAA;;;YAG5C,IAAI;AAACjB,gBAAAA,YAAAA;AAAcC,gBAAAA;aAAiB,CAACW,QAAQ,CAACG,GAAM,CAAA,EAAA;AAClD,gBAAA;AACF;YAEA,MAAMG,WAAAA,GAAc,CAAC,CAACF,SAAAA;AAEtB,YAAA,IAAI,CAACE,WAAAA,IAAe,CAACC,oBAAAA,CAAWJ,GAAM,CAAA,EAAA;gBACpCK,qBAAgB,CAAA;AAAEL,oBAAAA,GAAAA;AAAKE,oBAAAA,IAAAA,EAAMA,KAAKD;AAAU,iBAAA,CAAA;AAC9C;SACCV,EAAAA,GAAAA,CAAAA,CAAAA;AAEP;IAEA,IAAIE,OAAAA,CAAQI,QAAQ,CAAC,cAAiB,CAAA,EAAA;QACpCD,gBAAiBE,CAAAA,IAAI,CAACC,YAAAA,CAAqBO,iBAAmBf,EAAAA,GAAAA,CAAAA,CAAAA;AAChE;IAEA,IAAIE,OAAAA,CAAQI,QAAQ,CAAC,gBAAmB,CAAA,EAAA;QACtCD,gBAAiBE,CAAAA,IAAI,CAACC,YAAAA,CAAqBQ,qBAAuBhB,EAAAA,GAAAA,CAAAA,CAAAA;AACpE;IAEA,IAAIE,OAAAA,CAAQI,QAAQ,CAAC,WAAc,CAAA,EAAA;QACjCD,gBAAiBE,CAAAA,IAAI,CAACC,YAAAA,CAAqBS,aAAejB,EAAAA,GAAAA,CAAAA,CAAAA;AAC5D;IAEA,IAAIE,OAAAA,CAAQI,QAAQ,CAAC,SAAY,CAAA,EAAA;QAC/BD,gBAAiBE,CAAAA,IAAI,CAACC,YAAAA,CAAqBU,YAAclB,EAAAA,GAAAA,CAAAA,CAAAA;AAC3D;;IAGA,IAAIK,gBAAAA,CAAiBc,MAAM,KAAK,CAAG,EAAA;QACjC,OAAOlB,OAAAA;AACT;AAEA,IAAA,OAAOmB,cAAaf,gBAAkBJ,CAAAA,CAAAA,OAAAA,CAAAA;AACxC,CACA;AAEWoB,MAAAA,sBAAAA,GAAyBtB,gBAAW,CAAA,OAAOC,GAAcC,EAAAA,OAAAA,GAAAA;IACpE,OAAOH,eAAAA,CAAgBE,KAAKC,OAASJ,EAAAA,iBAAAA,CAAAA;AACvC,CAAG;MAEUyB,eAAkB,GAAA;AAC7B,IAAA,wBAAA;AACA,IAAA,cAAA;AACA,IAAA,gBAAA;AACA,IAAA,WAAA;AACA,IAAA,SAAA;AACA,IAAA;;AAGWC,MAAAA,YAAAA,GAAexB,gBAC1B,CAAA,OAAOC,KAAcwB,IAAetB,EAAAA,OAAAA,GAAAA;IAClC,IAAI,CAACF,GAAIG,CAAAA,MAAM,EAAE;AACf,QAAA,MAAM,IAAIC,KAAM,CAAA,uCAAA,CAAA;AAClB;;AAGA,IAAA,MAAMC,mBAAmC,EAAE;;IAG3C,IAAIH,OAAAA,CAAQI,QAAQ,CAAC,wBAA2B,CAAA,EAAA;QAC9CD,gBAAiBE,CAAAA,IAAI,CACnBkB,SAAAA,CAAkB,CAAC,EAAEhB,GAAG,EAAEC,SAAS,EAAEC,IAAI,EAAE,GAAA;;;YAGzC,IAAI;AAACjB,gBAAAA,YAAAA;AAAcC,gBAAAA;aAAiB,CAACW,QAAQ,CAACG,GAAM,CAAA,EAAA;AAClD,gBAAA;AACF;AAEA,YAAA,IAAI,CAACC,SAAW,EAAA;gBACdI,qBAAgB,CAAA;AAAEL,oBAAAA,GAAAA;AAAKE,oBAAAA,IAAAA,EAAMA,KAAKD;AAAU,iBAAA,CAAA;AAC9C;SACCV,EAAAA,GAAAA,CAAAA,CAAAA;AAEP;;IAGA,IAAIE,OAAAA,CAAQI,QAAQ,CAAC,cAAiB,CAAA,EAAA;QACpCD,gBAAiBE,CAAAA,IAAI,CAACkB,SAAAA,CAAkBV,iBAAmBf,EAAAA,GAAAA,CAAAA,CAAAA;AAC7D;;IAGA,IAAIE,OAAAA,CAAQI,QAAQ,CAAC,gBAAmB,CAAA,EAAA;QACtCD,gBAAiBE,CAAAA,IAAI,CAACkB,SAAAA,CAAkBT,qBAAuBhB,EAAAA,GAAAA,CAAAA,CAAAA;AACjE;;IAGA,IAAIE,OAAAA,CAAQI,QAAQ,CAAC,WAAc,CAAA,EAAA;QACjCD,gBAAiBE,CAAAA,IAAI,CAACkB,SAAAA,CAAkBR,aAAejB,EAAAA,GAAAA,CAAAA,CAAAA;AACzD;;IAGA,IAAIE,OAAAA,CAAQI,QAAQ,CAAC,SAAY,CAAA,EAAA;QAC/BD,gBAAiBE,CAAAA,IAAI,CAACkB,SAAAA,CAAkBP,YAAclB,EAAAA,GAAAA,CAAAA,CAAAA;AACxD;;IAGA,IAAIE,OAAAA,CAAQI,QAAQ,CAAC,oBAAuB,CAAA,EAAA;AAC1CD,QAAAA,gBAAAA,CAAiBE,IAAI,CACnBkB,SAAkB,CAAA,CAAC,EAAEhB,GAAG,EAAEC,SAAS,EAAEgB,KAAK,EAAEf,IAAI,EAAE,GAAA;;;YAGhD,IAAI;AAACjB,gBAAAA,YAAAA;AAAcC,gBAAAA;aAAiB,CAACW,QAAQ,CAACG,GAAM,CAAA,EAAA;AAClD,gBAAA;AACF;AAEA,YAAA,IAAI,CAACkB,8BAAAA,CAAkBjB,SAAckB,CAAAA,IAAAA,UAAAA,CAAQF,KAAQ,CAAA,EAAA;gBACnDZ,qBAAgB,CAAA;AAAEL,oBAAAA,GAAAA;AAAKE,oBAAAA,IAAAA,EAAMA,KAAKD;AAAU,iBAAA,CAAA;AAC9C;SACCV,EAAAA,GAAAA,CAAAA,CAAAA;AAEP;;IAGA,IAAIK,gBAAAA,CAAiBc,MAAM,KAAK,CAAG,EAAA;QACjC,OAAOK,IAAAA;AACT;AAEA,IAAA,OAAOJ,cAAaf,gBAAkBmB,CAAAA,CAAAA,IAAAA,CAAAA;AACxC,CACA;AAEWK,MAAAA,mBAAAA,GAAsB9B,gBAAW,CAAA,OAAOC,GAAcwB,EAAAA,IAAAA,GAAAA;IACjE,OAAOD,YAAAA,CAAavB,KAAKwB,IAAMF,EAAAA,eAAAA,CAAAA;AACjC,CAAG;MAEUQ,iBAAoB,GAAA;AAAC,IAAA,kBAAA;AAAoB,IAAA,eAAA;AAAiB,IAAA;;AAE1DC,MAAAA,cAAAA,GAAiBhC,gBAC5B,CAAA,OAAOC,KAAcgC,MAAiB9B,EAAAA,OAAAA,GAAAA;IACpC,IAAI,CAACF,GAAIG,CAAAA,MAAM,EAAE;AACf,QAAA,MAAM,IAAIC,KAAM,CAAA,yCAAA,CAAA;AAClB;;AAEA,IAAA,MAAMC,mBAAmC,EAAE;;IAG3C,IAAIH,OAAAA,CAAQI,QAAQ,CAAC,kBAAqB,CAAA,EAAA;QACxCD,gBAAiBE,CAAAA,IAAI,CACnB0B,WAAAA,CAAoB,CAAC,EAAExB,GAAG,EAAEC,SAAS,EAAEC,IAAI,EAAE,GAAA;;;YAG3C,IAAI;AAACjB,gBAAAA,YAAAA;AAAcC,gBAAAA;aAAiB,CAACW,QAAQ,CAACG,GAAM,CAAA,EAAA;AAClD,gBAAA;AACF;AAEA,YAAA,IAAIyB,QAAMxB,CAAAA,SAAAA,CAAAA,IAAc,CAACiB,8BAAAA,CAAkBjB,SAAY,CAAA,EAAA;gBACrDI,qBAAgB,CAAA;AAAEL,oBAAAA,GAAAA;AAAKE,oBAAAA,IAAAA,EAAMA,KAAKD;AAAU,iBAAA,CAAA;AAC9C;SACCV,EAAAA,GAAAA,CAAAA,CAAAA;AAEP;;IAGA,IAAIE,OAAAA,CAAQI,QAAQ,CAAC,eAAkB,CAAA,EAAA;QACrCD,gBAAiBE,CAAAA,IAAI,CAAC0B,WAAAA,CAAoBf,YAAclB,EAAAA,GAAAA,CAAAA,CAAAA;AAC1D;;IAGA,IAAIE,OAAAA,CAAQI,QAAQ,CAAC,gBAAmB,CAAA,EAAA;QACtCD,gBAAiBE,CAAAA,IAAI,CAAC0B,WAAAA,CAAoBhB,aAAejB,EAAAA,GAAAA,CAAAA,CAAAA;AAC3D;;IAGA,IAAIK,gBAAAA,CAAiBc,MAAM,KAAK,CAAG,EAAA;QACjC,OAAOa,MAAAA;AACT;AAEA,IAAA,OAAOZ,cAAaf,gBAAkB2B,CAAAA,CAAAA,MAAAA,CAAAA;AACxC,CACA;AAEWG,MAAAA,qBAAAA,GAAwBpC,gBAAW,CAAA,OAAOC,GAAcgC,EAAAA,MAAAA,GAAAA;IACnE,OAAOD,cAAAA,CAAe/B,KAAKgC,MAAQF,EAAAA,iBAAAA,CAAAA;AACrC,CAAG;MAEUM,mBAAsB,GAAA;AAAC,IAAA,wBAAA;AAA0B,IAAA;;AAEjDC,MAAAA,gBAAAA,GAAmBtC,gBAC9B,CAAA,OACEC,KACAsC,QACAhC,EAAAA,QAAAA,GAAAA;IAOA,IAAI,CAACN,GAAIG,CAAAA,MAAM,EAAE;AACf,QAAA,MAAM,IAAIC,KAAM,CAAA,2CAAA,CAAA;AAClB;;AAEA,IAAA,MAAMC,mBAAmC,EAAE;;IAG3CA,gBAAiBE,CAAAA,IAAI,CACnBgC,aACE,CAAA,OAAO,EAAE9B,GAAG,EAAEE,IAAI,EAAEe,KAAK,EAAEvB,MAAM,EAAEO,SAAS,EAAE8B,QAAQ,EAAEC,MAAM,EAAE,EAAE,EAAEC,GAAG,EAAE,GAAA;AACvE;;;;;AAKC,cACD,IAAI,CAACD,MAAQ/B,EAAAA,SAAAA,IAAaA,SAAW,EAAA;AACnC,YAAA,MAAMiC,sBAAyB,GAAA;AAC7B,gBAAA,UAAA;AACA,gBAAA,aAAA;AACA,gBAAA,WAAA;AACA,gBAAA;aACD,CAACrC,QAAQ,CAACI,SAAAA,CAAUkC,IAAI,CAAA;;AAGzB,YAAA,IAAI,CAACD,sBAAwB,EAAA;gBAC3B7B,qBAAgB,CAAA;AAAEL,oBAAAA,GAAAA;AAAKE,oBAAAA,IAAAA,EAAMA,KAAKkC;AAAI,iBAAA,CAAA;AACxC;;AAGA,YAAA;AACF;;AAGA,QAAA,IAAIpC,QAAQ,IAAM,EAAA;;YAEhB,IAAI,CAACqC,YAASpB,KAAQ,CAAA,EAAA;AACpB,gBAAA,OAAOZ,qBAAgB,CAAA;AAAEL,oBAAAA,GAAAA;AAAKE,oBAAAA,IAAAA,EAAMA,KAAKkC;AAAI,iBAAA,CAAA;AAC/C;YAEA,MAAME,OAAAA,GAAUC,MAAOC,CAAAA,IAAI,CAACvB,KAAAA,CAAAA;YAE5B,KAAK,MAAMwB,UAAUH,OAAS,CAAA;AAC5B,gBAAA,MAAMI,QAAQX,QAASU,CAAAA,MAAAA,CAAAA;;AAGvB,gBAAA,IAAI,CAACC,KAAO,EAAA;oBACVrC,qBAAgB,CAAA;wBAAEL,GAAKyC,EAAAA,MAAAA;wBAAQvC,IAAM,EAAA,CAAC,EAAEA,IAAKkC,CAAAA,GAAG,CAAC,CAAC,EAAEK,OAAO;AAAE,qBAAA,CAAA;AAC/D;AACF;;AAGA,YAAA;AACF;;QAGA,IAAIzC,GAAAA,KAAQ,EAAMiB,IAAAA,KAAAA,KAAU,GAAK,EAAA;AAC/B,YAAA;AACF;;AAGA,QAAA,IAAIjB,QAAQ,OAAS,EAAA;YACnB,IAAI;gBACF2C,SAAU,CAAA;oBAAER,IAAM,EAAA,SAAA;AAAWlB,oBAAAA;AAAM,iBAAA,CAAA;AACnC,gBAAA;AACF,aAAA,CAAE,OAAM;gBACNZ,qBAAgB,CAAA;AAAEL,oBAAAA,GAAAA;AAAKE,oBAAAA,IAAAA,EAAMA,KAAKD;AAAU,iBAAA,CAAA;AAC9C;AACF;;QAGA,IAAI;YACF0C,SAAU,CAAA;gBAAER,IAAM,EAAA,SAAA;gBAAWlB,KAAOjB,EAAAA;AAAI,aAAA,CAAA;;AAExC,YAAA;AACF,SAAA,CAAE,OAAM;;AAER;;AAGA,QAAA,IAAIA,QAAQ,MAAQ,EAAA;YAClBiC,GACEjC,CAAAA,GAAAA,EACA,MAAMc,YACJ,CAAA;AACEpB,gBAAAA,MAAAA;AACAqC,gBAAAA;aAEFd,EAAAA,KAAAA,EACApB,UAAUkB,IAAQF,IAAAA,eAAAA,CAAAA,CAAAA;AAGtB,YAAA;AACF;;AAGA,QAAA,IAAIb,QAAQ,SAAW,EAAA;YACrBiC,GACEjC,CAAAA,GAAAA,EACA,MAAMX,eACJ,CAAA;AACEK,gBAAAA,MAAAA;AACAqC,gBAAAA;aAEFd,EAAAA,KAAAA,EACApB,UAAUL,OAAWJ,IAAAA,iBAAAA,CAAAA,CAAAA;AAGzB,YAAA;AACF;;AAGA,QAAA,IAAIY,QAAQ,QAAU,EAAA;YACpBiC,GACEjC,CAAAA,GAAAA,EACA,MAAMsB,cACJ,CAAA;AACE5B,gBAAAA,MAAAA;AACAqC,gBAAAA;aAEFd,EAAAA,KAAAA,EACApB,UAAU0B,MAAUF,IAAAA,iBAAAA,CAAAA,CAAAA;AAGxB,YAAA;AACF;;AAGA,QAAA,IAAIrB,QAAQ,UAAY,EAAA;YACtBiC,GACEjC,CAAAA,GAAAA,EACA,MAAM4B,gBACJ,CAAA;AACElC,gBAAAA,MAAAA;AACAqC,gBAAAA,QAAAA;gBACAC,MAAQ,EAAA;AAAEhC,oBAAAA,GAAAA;AAAKE,oBAAAA,IAAAA;AAAMR,oBAAAA,MAAAA;AAAQO,oBAAAA;AAAU,iBAAA;AACvCC,gBAAAA;aAEFe,EAAAA,KAAAA,EACApB;;AAGJ,YAAA;AACF;;QAGA,IAAIA,QAAAA,EAAUgC,QAAUhC,EAAAA,QAAAA,CAAS,wBAA2B,CAAA,EAAA;YAC1DQ,qBAAgB,CAAA;AAAEL,gBAAAA,GAAAA;AAAKE,gBAAAA,IAAAA,EAAMA,KAAKD;AAAU,aAAA,CAAA;AAC9C;KAEFV,EAAAA,GAAAA,CAAAA,CAAAA;;IAKJ,IAAIM,QAAAA,EAAUgC,QAAUhC,EAAAA,QAAAA,CAAS,SAAY,CAAA,EAAA;QAC3CD,gBAAiBE,CAAAA,IAAI,CAACgC,aAAAA,CAAsBrB,YAAclB,EAAAA,GAAAA,CAAAA,CAAAA;AAC5D;;IAGA,IAAIK,gBAAAA,CAAiBc,MAAM,KAAK,CAAG,EAAA;QACjC,OAAOmB,QAAAA;AACT;AAEA,IAAA,OAAOlB,cAAaf,gBAAkBiC,CAAAA,CAAAA,QAAAA,CAAAA;AACxC,CACA;AAEWe,MAAAA,uBAAAA,GAA0BtD,gBAAW,CAAA,OAAOC,GAAcsC,EAAAA,QAAAA,GAAAA;IACrE,IAAI,CAACtC,GAAIG,CAAAA,MAAM,EAAE;AACf,QAAA,MAAM,IAAIC,KAAM,CAAA,2CAAA,CAAA;AAClB;;IAGA,OAAOiC,gBAAAA,CAAiBrC,KAAKsC,QAAU,EAAA;QACrCrC,OAASJ,EAAAA,iBAAAA;QACT2B,IAAMF,EAAAA,eAAAA;QACNU,MAAQF,EAAAA,iBAAAA;QACRQ,QAAUF,EAAAA;AACZ,KAAA,CAAA;AACF,CAAG;;;;;;;;;;;;;;;"}