@vulkano/core 1.24.2 → 1.25.0

package/controllers/controllers.js

@@ -11,6 +11,14 @@ const AllControllers = require('include-all')({
 
 const scaffoldController = require('./ScaffoldController');
 
+// PascalCase controller name -> kebab-case URL segment (MyAccount -> my-account)
+function toKebabCase(str) {
+  return str
+    .replace(/([a-z0-9])([A-Z])/g, '$1-$2')
+    .replace(/([A-Z])([A-Z][a-z])/g, '$1-$2')
+    .toLowerCase();
+}
+
 module.exports = function loadControllersApplication() {
 
   const routes = {};
@@ -48,7 +56,7 @@ module.exports = function loadControllersApplication() {
 
     }
 
-    let controllerName = controller.replace('Controller', '').toLowerCase();
+    let controllerName = toKebabCase(controller.replace('Controller', ''));
 
     let parts = [];
     let method = 'get';
@@ -65,7 +73,7 @@ module.exports = function loadControllersApplication() {
 
         Object.keys(submodules || []).forEach( (subcontroller) => {
 
-          controllerName = subcontroller.replace('Controller', '').toLowerCase();
+          controllerName = toKebabCase(subcontroller.replace('Controller', ''));
           const subcurrent = submodules[subcontroller];
 
           const {
@@ -177,3 +185,5 @@ module.exports = function loadControllersApplication() {
   return routes;
 
 };
+
+module.exports.toKebabCase = toKebabCase;

package/database/scaffold.js

@@ -1,67 +1,5 @@
-// Field names that are never exposed through populate select, whatever the
-// caller asks for — a coarse, name-based backstop for common secret-shaped
-// fields (defense in depth on top of the schema's own `select: false`, in
-// case a referenced model forgets to mark a sensitive field itself).
-const SENSITIVE_FIELD_HINTS = [
-  'password', 'passwd', 'secret', 'token', 'apikey', 'api_key',
-  'privatekey', 'private_key', 'hash', 'salt', 'ssn', 'creditcard',
-  'credit_card', 'cvv', 'pin'
-];
-
-function isSensitiveByName(field) {
-  const lower = field.toLowerCase();
-  return SENSITIVE_FIELD_HINTS.some((hint) => lower.includes(hint));
-}
-
 module.exports = {
 
-  /**
-   * Look up the referenced model on the same connection this model was
-   * compiled on (models here are registered via `db.model(...)`, not the
-   * global `mongoose.model(...)` registry — see database/mongodb.js — so
-   * resolving by connection is required for this to ever find it).
-   *
-   * @param {String} refModelName mongoose ref (the "ref" schema option)
-   * @returns {Object|null}
-   */
-  _resolveRefModel(refModelName) {
-
-    try {
-      return (this.db && this.db.model(refModelName)) || mongoose.model(refModelName);
-    } catch {
-      return null;
-    }
-
-  },
-
-  /**
-   * A field is safe to expose through populate select when it's neither
-   * name-flagged as sensitive (SENSITIVE_FIELD_HINTS) nor marked
-   * `select: false` on the REFERENCED model's own schema. If the referenced
-   * model can't be resolved (e.g. in isolated unit tests), only the
-   * name-based check applies.
-   *
-   * @param {String} refModelName mongoose ref (the "ref" schema option)
-   * @param {String} field
-   * @returns {Boolean}
-   */
-  _isFieldSafeToExpose(refModelName, field) {
-
-    if (isSensitiveByName(field)) {
-      return false;
-    }
-
-    const RefModel = this._resolveRefModel(refModelName);
-    const refPath = RefModel && RefModel.schema.paths[field];
-
-    if (refPath && refPath.options && refPath.options.select === false) {
-      return false;
-    }
-
-    return true;
-
-  },
-
   /**
    * Parse the populate param into one entry per relation: `name` (trimmed,
    * lowercased) plus an optional `fields` list. Syntax: relations are
@@ -165,28 +103,7 @@ module.exports = {
         const populateProps = { path: field };
 
         if (entry.fields && entry.fields.length > 0) {
-
-          // Explicit field list: keep only what's safe, as a pure inclusion
-          // select. If everything requested turns out sensitive, fall back
-          // to "_id" only — never to the unfiltered full document.
-          const safeFields = entry.fields.filter((f) => this._isFieldSafeToExpose(ref, f));
-          populateProps.select = safeFields.length > 0 ? safeFields.join(' ') : '_id';
-
-        } else {
-
-          // Full-doc populate: still must not leak sensitive fields, so
-          // build an exclusion select for whatever the ref schema/name-hints
-          // flag on that model — skipped only if nothing needs excluding.
-          const RefModel = this._resolveRefModel(ref);
-
-          const toExclude = RefModel
-            ? Object.keys(RefModel.schema.paths).filter((f) => !this._isFieldSafeToExpose(ref, f))
-            : [];
-
-          if (toExclude.length > 0) {
-            populateProps.select = toExclude.map((f) => `-${f}`).join(' ');
-          }
-
+          populateProps.select = entry.fields.join(' ');
         }
 
         return populateProps;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@vulkano/core",
-  "version": "1.24.2",
+  "version": "1.25.0",
   "description": "A MVC framework using Express 4",
   "license": "MIT",
   "author": "Vulkano Team",