@vulkano/core 1.23.1 → 1.24.0

package/README.md

@@ -47,7 +47,7 @@ npm install @vulkano/core
 PORT=8000
 MONGO_URI=mongodb://localhost:27017/myapp
 SALT_KEY=random-string
-JWT_SECRET=supersecret
+JWT_SECRET_KEY=supersecret
 ```
 
 ## Quick Start

package/bin/setup.js

@@ -422,7 +422,7 @@ module.exports = {
     '     .env                ← fill in values',
     '',
     '  Next steps:',
-    '     1. Set MONGO_URI, JWT_SECRET, etc.',
+    '     1. Set MONGO_URI, JWT_SECRET_KEY, etc.',
     '',
   ].join('\n'));
 

package/database/scaffold.js

@@ -1,9 +1,122 @@
 module.exports = {
 
+  /**
+   * Parse the populate param into one entry per relation: `name` (trimmed,
+   * lowercased) plus an optional `fields` list. Syntax: relations are
+   * comma-separated; a relation can carry its own field list after a colon,
+   * with `|` separating multiple fields — e.g.
+   * `?populate=school:name|address,teacher` populates `school` (selecting
+   * only name+address) and `teacher` (full doc). Kept as its own param
+   * (not `?school=...`) so it can never collide with a real filter/field
+   * query param that happens to share the relation's name.
+   *
+   * @param {Object} props (populate)
+   * @returns {Array} [{ name, fields }]
+   */
+  _parsePopulateEntries(props) {
+
+    return ((props || {}).populate || '')
+      .split(',')
+      .map((raw) => {
+
+        const [rawName, rawFields] = raw.split(':');
+        const name = (rawName || '').trim().toLowerCase();
+
+        if (!name) {
+          return null;
+        }
+
+        const fields = rawFields
+          ? rawFields.split('|').map((item) => item.trim()).filter(Boolean)
+          : null;
+
+        return { name, fields };
+
+      })
+      .filter(Boolean);
+
+  },
+
+  /**
+   * Sanitize populate param: trim + lowercase each relation name
+   * (field-selection suffix, if any, is dropped — see _parsePopulateEntries)
+   *
+   * @param {Object} props (populate)
+   * @returns {Array}
+   */
+  _getSanitizedPopulate(props) {
+
+    return this._parsePopulateEntries(props).map((entry) => entry.name);
+
+  },
+
+  /**
+   * Build populate array by auto-detecting the model's own relations that
+   * were opted in — either via `autopopulate: true` on the attribute
+   * definition, or via the `extra` allowlist passed here for a one-off call.
+   * A ref field with neither is never populated, no matter what the caller
+   * asks for. This is the security gate: a relation only becomes reachable
+   * through ?populate= when its attribute or the calling code says so.
+   *
+   * @param {Object} props (populate — see _parsePopulateEntries for its syntax)
+   * @param {Array} [extra] field names to allow even without autopopulate: true
+   * @returns {Array}
+   */
+  _buildPopulate(props, extra) {
+
+    const entries = this._parsePopulateEntries(props);
+
+    if (entries.length === 0) {
+      return [];
+    }
+
+    const extraLower = (Array.isArray(extra) ? extra : []).map((item) => item.toLowerCase());
+
+    const { paths } = this.schema;
+
+    const fieldByLowerName = {};
+    Object.keys(paths).forEach((field) => {
+      fieldByLowerName[field.toLowerCase()] = field;
+    });
+
+    return entries
+      .map((entry) => {
+
+        const field = fieldByLowerName[entry.name];
+
+        if (!field) {
+          return null;
+        }
+
+        const path = paths[field];
+        const opts = path.options || {};
+        const casterOpts = (path.caster && path.caster.options) || {};
+        const ref = opts.ref || casterOpts.ref;
+        const autopopulate = opts.autopopulate
+          || casterOpts.autopopulate
+          || extraLower.includes(entry.name);
+
+        if (!ref || !autopopulate) {
+          return null;
+        }
+
+        const populateProps = { path: field };
+
+        if (entry.fields && entry.fields.length > 0) {
+          populateProps.select = entry.fields.join(' ');
+        }
+
+        return populateProps;
+
+      })
+      .filter(Boolean);
+
+  },
+
   /**
    * Method to get all records by page
    *
-   * @param {Object} props (page, perPage, search, sort)
+   * @param {Object} props (page, perPage, search, sort, populate)
    * @returns {Promise}
    */
   getAll(props) {
@@ -13,15 +126,17 @@ module.exports = {
       sort: 'createdAt|DESC',
       searchBy: [],
       filter: {
-        active: true
+        active: true // soft-delete
       },
     };
 
+    const populate = this._buildPopulate(props);
+
     // Query to Run
     const query = Paginate.serializeQuery(defaultProps, props);
 
     // Pagination
-    return Paginate.get(this, query);
+    return Paginate.get(this, query, populate);
 
   },
 
@@ -29,9 +144,10 @@ module.exports = {
    * Method to get a record by id
    *
    * @param {ObjectID} id
+   * @param {Object} props (populate)
    * @returns {Promise}
    */
-  getByField(value, field) {
+  getByField(value, field, props) {
 
     // This is to prevent error while run the findOne
     if (!(/^[a-fA-F0-9]{24}$/).test(value) && !field) {
@@ -41,7 +157,11 @@ module.exports = {
     const toSearch = { active: true };
     toSearch[field || '_id'] = value;
 
-    return this.findOne(toSearch)
+    const query = this.findOne(toSearch);
+
+    this._buildPopulate(props).forEach((p) => query.populate(p));
+
+    return query
       .then( (r) => {
 
         if (!r) {

package/examples/models/Example.js

@@ -18,6 +18,13 @@ module.exports = {
       type: String,
       required: true
     },
+    school: {
+      type: mongoose.Schema.Types.ObjectId,
+      ref: 'School',
+      // Opts this relation into ?populate=school — a ref field without this
+      // flag is never populated, no matter what the caller asks for
+      autopopulate: true
+    },
     age: {
       type: Number,
       required: false,
@@ -44,7 +51,7 @@ module.exports = {
   /**
    * Method to get all records by page
    *
-   * @param {Object} props (page, perPage, search, sort)
+   * @param {Object} props (page, perPage, search, sort, populate — see _buildPopulate below)
    * @returns {Promise}
    */
   getAll(props) {
@@ -53,14 +60,21 @@ module.exports = {
     const defaultProps = {
       sort: 'createdAt|DESC',
       searchBy: ['name'],
-      fields: ['name', 'age', 'active', 'createdAt', 'updatedAt'],
+      fields: ['name', 'school', 'age', 'active', 'createdAt', 'updatedAt'],
       filter: {
         active: true
       },
     };
 
-    // Populate
-    const populate = [];
+    // Populate: only relations opted in via `autopopulate: true` on the
+    // attribute (see `school` above) ever get expanded, and only when asked
+    // for through ?populate=. Syntax (see database/scaffold.js#_buildPopulate):
+    //   ?populate=school                → full School doc
+    //   ?populate=school:name           → only { _id, name }
+    //   ?populate=school:name|address   → only { _id, name, address }
+    // A relation NOT marked autopopulate can still be opened for one call by
+    // passing it as a second arg: this._buildPopulate(props, ['someRef'])
+    const populate = this._buildPopulate(props);
 
     // Query to Run
     const query = Paginate.serializeQuery(defaultProps, props);
@@ -74,16 +88,22 @@ module.exports = {
    * Method to get a record by id
    *
    * @param {ObjectID} id
+   * @param {Object} _props (populate — see getAll above for the ?populate= syntax)
    * @returns {Promise}
    */
-  getExample(_id) {
+  getExample(_id, _props) {
 
     // This is to prevent error while run the findOne
     if (!(/^[a-fA-F0-9]{24}$/).test(_id)) {
       return VSError.reject('Invalid ID. Record not found', 404);
     }
 
-    return Example.findOne({ _id })
+    const query = Example.findOne({ _id });
+
+    // Populate (only relations marked autopopulate: true in attributes)
+    this._buildPopulate(_props).forEach((p) => query.populate(p));
+
+    return query
       .then( (r) => {
 
         if (!r) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@vulkano/core",
-  "version": "1.23.1",
+  "version": "1.24.0",
   "description": "A MVC framework using Express 4",
   "license": "MIT",
   "author": "Vulkano Team",