@waline/vercel 1.6.0 → 1.8.0

package/README.md

@@ -1,6 +1,6 @@
-## @waline/vercel
+# @waline/vercel
 
-![](https://img.shields.io/npm/v/@waline/vercel?color=blue&logo=npm&style=flat-square)
+![Version](https://img.shields.io/npm/v/@waline/vercel?color=blue&logo=npm&style=flat-square)
 
 This is the backend for Waline comment system.
 
@@ -20,6 +20,6 @@ We support [Akismet](https://akismet.com/) spam protection service default. If y
 
 ## Deploy
 
-[ ![](https://vercel.com/button) ](https://vercel.com/import/project?template=https://github.com/walinejs/waline/tree/main/example)
+[![Deploy button](https://vercel.com/button)](https://vercel.com/import/project?template=https://github.com/walinejs/waline/tree/main/example)
 
 Click it to deploy quickly!

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@waline/vercel",
-  "version": "1.6.0",
+  "version": "1.8.0",
   "description": "vercel server for waline comment system",
   "repository": "https://github.com/walinejs/waline",
   "license": "MIT",
@@ -10,25 +10,25 @@
     "@cloudbase/node-sdk": "^2.7.1",
     "@koa/cors": "^3.1.0",
     "akismet": "^2.0.6",
-    "deta": "^1.0.1",
-    "dompurify": "^2.3.3",
+    "deta": "^1.0.2",
+    "dompurify": "^2.3.6",
     "fast-csv": "^4.3.6",
-    "jsdom": "^18.0.0",
+    "jsdom": "^19.0.0",
     "jsonwebtoken": "^8.5.1",
-    "katex": "^0.13.23",
-    "leancloud-storage": "^4.12.0",
-    "markdown-it": "^12.2.0",
+    "katex": "^0.15.2",
+    "leancloud-storage": "^4.12.2",
+    "markdown-it": "^12.3.2",
     "markdown-it-emoji": "^2.0.0",
     "markdown-it-sub": "^1.0.0",
     "markdown-it-sup": "^1.0.0",
     "mathjax-full": "^3.2.0",
-    "nodemailer": "^6.7.0",
+    "nodemailer": "^6.7.2",
     "nunjucks": "^3.2.3",
     "phpass": "^0.1.1",
-    "prismjs": "^1.25.0",
+    "prismjs": "^1.27.0",
     "request": "^2.88.2",
     "request-promise-native": "^1.0.9",
-    "think-logger3": "^1.2.1",
+    "think-logger3": "^1.3.1",
     "think-model": "^1.5.4",
     "think-model-mysql": "^1.1.6",
     "think-model-postgresql": "^1.1.6",
@@ -36,6 +36,6 @@
     "think-mongo": "^2.1.2",
     "think-router-rest": "^1.0.5",
     "thinkjs": "^3.2.14",
-    "ua-parser-js": "^0.7.31"
+    "ua-parser-js": "^1.0.2"
   }
 }

package/src/config/adapter.js

@@ -37,10 +37,9 @@ const {
 } = process.env;
 
 let type = 'common';
-let mongoOpt = {
-  replicaSet: MONGO_REPLICASET,
-  authSource: MONGO_AUTHSOURCE,
-};
+const mongoOpt = {};
+if (MONGO_REPLICASET) mongoOpt.replicaSet = MONGO_REPLICASET;
+if (MONGO_AUTHSOURCE) mongoOpt.authSource = MONGO_AUTHSOURCE;
 
 if (MONGO_DB) {
   type = 'mongo';

package/src/controller/comment.js

@@ -1,4 +1,3 @@
-const helper = require('think-helper');
 const parser = require('ua-parser-js');
 const BaseRest = require('./rest');
 const akismet = require('../service/akismet');
@@ -8,7 +7,8 @@ const markdownParser = getMarkdownParser();
 async function formatCmt(
   { ua, user_id, ...comment },
   users = [],
-  { avatarProxy }
+  { avatarProxy },
+  loginUser
 ) {
   ua = parser(ua);
   if (!think.config('disableUserAgent')) {
@@ -36,9 +36,12 @@ async function formatCmt(
       ? avatarProxy + '?url=' + encodeURIComponent(avatarUrl)
       : avatarUrl;
 
-  comment.mail = helper.md5(
-    comment.mail ? comment.mail.toLowerCase() : comment.mail
-  );
+  const isAdmin = loginUser && loginUser.type === 'administrator';
+  if (!isAdmin) {
+    delete comment.mail;
+  } else {
+    comment.orig = comment.comment;
+  }
 
   comment.comment = markdownParser(comment.comment);
   return comment;
@@ -55,30 +58,40 @@ module.exports = class extends BaseRest {
 
   async getAction() {
     const { type } = this.get();
+    const { userInfo } = this.ctx.state;
 
     switch (type) {
       case 'recent': {
         const { count } = this.get();
-        const comments = await this.modelInstance.select(
-          { status: ['NOT IN', ['waiting', 'spam']] },
-          {
-            desc: 'insertedAt',
-            limit: count,
-            field: [
-              'comment',
-              'insertedAt',
-              'link',
-              'mail',
-              'nick',
-              'url',
-              'pid',
-              'rid',
-              'ua',
-              'user_id',
-              'sticky',
-            ],
-          }
-        );
+        const where = {};
+        if (think.isEmpty(userInfo) || this.config('storage') === 'deta') {
+          where.status = ['NOT IN', ['waiting', 'spam']];
+        } else {
+          where._complex = {
+            _logic: 'or',
+            status: ['NOT IN', ['waiting', 'spam']],
+            user_id: userInfo.objectId,
+          };
+        }
+
+        const comments = await this.modelInstance.select(where, {
+          desc: 'insertedAt',
+          limit: count,
+          field: [
+            'status',
+            'comment',
+            'insertedAt',
+            'link',
+            'mail',
+            'nick',
+            'url',
+            'pid',
+            'rid',
+            'ua',
+            'user_id',
+            'sticky',
+          ],
+        });
 
         const userModel = this.service(
           `storage/${this.config('storage')}`,
@@ -100,20 +113,26 @@ module.exports = class extends BaseRest {
 
         return this.json(
           await Promise.all(
-            comments.map((cmt) => formatCmt(cmt, users, this.config()))
+            comments.map((cmt) =>
+              formatCmt(cmt, users, this.config(), userInfo)
+            )
           )
         );
       }
 
       case 'count': {
         const { url } = this.get();
-        const data = await this.modelInstance.select(
-          {
-            url: ['IN', url],
+        const where = { url: ['IN', url] };
+        if (think.isEmpty(userInfo) || this.config('storage') === 'deta') {
+          where.status = ['NOT IN', ['waiting', 'spam']];
+        } else {
+          where._complex = {
+            _logic: 'or',
             status: ['NOT IN', ['waiting', 'spam']],
-          },
-          { field: ['url'] }
-        );
+            user_id: userInfo.objectId,
+          };
+        }
+        const data = await this.modelInstance.select(where, { field: ['url'] });
         const counts = url.map(
           (u) => data.filter(({ url }) => url === u).length
         );
@@ -154,40 +173,67 @@ module.exports = class extends BaseRest {
           offset: Math.max((page - 1) * pageSize, 0),
         });
 
+        const userModel = this.service(
+          `storage/${this.config('storage')}`,
+          'Users'
+        );
+        const user_ids = Array.from(
+          new Set(comments.map(({ user_id }) => user_id).filter((v) => v))
+        );
+
+        let users = [];
+        if (user_ids.length) {
+          users = await userModel.select(
+            { objectId: ['IN', user_ids] },
+            {
+              field: ['display_name', 'email', 'url', 'type', 'avatar'],
+            }
+          );
+        }
+
         return this.success({
           page,
           totalPages: Math.ceil(count / pageSize),
           pageSize,
           spamCount,
           waitingCount,
-          data: comments,
+          data: await Promise.all(
+            comments.map((cmt) =>
+              formatCmt(cmt, users, this.config(), userInfo)
+            )
+          ),
         });
       }
 
       default: {
         const { path: url, page, pageSize } = this.get();
-
-        const comments = await this.modelInstance.select(
-          {
-            url,
+        const where = { url };
+        if (think.isEmpty(userInfo) || this.config('storage') === 'deta') {
+          where.status = ['NOT IN', ['waiting', 'spam']];
+        } else {
+          where._complex = {
+            _logic: 'or',
             status: ['NOT IN', ['waiting', 'spam']],
-          },
-          {
-            desc: 'insertedAt',
-            field: [
-              'comment',
-              'insertedAt',
-              'link',
-              'mail',
-              'nick',
-              'pid',
-              'rid',
-              'ua',
-              'user_id',
-              'sticky',
-            ],
-          }
-        );
+            user_id: userInfo.objectId,
+          };
+        }
+
+        const comments = await this.modelInstance.select(where, {
+          desc: 'insertedAt',
+          field: [
+            'status',
+            'comment',
+            'insertedAt',
+            'link',
+            'mail',
+            'nick',
+            'pid',
+            'rid',
+            'ua',
+            'user_id',
+            'sticky',
+          ],
+        });
 
         const userModel = this.service(
           `storage/${this.config('storage')}`,
@@ -221,11 +267,16 @@ module.exports = class extends BaseRest {
           count: comments.length,
           data: await Promise.all(
             rootComments.map(async (comment) => {
-              const cmt = await formatCmt(comment, users, this.config());
+              const cmt = await formatCmt(
+                comment,
+                users,
+                this.config(),
+                userInfo
+              );
               cmt.children = await Promise.all(
                 comments
                   .filter(({ rid }) => rid === cmt.objectId)
-                  .map((cmt) => formatCmt(cmt, users, this.config()))
+                  .map((cmt) => formatCmt(cmt, users, this.config(), userInfo))
                   .reverse()
               );
               return cmt;
@@ -383,7 +434,9 @@ module.exports = class extends BaseRest {
 
     think.logger.debug(`Comment post hooks postSave done!`);
 
-    return this.success(await formatCmt(resp, [userInfo], this.config()));
+    return this.success(
+      await formatCmt(resp, [userInfo], this.config(), userInfo)
+    );
   }
 
   async putAction() {

package/src/logic/base.js

@@ -45,6 +45,7 @@ module.exports = class extends think.Logic {
       { email: userMail },
       {
         field: [
+          'id',
           'email',
           'url',
           'display_name',

package/src/service/markdown/xss.js

@@ -28,10 +28,16 @@ DOMPurify.addHook('afterSanitizeAttributes', function (node) {
 });
 
 const sanitize = (content) =>
-  DOMPurify.sanitize(content, {
-    FORBID_TAGS: ['form', 'input', 'style'],
-    FORBID_ATTR: ['autoplay', 'style'],
-  });
+  DOMPurify.sanitize(
+    content,
+    Object.assign(
+      {
+        FORBID_TAGS: ['form', 'input', 'style'],
+        FORBID_ATTR: ['autoplay', 'style'],
+      },
+      think.config('domPurify') || {}
+    )
+  );
 
 module.exports = {
   sanitize,

package/src/service/notify.js

@@ -273,6 +273,50 @@ module.exports = class extends think.Service {
     });
   }
 
+  async pushplus({ title, content }, self, parent) {
+    const {
+      PUSH_PLUS_KEY,
+      PUSH_PLUS_TOPIC: topic,
+      PUSH_PLUS_TEMPLATE: template,
+      PUSH_PLUS_CHANNEL: channel,
+      PUSH_PLUS_WEBHOOK: webhook,
+      PUSH_PLUS_CALLBACKURL: callbackUrl,
+      SITE_NAME,
+      SITE_URL,
+    } = process.env;
+
+    if (!PUSH_PLUS_KEY) {
+      return false;
+    }
+
+    const data = {
+      self,
+      parent,
+      site: {
+        name: SITE_NAME,
+        url: SITE_URL,
+        postUrl: SITE_URL + self.url + '#' + self.objectId,
+      },
+    };
+    title = nunjucks.renderString(title, data);
+    content = nunjucks.renderString(content, data);
+
+    return request({
+      uri: `http://www.pushplus.plus/send/${PUSH_PLUS_KEY}`,
+      method: 'POST',
+      form: {
+        title,
+        content,
+        topic,
+        template,
+        channel,
+        webhook,
+        callbackUrl,
+      },
+      json: true,
+    });
+  }
+
   async run(comment, parent, disableAuthorNotify = false) {
     const { AUTHOR_EMAIL, BLOGGER_EMAIL } = process.env;
     const { mailSubject, mailTemplate, mailSubjectAdmin, mailTemplateAdmin } =
@@ -287,7 +331,7 @@ module.exports = class extends think.Service {
       ? parent && parent.mail.toLowerCase() === AUTHOR.toLowerCase()
       : false;
 
-    const title = mailSubjectAdmin || '{{site.name}} 上有新评论了';
+    const title = mailSubjectAdmin || '{{site.name | safe}} 上有新评论了';
     const content =
       mailTemplateAdmin ||
       `
@@ -312,11 +356,10 @@ module.exports = class extends think.Service {
       );
       const qq = await this.qq(comment, parent);
       const telegram = await this.telegram(comment, parent);
+      const pushplus = await this.pushplus({ title, content }, comment, parent);
+      console.log(pushplus);
       if (
-        think.isEmpty(wechat) &&
-        think.isEmpty(qq) &&
-        think.isEmpty(telegram) &&
-        think.isEmpty(qywxAmWechat) &&
+        [wechat, qq, telegram, qywxAmWechat, pushplus].every(think.isEmpty) &&
         !isReplyAuthor
       ) {
         mailList.push({ to: AUTHOR, title, content });
@@ -331,7 +374,8 @@ module.exports = class extends think.Service {
       mailList.push({
         to: parent.mail,
         title:
-          mailSubject || '{{parent.nick}}，『{{site.name}}』上的评论收到了回复',
+          mailSubject ||
+          '{{parent.nick | safe}}，『{{site.name | safe}}』上的评论收到了回复',
         content:
           mailTemplate ||
           `

package/src/service/storage/cloudbase.js

@@ -33,14 +33,17 @@ module.exports = class extends Base {
     }
   }
 
-  where(instance, where) {
+  parseWhere(where) {
     if (think.isEmpty(where)) {
-      return instance;
+      return {};
     }
 
     const filter = {};
     const parseKey = (k) => (k === 'objectId' ? '_id' : k);
     for (let k in where) {
+      if (k === '_complex') {
+        continue;
+      }
       if (think.isString(where[k])) {
         filter[parseKey(k)] = _.eq(where[k]);
         continue;
@@ -84,7 +87,26 @@ module.exports = class extends Base {
         }
       }
     }
-    return instance.where(filter);
+    return filter;
+  }
+
+  where(instance, where) {
+    const filter = this.parseWhere(where);
+    if (!where._complex) {
+      return instance.where(filter);
+    }
+
+    const filters = [];
+    for (const k in where._complex) {
+      if (k === '_logic') {
+        continue;
+      }
+      filters.push({
+        ...this.parseWhere({ [k]: where._complex[k] }),
+        ...filter,
+      });
+    }
+    return instance.where(_[where._complex._logic](...filters));
   }
 
   async _select(where, { desc, limit, offset, field } = {}) {
@@ -115,8 +137,9 @@ module.exports = class extends Base {
   async select(where, options = {}) {
     let data = [];
     let ret = [];
+    let offset = options.offset || 0;
     do {
-      options.offset = (options.offset || 0) + data.length;
+      options.offset = offset + data.length;
       ret = await this._select(where, options);
       data = data.concat(ret);
     } while (ret.length === 100);

package/src/service/storage/github.js

@@ -166,13 +166,18 @@ module.exports = class extends Base {
     return this.git.set(filename, csv, { sha });
   }
 
-  where(data, where) {
+  parseWhere(where) {
+    const _where = [];
     if (think.isEmpty(where)) {
-      return data;
+      return _where;
     }
 
     const filters = [];
     for (let k in where) {
+      if (k === '_complex') {
+        continue;
+      }
+
       if (k === 'objectId') {
         filters.push((item) => item.id === where[k]);
         continue;
@@ -219,7 +224,33 @@ module.exports = class extends Base {
       }
     }
 
-    return filters.reduce((data, fn) => data.filter(fn), data);
+    return filters;
+  }
+
+  where(data, where) {
+    const filter = this.parseWhere(where);
+
+    if (!where._complex) {
+      return data.filter((item) => filter.every((fn) => fn(item)));
+    }
+
+    const logicMap = {
+      and: Array.prototype.every,
+      or: Array.prototype.some,
+    };
+    const filters = [];
+    for (const k in where._complex) {
+      if (k === '_logic') {
+        continue;
+      }
+
+      filters.push([...filter, ...this.parseWhere({ [k]: where._complex[k] })]);
+    }
+
+    const logicFn = logicMap[where._complex._logic];
+    return data.filter((item) =>
+      logicFn.call(filters, (filter) => filter.every((fn) => fn(item)))
+    );
   }
 
   async select(where, { desc, limit, offset, field } = {}) {

package/src/service/storage/inspirecloud.js

@@ -7,14 +7,18 @@ module.exports = class extends Base {
     this.db = inspirecloud.db;
   }
 
-  where(where) {
+  parseWhere(where) {
+    const _where = {};
     if (think.isEmpty(where)) {
-      return;
+      return _where;
     }
 
-    const _where = {};
     const parseKey = (k) => (k === 'objectId' ? '_id' : k);
     for (const k in where) {
+      if (k === '_complex') {
+        continue;
+      }
+
       if (think.isString(where[k])) {
         _where[parseKey(k)] =
           k === 'objectId' ? this.db.ObjectId(where[k]) : where[k];
@@ -28,18 +32,20 @@ module.exports = class extends Base {
           const handler = where[k][0].toUpperCase();
           switch (handler) {
             case 'IN':
-              _where[parseKey(k)] = this.db.in(
-                k === 'objectId'
-                  ? where[k][1].map(this.db.ObjectId)
-                  : where[k][1]
-              );
+              _where[parseKey(k)] = {
+                $in:
+                  k === 'objectId'
+                    ? where[k][1].map(this.db.ObjectId)
+                    : where[k][1],
+              };
               break;
             case 'NOT IN':
-              _where[parseKey(k)] = this.db.nin(
-                k === 'objectId'
-                  ? where[k][1].map(this.db.ObjectId)
-                  : where[k][1]
-              );
+              _where[parseKey(k)] = {
+                $nin:
+                  k === 'objectId'
+                    ? where[k][1].map(this.db.ObjectId)
+                    : where[k][1],
+              };
               break;
             case 'LIKE': {
               const first = where[k][1][0];
@@ -52,14 +58,14 @@ module.exports = class extends Base {
               } else if (last === '%') {
                 reg = new RegExp('^' + where[k][1].slice(0, -1));
               }
-              _where[parseKey(k)] = this.db.regex(reg);
+              _where[parseKey(k)] = { $regex: reg };
               break;
             }
             case '!=':
-              _where[parseKey(k)] = this.db.ne(where[k]);
+              _where[parseKey(k)] = { $ne: where[k] };
               break;
             case '>':
-              _where[parseKey(k)] = this.db.gt(where[k]);
+              _where[parseKey(k)] = { $gt: where[k] };
               break;
           }
         }
@@ -69,6 +75,27 @@ module.exports = class extends Base {
     return _where;
   }
 
+  where(where) {
+    const filter = this.parseWhere(where);
+    if (!where._complex) {
+      return filter;
+    }
+
+    const filters = [];
+    for (const k in where._complex) {
+      if (k === '_logic') {
+        continue;
+      }
+
+      filters.push({
+        ...this.parseWhere({ [k]: where._complex[k] }),
+        ...filter,
+      });
+    }
+
+    return { [`$${where._complex._logic}`]: filters };
+  }
+
   async _select(where, { desc, limit, offset, field } = {}) {
     const instance = this.db.table(this.tableName);
     const query = instance.where(this.where(where));
@@ -101,8 +128,9 @@ module.exports = class extends Base {
   async select(where, options = {}) {
     let data = [];
     let ret = [];
+    let offset = options.offset || 0;
     do {
-      options.offset = (options.offset || 0) + data.length;
+      options.offset = offset + data.length;
       ret = await this._select(where, options);
       data = data.concat(ret);
     } while (ret.length === 1000);

package/src/service/storage/leancloud.js

@@ -13,19 +13,26 @@ if (LEAN_ID && LEAN_KEY && LEAN_MASTER_KEY) {
   });
 }
 module.exports = class extends Base {
-  where(instance, where) {
+  parseWhere(className, where) {
+    const instance = new AV.Query(className);
     if (think.isEmpty(where)) {
-      return;
+      return instance;
     }
 
     for (const k in where) {
+      if (k === '_complex') {
+        continue;
+      }
+
       if (think.isString(where[k])) {
         instance.equalTo(k, where[k]);
         continue;
       }
+
       if (where[k] === undefined) {
         instance.doesNotExist(k);
       }
+
       if (Array.isArray(where[k])) {
         if (where[k][0]) {
           const handler = where[k][0].toUpperCase();
@@ -58,11 +65,32 @@ module.exports = class extends Base {
         }
       }
     }
+    return instance;
+  }
+
+  where(className, where) {
+    if (!where._complex) {
+      return this.parseWhere(className, where);
+    }
+
+    const filters = [];
+    for (const k in where._complex) {
+      if (k === '_logic') {
+        continue;
+      }
+
+      const filter = this.parseWhere(className, {
+        ...where,
+        [k]: where._complex[k],
+      });
+      filters.push(filter);
+    }
+
+    return AV.Query[where._complex._logic](...filters);
   }
 
   async _select(where, { desc, limit, offset, field } = {}) {
-    const instance = new AV.Query(this.tableName);
-    this.where(instance, where);
+    const instance = this.where(this.tableName, where);
     if (desc) {
       instance.descending(desc);
     }
@@ -88,8 +116,9 @@ module.exports = class extends Base {
   async select(where, options = {}) {
     let data = [];
     let ret = [];
+    let offset = options.offset || 0;
     do {
-      options.offset = (options.offset || 0) + data.length;
+      options.offset = offset + data.length;
       ret = await this._select(where, options);
       data = data.concat(ret);
     } while (ret.length === 100);
@@ -98,8 +127,7 @@ module.exports = class extends Base {
   }
 
   async count(where = {}, options = {}) {
-    const instance = new AV.Query(this.tableName);
-    this.where(instance, where);
+    const instance = this.where(this.tableName, where);
     return instance.count(options).catch((e) => {
       if (e.code === 101) {
         return 0;
@@ -126,8 +154,7 @@ module.exports = class extends Base {
   }
 
   async update(data, where) {
-    const instance = new AV.Query(this.tableName);
-    this.where(instance, where);
+    const instance = this.where(this.tableName, where);
     const ret = await instance.find();
 
     return Promise.all(
@@ -145,8 +172,7 @@ module.exports = class extends Base {
   }
 
   async delete(where) {
-    const instance = new AV.Query(this.tableName);
-    this.where(instance, where);
+    const instance = this.where(this.tableName, where);
     const data = await instance.find();
 
     return AV.Object.destroyAll(data);

package/src/service/storage/mongodb.js

@@ -2,25 +2,25 @@ const { ObjectId } = require('mongodb');
 const Base = require('./base');
 
 module.exports = class extends Base {
-  where(instance, where) {
+  parseWhere(where) {
     if (think.isEmpty(where)) {
-      return;
+      return {};
     }
 
+    const filter = {};
     const parseKey = (k) => (k === 'objectId' ? '_id' : k);
     for (let k in where) {
+      if (k === '_complex') {
+        continue;
+      }
       if (think.isString(where[k])) {
-        instance.where({
-          [parseKey(k)]: {
-            $eq: k === 'objectId' ? ObjectId(where[k]) : where[k],
-          },
-        });
+        filter[parseKey(k)] = {
+          $eq: k === 'objectId' ? ObjectId(where[k]) : where[k],
+        };
         continue;
       }
       if (where[k] === undefined) {
-        instance.where({
-          [parseKey(k)]: { $eq: null },
-        });
+        filter[parseKey(k)] = { $eq: null };
       }
       if (Array.isArray(where[k])) {
         if (where[k][0]) {
@@ -28,63 +28,70 @@ module.exports = class extends Base {
           switch (handler) {
             case 'IN':
               if (k === 'objectId') {
-                instance.where({
-                  [parseKey(k)]: { $in: where[k][1].map(ObjectId) },
-                });
+                filter[parseKey(k)] = { $in: where[k][1].map(ObjectId) };
               } else {
-                instance.where({
-                  [parseKey(k)]: {
-                    $regex: new RegExp(`^(${where[k][1].join('|')})$`),
-                  },
-                });
+                filter[parseKey(k)] = {
+                  $regex: new RegExp(`^(${where[k][1].join('|')})$`),
+                };
               }
               break;
             case 'NOT IN':
-              instance.where({
-                [parseKey(k)]: {
-                  $nin:
-                    k === 'objectId' ? where[k][1].map(ObjectId) : where[k][1],
-                },
-              });
+              filter[parseKey(k)] = {
+                $nin:
+                  k === 'objectId' ? where[k][1].map(ObjectId) : where[k][1],
+              };
               break;
             case 'LIKE': {
               const first = where[k][1][0];
               const last = where[k][1].slice(-1);
+              let reg;
               if (first === '%' && last === '%') {
-                instance.where({
-                  [parseKey(k)]: {
-                    $regex: new RegExp(where[k][1].slice(1, -1)),
-                  },
-                });
+                reg = new RegExp(where[k][1].slice(1, -1));
               } else if (first === '%') {
-                instance.where({
-                  [parseKey(k)]: {
-                    $regex: new RegExp(where[k][1].slice(1) + '$'),
-                  },
-                });
+                reg = new RegExp(where[k][1].slice(1) + '$');
               } else if (last === '%') {
-                instance.where({
-                  [parseKey(k)]: {
-                    $regex: new RegExp('^' + where[k][1].slice(0, -1)),
-                  },
-                });
+                reg = new RegExp('^' + where[k][1].slice(0, -1));
+              }
+
+              if (reg) {
+                filter[parseKey(k)] = { $regex: reg };
               }
               break;
             }
             case '!=':
-              instance.where({
-                [parseKey(k)]: { $ne: where[k][1] },
-              });
+              filter[parseKey(k)] = { $ne: where[k][1] };
               break;
             case '>':
-              instance.where({
-                [parseKey(k)]: { $gt: where[k][1] },
-              });
+              filter[parseKey(k)] = { $gt: where[k][1] };
               break;
           }
         }
       }
     }
+    return filter;
+  }
+
+  where(instance, where) {
+    const filter = this.parseWhere(where);
+    if (!where._complex) {
+      return instance.where(filter);
+    }
+
+    const filters = [];
+    for (const k in where._complex) {
+      if (k === '_logic') {
+        continue;
+      }
+      filters.push({
+        ...this.parseWhere({ [k]: where._complex[k] }),
+        ...filter,
+      });
+    }
+
+    return instance.where({
+      // $or, $and, $not, $nor
+      [`$${where._complex._logic}`]: filters,
+    });
   }
 
   async select(where, { desc, limit, offset, field } = {}) {