@vulkano/core 1.23.2 → 1.24.1

package/database/scaffold.js

@@ -1,9 +1,205 @@
+// Field names that are never exposed through populate select, whatever the
+// caller asks for — a coarse, name-based backstop for common secret-shaped
+// fields (defense in depth on top of the schema's own `select: false`, in
+// case a referenced model forgets to mark a sensitive field itself).
+const SENSITIVE_FIELD_HINTS = [
+  'password', 'passwd', 'secret', 'token', 'apikey', 'api_key',
+  'privatekey', 'private_key', 'hash', 'salt', 'ssn', 'creditcard',
+  'credit_card', 'cvv', 'pin'
+];
+
+function isSensitiveByName(field) {
+  const lower = field.toLowerCase();
+  return SENSITIVE_FIELD_HINTS.some((hint) => lower.includes(hint));
+}
+
 module.exports = {
 
+  /**
+   * Look up the referenced model on the same connection this model was
+   * compiled on (models here are registered via `db.model(...)`, not the
+   * global `mongoose.model(...)` registry — see database/mongodb.js — so
+   * resolving by connection is required for this to ever find it).
+   *
+   * @param {String} refModelName mongoose ref (the "ref" schema option)
+   * @returns {Object|null}
+   */
+  _resolveRefModel(refModelName) {
+
+    try {
+      return (this.db && this.db.model(refModelName)) || mongoose.model(refModelName);
+    } catch {
+      return null;
+    }
+
+  },
+
+  /**
+   * A field is safe to expose through populate select when it's neither
+   * name-flagged as sensitive (SENSITIVE_FIELD_HINTS) nor marked
+   * `select: false` on the REFERENCED model's own schema. If the referenced
+   * model can't be resolved (e.g. in isolated unit tests), only the
+   * name-based check applies.
+   *
+   * @param {String} refModelName mongoose ref (the "ref" schema option)
+   * @param {String} field
+   * @returns {Boolean}
+   */
+  _isFieldSafeToExpose(refModelName, field) {
+
+    if (isSensitiveByName(field)) {
+      return false;
+    }
+
+    const RefModel = this._resolveRefModel(refModelName);
+    const refPath = RefModel && RefModel.schema.paths[field];
+
+    if (refPath && refPath.options && refPath.options.select === false) {
+      return false;
+    }
+
+    return true;
+
+  },
+
+  /**
+   * Parse the populate param into one entry per relation: `name` (trimmed,
+   * lowercased) plus an optional `fields` list. Syntax: relations are
+   * comma-separated; a relation can carry its own field list after a colon,
+   * with `|` separating multiple fields — e.g.
+   * `?populate=school:name|address,teacher` populates `school` (selecting
+   * only name+address) and `teacher` (full doc). Kept as its own param
+   * (not `?school=...`) so it can never collide with a real filter/field
+   * query param that happens to share the relation's name.
+   *
+   * @param {Object} props (populate)
+   * @returns {Array} [{ name, fields }]
+   */
+  _parsePopulateEntries(props) {
+
+    return ((props || {}).populate || '')
+      .split(',')
+      .map((raw) => {
+
+        const [rawName, rawFields] = raw.split(':');
+        const name = (rawName || '').trim().toLowerCase();
+
+        if (!name) {
+          return null;
+        }
+
+        const fields = rawFields
+          ? rawFields.split('|').map((item) => item.trim()).filter(Boolean)
+          : null;
+
+        return { name, fields };
+
+      })
+      .filter(Boolean);
+
+  },
+
+  /**
+   * Sanitize populate param: trim + lowercase each relation name
+   * (field-selection suffix, if any, is dropped — see _parsePopulateEntries)
+   *
+   * @param {Object} props (populate)
+   * @returns {Array}
+   */
+  _getSanitizedPopulate(props) {
+
+    return this._parsePopulateEntries(props).map((entry) => entry.name);
+
+  },
+
+  /**
+   * Build populate array by auto-detecting the model's own relations that
+   * were opted in — either via `autopopulate: true` on the attribute
+   * definition, or via the `extra` allowlist passed here for a one-off call.
+   * A ref field with neither is never populated, no matter what the caller
+   * asks for. This is the security gate: a relation only becomes reachable
+   * through ?populate= when its attribute or the calling code says so.
+   *
+   * @param {Object} props (populate — see _parsePopulateEntries for its syntax)
+   * @param {Array} [extra] field names to allow even without autopopulate: true
+   * @returns {Array}
+   */
+  _buildPopulate(props, extra) {
+
+    const entries = this._parsePopulateEntries(props);
+
+    if (entries.length === 0) {
+      return [];
+    }
+
+    const extraLower = (Array.isArray(extra) ? extra : []).map((item) => item.toLowerCase());
+
+    const { paths } = this.schema;
+
+    const fieldByLowerName = {};
+    Object.keys(paths).forEach((field) => {
+      fieldByLowerName[field.toLowerCase()] = field;
+    });
+
+    return entries
+      .map((entry) => {
+
+        const field = fieldByLowerName[entry.name];
+
+        if (!field) {
+          return null;
+        }
+
+        const path = paths[field];
+        const opts = path.options || {};
+        const casterOpts = (path.caster && path.caster.options) || {};
+        const ref = opts.ref || casterOpts.ref;
+        const autopopulate = opts.autopopulate
+          || casterOpts.autopopulate
+          || extraLower.includes(entry.name);
+
+        if (!ref || !autopopulate) {
+          return null;
+        }
+
+        const populateProps = { path: field };
+
+        if (entry.fields && entry.fields.length > 0) {
+
+          // Explicit field list: keep only what's safe, as a pure inclusion
+          // select. If everything requested turns out sensitive, fall back
+          // to "_id" only — never to the unfiltered full document.
+          const safeFields = entry.fields.filter((f) => this._isFieldSafeToExpose(ref, f));
+          populateProps.select = safeFields.length > 0 ? safeFields.join(' ') : '_id';
+
+        } else {
+
+          // Full-doc populate: still must not leak sensitive fields, so
+          // build an exclusion select for whatever the ref schema/name-hints
+          // flag on that model — skipped only if nothing needs excluding.
+          const RefModel = this._resolveRefModel(ref);
+
+          const toExclude = RefModel
+            ? Object.keys(RefModel.schema.paths).filter((f) => !this._isFieldSafeToExpose(ref, f))
+            : [];
+
+          if (toExclude.length > 0) {
+            populateProps.select = toExclude.map((f) => `-${f}`).join(' ');
+          }
+
+        }
+
+        return populateProps;
+
+      })
+      .filter(Boolean);
+
+  },
+
   /**
    * Method to get all records by page
    *
-   * @param {Object} props (page, perPage, search, sort)
+   * @param {Object} props (page, perPage, search, sort, populate)
    * @returns {Promise}
    */
   getAll(props) {
@@ -13,15 +209,17 @@ module.exports = {
       sort: 'createdAt|DESC',
       searchBy: [],
       filter: {
-        active: true
+        active: true // soft-delete
       },
     };
 
+    const populate = this._buildPopulate(props);
+
     // Query to Run
     const query = Paginate.serializeQuery(defaultProps, props);
 
     // Pagination
-    return Paginate.get(this, query);
+    return Paginate.get(this, query, populate);
 
   },
 
@@ -29,9 +227,10 @@ module.exports = {
    * Method to get a record by id
    *
    * @param {ObjectID} id
+   * @param {Object} props (populate)
    * @returns {Promise}
    */
-  getByField(value, field) {
+  getByField(value, field, props) {
 
     // This is to prevent error while run the findOne
     if (!(/^[a-fA-F0-9]{24}$/).test(value) && !field) {
@@ -41,7 +240,11 @@ module.exports = {
     const toSearch = { active: true };
     toSearch[field || '_id'] = value;
 
-    return this.findOne(toSearch)
+    const query = this.findOne(toSearch);
+
+    this._buildPopulate(props).forEach((p) => query.populate(p));
+
+    return query
       .then( (r) => {
 
         if (!r) {

package/examples/models/Example.js

@@ -18,6 +18,13 @@ module.exports = {
       type: String,
       required: true
     },
+    school: {
+      type: mongoose.Schema.Types.ObjectId,
+      ref: 'School',
+      // Opts this relation into ?populate=school — a ref field without this
+      // flag is never populated, no matter what the caller asks for
+      autopopulate: true
+    },
     age: {
       type: Number,
       required: false,
@@ -44,7 +51,7 @@ module.exports = {
   /**
    * Method to get all records by page
    *
-   * @param {Object} props (page, perPage, search, sort)
+   * @param {Object} props (page, perPage, search, sort, populate — see _buildPopulate below)
    * @returns {Promise}
    */
   getAll(props) {
@@ -53,14 +60,21 @@ module.exports = {
     const defaultProps = {
       sort: 'createdAt|DESC',
       searchBy: ['name'],
-      fields: ['name', 'age', 'active', 'createdAt', 'updatedAt'],
+      fields: ['name', 'school', 'age', 'active', 'createdAt', 'updatedAt'],
       filter: {
         active: true
       },
     };
 
-    // Populate
-    const populate = [];
+    // Populate: only relations opted in via `autopopulate: true` on the
+    // attribute (see `school` above) ever get expanded, and only when asked
+    // for through ?populate=. Syntax (see database/scaffold.js#_buildPopulate):
+    //   ?populate=school                → full School doc
+    //   ?populate=school:name           → only { _id, name }
+    //   ?populate=school:name|address   → only { _id, name, address }
+    // A relation NOT marked autopopulate can still be opened for one call by
+    // passing it as a second arg: this._buildPopulate(props, ['someRef'])
+    const populate = this._buildPopulate(props);
 
     // Query to Run
     const query = Paginate.serializeQuery(defaultProps, props);
@@ -74,16 +88,22 @@ module.exports = {
    * Method to get a record by id
    *
    * @param {ObjectID} id
+   * @param {Object} _props (populate — see getAll above for the ?populate= syntax)
    * @returns {Promise}
    */
-  getExample(_id) {
+  getExample(_id, _props) {
 
     // This is to prevent error while run the findOne
     if (!(/^[a-fA-F0-9]{24}$/).test(_id)) {
       return VSError.reject('Invalid ID. Record not found', 404);
     }
 
-    return Example.findOne({ _id })
+    const query = Example.findOne({ _id });
+
+    // Populate (only relations marked autopopulate: true in attributes)
+    this._buildPopulate(_props).forEach((p) => query.populate(p));
+
+    return query
       .then( (r) => {
 
         if (!r) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@vulkano/core",
-  "version": "1.23.2",
+  "version": "1.24.1",
   "description": "A MVC framework using Express 4",
   "license": "MIT",
   "author": "Vulkano Team",

package/views/helpers/i18n.js

@@ -0,0 +1,8 @@
+/**
+ * Bridges the global `i18n` instance (set by bootstrap/services.js) into the
+ * Nunjucks environment. Without this, `i18n` exists only in JS scope — views
+ * never receive it, since nunjucks.js only auto-adds `app` as a global.
+ *
+ * Usage in templates: {{ i18n.t('key') }}
+ */
+module.exports = i18n;