axiodb 21.7.8 → 22.2.0

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (235) hide show
  1. package/lib/Helper/Console.helper.js +0 -1
  2. package/lib/Helper/Converter.helper.js +0 -1
  3. package/lib/Helper/DocumentLoader.helper.js +0 -1
  4. package/lib/Helper/Logger.helper.js +0 -1
  5. package/lib/Helper/PathSanitizer.helper.js +0 -1
  6. package/lib/Helper/RegexGuard.helper.d.ts +85 -0
  7. package/lib/Helper/RegexGuard.helper.js +277 -0
  8. package/lib/Helper/SafeErrorMessage.helper.d.ts +18 -0
  9. package/lib/Helper/SafeErrorMessage.helper.js +41 -0
  10. package/lib/Helper/SortedIndexValues.helper.js +0 -1
  11. package/lib/Helper/UniqueGenerator.helper.js +0 -1
  12. package/lib/Helper/response.helper.js +0 -1
  13. package/lib/Memory/memory.operation.js +0 -1
  14. package/lib/Services/Aggregation/Aggregation.Operation.js +0 -1
  15. package/lib/Services/Aggregation/OperatorRegistry.js +0 -1
  16. package/lib/Services/Aggregation/operators/accumulatorOperators.js +0 -1
  17. package/lib/Services/Aggregation/operators/expressionOperators.js +5 -2
  18. package/lib/Services/Aggregation/operators/stageOperators.js +5 -2
  19. package/lib/Services/Auth/AuthEvents.service.js +0 -1
  20. package/lib/Services/Auth/AuthSeeder.service.js +0 -1
  21. package/lib/Services/Auth/AuthService.service.js +0 -1
  22. package/lib/Services/Auth/ConfigDatabase.service.js +0 -1
  23. package/lib/Services/Auth/CookieCodec.helper.js +0 -1
  24. package/lib/Services/Auth/LoginRateLimiter.service.js +0 -1
  25. package/lib/Services/Auth/PasswordHasher.helper.js +0 -1
  26. package/lib/Services/Auth/PermissionChecker.helper.js +0 -1
  27. package/lib/Services/Auth/SessionStore.service.js +0 -1
  28. package/lib/Services/CRUD Operation/Create.operation.js +0 -1
  29. package/lib/Services/CRUD Operation/Delete.operation.js +0 -1
  30. package/lib/Services/CRUD Operation/Reader.operation.js +0 -1
  31. package/lib/Services/CRUD Operation/Update.operation.js +0 -1
  32. package/lib/Services/Collection/collection.operation.js +0 -1
  33. package/lib/Services/Database/database.operation.js +2 -3
  34. package/lib/Services/Index/Index.service.js +0 -1
  35. package/lib/Services/Index/IndexCache.service.js +0 -1
  36. package/lib/Services/Index/ReadIndex.service.js +0 -1
  37. package/lib/Services/Indexation.operation.js +4 -4
  38. package/lib/Services/Transaction/LockManager.service.js +0 -1
  39. package/lib/Services/Transaction/Session.service.js +0 -1
  40. package/lib/Services/Transaction/Transaction.service.js +0 -1
  41. package/lib/Services/Transaction/TransactionIndexManager.service.js +0 -1
  42. package/lib/Services/Transaction/TransactionRegistry.service.js +0 -1
  43. package/lib/Services/Transaction/WriteAheadLog.service.js +0 -1
  44. package/lib/client/AggregationProxy.js +0 -1
  45. package/lib/client/AxioDBCloud.client.js +0 -1
  46. package/lib/client/CollectionProxy.js +0 -1
  47. package/lib/client/DatabaseProxy.js +0 -1
  48. package/lib/client/DeleteOperationProxy.js +0 -1
  49. package/lib/client/PooledConnection.js +0 -1
  50. package/lib/client/ReaderProxy.js +0 -1
  51. package/lib/client/TransactionProxy.js +0 -1
  52. package/lib/client/UpdateOperationProxy.js +0 -1
  53. package/lib/client/types/client.types.js +0 -1
  54. package/lib/config/DB.js +0 -1
  55. package/lib/config/Interfaces/Auth/auth.interface.js +0 -1
  56. package/lib/config/Interfaces/Helper/response.helper.interface.js +0 -1
  57. package/lib/config/Interfaces/Operation/Indexation.operation.interface.js +0 -1
  58. package/lib/config/Interfaces/Operation/aggregation.interface.js +0 -1
  59. package/lib/config/Interfaces/Operation/database.operation.interface.js +0 -1
  60. package/lib/config/Interfaces/Transaction/transaction.interface.js +0 -1
  61. package/lib/config/Interfaces/shared.types.js +0 -1
  62. package/lib/config/Keys/Keys.js +0 -1
  63. package/lib/config/Keys/Permissions.js +0 -1
  64. package/lib/config/Keys/StatusCode.js +0 -1
  65. package/lib/engine/Filesystem/FileManager.js +9 -4
  66. package/lib/engine/Filesystem/FolderManager.js +8 -3
  67. package/lib/engine/node/WorkerForDataLoad.engine.js +0 -1
  68. package/lib/engine/node/WorkerForSearch.engine.js +0 -1
  69. package/lib/server/config/PortFreeChecker.js +0 -1
  70. package/lib/server/config/keys.d.ts +6 -0
  71. package/lib/server/config/keys.js +14 -2
  72. package/lib/server/config/server.js +5 -1
  73. package/lib/server/controller/Auth/Auth.controller.js +0 -1
  74. package/lib/server/controller/Auth/RoleManagement.controller.js +0 -1
  75. package/lib/server/controller/Auth/UserManagement.controller.js +0 -1
  76. package/lib/server/controller/Collections/Collection.controller.js +0 -1
  77. package/lib/server/controller/Database/Databse.controller.js +2 -2
  78. package/lib/server/controller/Index/Index.controller.js +0 -1
  79. package/lib/server/controller/Operation/CRUD.controller.js +0 -1
  80. package/lib/server/controller/Stats.controller.js +0 -1
  81. package/lib/server/helper/databaseImport.helper.js +0 -1
  82. package/lib/server/helper/documentCounterInFolder.helper.js +0 -1
  83. package/lib/server/helper/responseBuilder.helper.js +0 -1
  84. package/lib/server/middleware/auth.middleware.js +0 -1
  85. package/lib/server/middleware/permission.middleware.js +0 -1
  86. package/lib/server/public/AxioControl/AXioDB.png +0 -0
  87. package/lib/server/public/AxioControl/assets/index-B9AO8c4G.js +1 -0
  88. package/lib/server/public/AxioControl/index.html +1 -1
  89. package/lib/server/public/AxioControl/sw.js +1 -1
  90. package/lib/server/public/DONT_TOUCH_THIS_FILE.js +0 -1
  91. package/lib/server/router/Router.js +0 -1
  92. package/lib/server/router/Routers/Auth.routes.js +0 -1
  93. package/lib/server/router/Routers/Collection.routes.js +0 -1
  94. package/lib/server/router/Routers/DB.routes.js +0 -1
  95. package/lib/server/router/Routers/Index.routes.js +0 -1
  96. package/lib/server/router/Routers/Operation.routes.js +0 -1
  97. package/lib/server/router/Routers/RoleManagement.routes.js +0 -1
  98. package/lib/server/router/Routers/UserManagement.routes.js +0 -1
  99. package/lib/tcp/config/keys.js +0 -1
  100. package/lib/tcp/config/permissions.js +0 -1
  101. package/lib/tcp/config/protocol.js +0 -1
  102. package/lib/tcp/config/server.js +2 -2
  103. package/lib/tcp/connection/ConnectionManager.js +2 -2
  104. package/lib/tcp/connection/ConnectionRateLimiter.js +0 -1
  105. package/lib/tcp/connection/RequestContext.js +0 -1
  106. package/lib/tcp/connection/TransactionManager.js +0 -1
  107. package/lib/tcp/handler/CommandHandler.js +3 -3
  108. package/lib/tcp/handler/handlers/Auth.handler.js +0 -1
  109. package/lib/tcp/handler/handlers/Collection.handler.d.ts +1 -1
  110. package/lib/tcp/handler/handlers/Collection.handler.js +6 -6
  111. package/lib/tcp/handler/handlers/DB.handler.js +5 -5
  112. package/lib/tcp/handler/handlers/Operation.handler.js +3 -2
  113. package/lib/tcp/handler/handlers/Transaction.handler.js +3 -2
  114. package/lib/tcp/types/command.types.js +0 -1
  115. package/lib/tcp/types/protocol.types.js +0 -1
  116. package/lib/utility/BufferLoaderWithWorker.utils.js +0 -1
  117. package/lib/utility/Searcher.utils.js +3 -3
  118. package/lib/utility/SortData.utils.js +0 -1
  119. package/lib/utility/ZipUnzip.utils.js +0 -1
  120. package/package.json +1 -1
  121. package/.commandcode/settings.json +0 -24
  122. package/.commandcode/taste/taste.md +0 -2
  123. package/.commandcode/taste/user-taste-profile/taste.md +0 -39
  124. package/lib/Helper/Console.helper.js.map +0 -1
  125. package/lib/Helper/Converter.helper.js.map +0 -1
  126. package/lib/Helper/DocumentLoader.helper.js.map +0 -1
  127. package/lib/Helper/Logger.helper.js.map +0 -1
  128. package/lib/Helper/PathSanitizer.helper.js.map +0 -1
  129. package/lib/Helper/SortedIndexValues.helper.js.map +0 -1
  130. package/lib/Helper/UniqueGenerator.helper.js.map +0 -1
  131. package/lib/Helper/response.helper.js.map +0 -1
  132. package/lib/Memory/memory.operation.js.map +0 -1
  133. package/lib/Services/Aggregation/Aggregation.Operation.js.map +0 -1
  134. package/lib/Services/Aggregation/OperatorRegistry.js.map +0 -1
  135. package/lib/Services/Aggregation/operators/accumulatorOperators.js.map +0 -1
  136. package/lib/Services/Aggregation/operators/expressionOperators.js.map +0 -1
  137. package/lib/Services/Aggregation/operators/stageOperators.js.map +0 -1
  138. package/lib/Services/Auth/AuthEvents.service.js.map +0 -1
  139. package/lib/Services/Auth/AuthSeeder.service.js.map +0 -1
  140. package/lib/Services/Auth/AuthService.service.js.map +0 -1
  141. package/lib/Services/Auth/ConfigDatabase.service.js.map +0 -1
  142. package/lib/Services/Auth/CookieCodec.helper.js.map +0 -1
  143. package/lib/Services/Auth/LoginRateLimiter.service.js.map +0 -1
  144. package/lib/Services/Auth/PasswordHasher.helper.js.map +0 -1
  145. package/lib/Services/Auth/PermissionChecker.helper.js.map +0 -1
  146. package/lib/Services/Auth/SessionStore.service.js.map +0 -1
  147. package/lib/Services/CRUD Operation/Create.operation.js.map +0 -1
  148. package/lib/Services/CRUD Operation/Delete.operation.js.map +0 -1
  149. package/lib/Services/CRUD Operation/Reader.operation.js.map +0 -1
  150. package/lib/Services/CRUD Operation/Update.operation.js.map +0 -1
  151. package/lib/Services/Collection/collection.operation.js.map +0 -1
  152. package/lib/Services/Database/database.operation.js.map +0 -1
  153. package/lib/Services/Index/Index.service.js.map +0 -1
  154. package/lib/Services/Index/IndexCache.service.js.map +0 -1
  155. package/lib/Services/Index/ReadIndex.service.js.map +0 -1
  156. package/lib/Services/Indexation.operation.js.map +0 -1
  157. package/lib/Services/Transaction/LockManager.service.js.map +0 -1
  158. package/lib/Services/Transaction/Session.service.js.map +0 -1
  159. package/lib/Services/Transaction/Transaction.service.js.map +0 -1
  160. package/lib/Services/Transaction/TransactionIndexManager.service.js.map +0 -1
  161. package/lib/Services/Transaction/TransactionRegistry.service.js.map +0 -1
  162. package/lib/Services/Transaction/WriteAheadLog.service.js.map +0 -1
  163. package/lib/client/AggregationProxy.js.map +0 -1
  164. package/lib/client/AxioDBCloud.client.js.map +0 -1
  165. package/lib/client/CollectionProxy.js.map +0 -1
  166. package/lib/client/DatabaseProxy.js.map +0 -1
  167. package/lib/client/DeleteOperationProxy.js.map +0 -1
  168. package/lib/client/PooledConnection.js.map +0 -1
  169. package/lib/client/ReaderProxy.js.map +0 -1
  170. package/lib/client/TransactionProxy.js.map +0 -1
  171. package/lib/client/UpdateOperationProxy.js.map +0 -1
  172. package/lib/client/types/client.types.js.map +0 -1
  173. package/lib/config/DB.js.map +0 -1
  174. package/lib/config/Interfaces/Auth/auth.interface.js.map +0 -1
  175. package/lib/config/Interfaces/Helper/response.helper.interface.js.map +0 -1
  176. package/lib/config/Interfaces/Operation/Indexation.operation.interface.js.map +0 -1
  177. package/lib/config/Interfaces/Operation/aggregation.interface.js.map +0 -1
  178. package/lib/config/Interfaces/Operation/database.operation.interface.js.map +0 -1
  179. package/lib/config/Interfaces/Transaction/transaction.interface.js.map +0 -1
  180. package/lib/config/Interfaces/shared.types.js.map +0 -1
  181. package/lib/config/Keys/Keys.js.map +0 -1
  182. package/lib/config/Keys/Permissions.js.map +0 -1
  183. package/lib/config/Keys/StatusCode.js.map +0 -1
  184. package/lib/engine/Filesystem/FileManager.js.map +0 -1
  185. package/lib/engine/Filesystem/FolderManager.js.map +0 -1
  186. package/lib/engine/node/WorkerForDataLoad.engine.js.map +0 -1
  187. package/lib/engine/node/WorkerForSearch.engine.js.map +0 -1
  188. package/lib/server/config/PortFreeChecker.js.map +0 -1
  189. package/lib/server/config/keys.js.map +0 -1
  190. package/lib/server/config/server.js.map +0 -1
  191. package/lib/server/controller/Auth/Auth.controller.js.map +0 -1
  192. package/lib/server/controller/Auth/RoleManagement.controller.js.map +0 -1
  193. package/lib/server/controller/Auth/UserManagement.controller.js.map +0 -1
  194. package/lib/server/controller/Collections/Collection.controller.js.map +0 -1
  195. package/lib/server/controller/Database/Databse.controller.js.map +0 -1
  196. package/lib/server/controller/Index/Index.controller.js.map +0 -1
  197. package/lib/server/controller/Operation/CRUD.controller.js.map +0 -1
  198. package/lib/server/controller/Stats.controller.js.map +0 -1
  199. package/lib/server/helper/databaseImport.helper.js.map +0 -1
  200. package/lib/server/helper/documentCounterInFolder.helper.js.map +0 -1
  201. package/lib/server/helper/responseBuilder.helper.js.map +0 -1
  202. package/lib/server/middleware/auth.middleware.js.map +0 -1
  203. package/lib/server/middleware/permission.middleware.js.map +0 -1
  204. package/lib/server/public/AxioControl/.vite/manifest.json +0 -11
  205. package/lib/server/public/AxioControl/.vite/ssr-manifest.json +0 -813
  206. package/lib/server/public/AxioControl/assets/index-BRccHygR.js +0 -157
  207. package/lib/server/public/DONT_TOUCH_THIS_FILE.js.map +0 -1
  208. package/lib/server/router/Router.js.map +0 -1
  209. package/lib/server/router/Routers/Auth.routes.js.map +0 -1
  210. package/lib/server/router/Routers/Collection.routes.js.map +0 -1
  211. package/lib/server/router/Routers/DB.routes.js.map +0 -1
  212. package/lib/server/router/Routers/Index.routes.js.map +0 -1
  213. package/lib/server/router/Routers/Operation.routes.js.map +0 -1
  214. package/lib/server/router/Routers/RoleManagement.routes.js.map +0 -1
  215. package/lib/server/router/Routers/UserManagement.routes.js.map +0 -1
  216. package/lib/tcp/config/keys.js.map +0 -1
  217. package/lib/tcp/config/permissions.js.map +0 -1
  218. package/lib/tcp/config/protocol.js.map +0 -1
  219. package/lib/tcp/config/server.js.map +0 -1
  220. package/lib/tcp/connection/ConnectionManager.js.map +0 -1
  221. package/lib/tcp/connection/ConnectionRateLimiter.js.map +0 -1
  222. package/lib/tcp/connection/RequestContext.js.map +0 -1
  223. package/lib/tcp/connection/TransactionManager.js.map +0 -1
  224. package/lib/tcp/handler/CommandHandler.js.map +0 -1
  225. package/lib/tcp/handler/handlers/Auth.handler.js.map +0 -1
  226. package/lib/tcp/handler/handlers/Collection.handler.js.map +0 -1
  227. package/lib/tcp/handler/handlers/DB.handler.js.map +0 -1
  228. package/lib/tcp/handler/handlers/Operation.handler.js.map +0 -1
  229. package/lib/tcp/handler/handlers/Transaction.handler.js.map +0 -1
  230. package/lib/tcp/types/command.types.js.map +0 -1
  231. package/lib/tcp/types/protocol.types.js.map +0 -1
  232. package/lib/utility/BufferLoaderWithWorker.utils.js.map +0 -1
  233. package/lib/utility/Searcher.utils.js.map +0 -1
  234. package/lib/utility/SortData.utils.js.map +0 -1
  235. package/lib/utility/ZipUnzip.utils.js.map +0 -1
@@ -20,4 +20,3 @@ class Console {
20
20
  }
21
21
  }
22
22
  exports.default = Console;
23
- //# sourceMappingURL=Console.helper.js.map
@@ -22,4 +22,3 @@ class Converter {
22
22
  }
23
23
  }
24
24
  exports.default = Converter;
25
- //# sourceMappingURL=Converter.helper.js.map
@@ -51,4 +51,3 @@ class DocumentLoader {
51
51
  }
52
52
  DocumentLoader.ResponseHelper = new response_helper_1.default();
53
53
  exports.default = DocumentLoader;
54
- //# sourceMappingURL=DocumentLoader.helper.js.map
@@ -42,4 +42,3 @@ class Logger {
42
42
  }
43
43
  }
44
44
  exports.default = Logger;
45
- //# sourceMappingURL=Logger.helper.js.map
@@ -104,4 +104,3 @@ class PathSanitizer {
104
104
  }
105
105
  }
106
106
  exports.default = PathSanitizer;
107
- //# sourceMappingURL=PathSanitizer.helper.js.map
@@ -0,0 +1,85 @@
1
+ /**
2
+ * RegexGuard - Static ReDoS guard for user-supplied regex patterns.
3
+ *
4
+ * Rejects patterns that are too long, contain nested unbounded quantifiers
5
+ * (`(a+)+`), or have overlapping alternation branches inside an unboundedly
6
+ * quantified group (`(a|aa)+`). Bounded quantifiers like `{2,9}` are allowed.
7
+ *
8
+ * @class RegexGuard
9
+ * @example
10
+ * const safe = RegexGuard.compileRegex("(a+)b", "");
11
+ * const guarded = RegexGuard.compileRegex("(a+)+$", ""); // throws
12
+ */
13
+ export default class RegexGuard {
14
+ /** Upper bound on pattern length. */
15
+ static readonly MAX_PATTERN_LENGTH = 512;
16
+ /**
17
+ * Compiles a user-supplied pattern into a RegExp after proving it is safe.
18
+ * @param pattern - The regex source to compile.
19
+ * @param flags - Optional regex flags (e.g. "i").
20
+ * @returns A compiled RegExp.
21
+ * @throws Error if the pattern is empty, too long, or prone to catastrophic backtracking.
22
+ */
23
+ static compileRegex(pattern: string, flags?: string): RegExp;
24
+ /**
25
+ * Returns true when the pattern does not contain the catastrophic
26
+ * nested-quantifier shape. Pure check - callers decide what to do.
27
+ * @param pattern - The regex source to inspect.
28
+ * @returns true if the pattern is considered safe, false otherwise.
29
+ */
30
+ static isSafePattern(pattern: string): boolean;
31
+ /**
32
+ * Static scan for the catastrophic-backtracking shape.
33
+ *
34
+ * Two classes are rejected:
35
+ * 1. Nested unbounded quantifiers: a group that contains an internally
36
+ * quantified atom and is itself unboundedly quantified, e.g. `(a+)+`.
37
+ * 2. Overlapping alternation inside an unboundedly quantified group: two
38
+ * branches where one is a strict prefix of another, e.g. `(a|aa)+` -
39
+ * the parser cannot decide where a branch ends, causing exponential work.
40
+ *
41
+ * @param pattern - The regex source to inspect.
42
+ * @throws Error describing the dangerous construct when detected.
43
+ */
44
+ static assertSafePattern(pattern: string): void;
45
+ /**
46
+ * Splits a group body on top-level alternation operators and reports whether
47
+ * any two branches overlap, i.e. one is a strict prefix of another. Branch
48
+ * overlap on an unboundedly quantified group is what produces exponential
49
+ * backtracking in patterns like `(a|aa)+`.
50
+ * @param body - The characters between a group's '(' and ')'.
51
+ * @returns true when an overlapping branch pair is found.
52
+ */
53
+ private static hasOverlappingAlternation;
54
+ /**
55
+ * Strips the special group marker (`?:`, `?=`, `?!`, `?<=`, `?<!`, `?<name>`)
56
+ * from a group body so branch analysis sees the actual alternation content.
57
+ * @param body - The raw text between '(' and ')'.
58
+ * @returns The body without its leading marker, if one was present.
59
+ */
60
+ private static stripGroupMarker;
61
+ /**
62
+ * Splits a group body on '|' operators that are not nested inside a
63
+ * sub-group or character class.
64
+ * @param body - The group's raw body text.
65
+ * @returns The top-level alternation branches (at least one element).
66
+ */
67
+ private static splitTopLevel;
68
+ /**
69
+ * Determines what kind of quantifier (if any) follows a closing parenthesis.
70
+ * @param pattern - The full regex source.
71
+ * @param closeIndex - Index of the ')' that just closed a group.
72
+ * @returns "none" when no quantifier follows, "unbounded" for `*`, `+`, or an
73
+ * open-ended `{n,}` range, otherwise "bounded".
74
+ */
75
+ private static peekGroupQuantifier;
76
+ /**
77
+ * Parses a `{...}` quantifier starting at the given index.
78
+ * @param pattern - The full regex source.
79
+ * @param openIndex - Index of the '{'.
80
+ * @returns true for an unbounded `{n,}` range, false for a bounded `{n}` or
81
+ * `{n,m}`, and null when the character is not actually a quantifier
82
+ * (e.g. a literal brace inside a larger construct).
83
+ */
84
+ private static isUnboundedRange;
85
+ }
@@ -0,0 +1,277 @@
1
+ "use strict";
2
+ Object.defineProperty(exports, "__esModule", { value: true });
3
+ /**
4
+ * RegexGuard - Static ReDoS guard for user-supplied regex patterns.
5
+ *
6
+ * Rejects patterns that are too long, contain nested unbounded quantifiers
7
+ * (`(a+)+`), or have overlapping alternation branches inside an unboundedly
8
+ * quantified group (`(a|aa)+`). Bounded quantifiers like `{2,9}` are allowed.
9
+ *
10
+ * @class RegexGuard
11
+ * @example
12
+ * const safe = RegexGuard.compileRegex("(a+)b", "");
13
+ * const guarded = RegexGuard.compileRegex("(a+)+$", ""); // throws
14
+ */
15
+ class RegexGuard {
16
+ /**
17
+ * Compiles a user-supplied pattern into a RegExp after proving it is safe.
18
+ * @param pattern - The regex source to compile.
19
+ * @param flags - Optional regex flags (e.g. "i").
20
+ * @returns A compiled RegExp.
21
+ * @throws Error if the pattern is empty, too long, or prone to catastrophic backtracking.
22
+ */
23
+ static compileRegex(pattern, flags) {
24
+ if (!pattern || typeof pattern !== "string") {
25
+ throw new Error("Invalid regex pattern: must be a non-empty string");
26
+ }
27
+ if (pattern.length > this.MAX_PATTERN_LENGTH) {
28
+ throw new Error(`Regex pattern exceeds maximum length of ${this.MAX_PATTERN_LENGTH}`);
29
+ }
30
+ this.assertSafePattern(pattern);
31
+ return new RegExp(pattern, flags || "");
32
+ }
33
+ /**
34
+ * Returns true when the pattern does not contain the catastrophic
35
+ * nested-quantifier shape. Pure check - callers decide what to do.
36
+ * @param pattern - The regex source to inspect.
37
+ * @returns true if the pattern is considered safe, false otherwise.
38
+ */
39
+ static isSafePattern(pattern) {
40
+ try {
41
+ this.assertSafePattern(pattern);
42
+ return true;
43
+ }
44
+ catch (_a) {
45
+ return false;
46
+ }
47
+ }
48
+ /**
49
+ * Static scan for the catastrophic-backtracking shape.
50
+ *
51
+ * Two classes are rejected:
52
+ * 1. Nested unbounded quantifiers: a group that contains an internally
53
+ * quantified atom and is itself unboundedly quantified, e.g. `(a+)+`.
54
+ * 2. Overlapping alternation inside an unboundedly quantified group: two
55
+ * branches where one is a strict prefix of another, e.g. `(a|aa)+` -
56
+ * the parser cannot decide where a branch ends, causing exponential work.
57
+ *
58
+ * @param pattern - The regex source to inspect.
59
+ * @throws Error describing the dangerous construct when detected.
60
+ */
61
+ static assertSafePattern(pattern) {
62
+ let inClass = false;
63
+ let escaped = false;
64
+ // Stack of currently-open groups; each tracks whether it contains an
65
+ // internally quantified atom and where it opened (for branch analysis).
66
+ const groups = [];
67
+ for (let i = 0; i < pattern.length; i++) {
68
+ const c = pattern[i];
69
+ if (escaped) {
70
+ escaped = false;
71
+ continue;
72
+ }
73
+ if (c === "\\") {
74
+ escaped = true;
75
+ continue;
76
+ }
77
+ // Inside a character class like [abc+]: '+' is a literal there, not a quantifier.
78
+ if (inClass) {
79
+ if (c === "]")
80
+ inClass = false;
81
+ continue;
82
+ }
83
+ if (c === "[") {
84
+ inClass = true;
85
+ continue;
86
+ }
87
+ if (c === "(") {
88
+ groups.push({ openIndex: i, hasQuantifiedAtom: false });
89
+ continue;
90
+ }
91
+ if (c === ")") {
92
+ const group = groups.pop();
93
+ if (!group)
94
+ continue;
95
+ const quantifier = this.peekGroupQuantifier(pattern, i);
96
+ const isUnbounded = quantifier === "unbounded";
97
+ if (isUnbounded) {
98
+ if (group.hasQuantifiedAtom) {
99
+ throw new Error("Regex pattern rejected: contains nested quantifiers that can cause catastrophic backtracking");
100
+ }
101
+ const body = pattern.slice(group.openIndex + 1, i);
102
+ if (this.hasOverlappingAlternation(this.stripGroupMarker(body))) {
103
+ throw new Error("Regex pattern rejected: quantified alternation with overlapping branches can cause catastrophic backtracking");
104
+ }
105
+ }
106
+ // A quantified group, or a group containing quantified atoms, is itself
107
+ // a quantified atom to its parent group.
108
+ const isQuantifiedAtom = group.hasQuantifiedAtom || isUnbounded;
109
+ if (isQuantifiedAtom && groups.length > 0) {
110
+ groups[groups.length - 1].hasQuantifiedAtom = true;
111
+ }
112
+ continue;
113
+ }
114
+ // Track unbounded quantifiers (+ or * or {n,}): the atom before them is a
115
+ // quantified atom. '?' is deliberately excluded - a single optional atom
116
+ // cannot blow up on its own. `{m}` bounded and `{m,n}` bounded are also excluded.
117
+ let isUnbounded = false;
118
+ if (c === "+" || c === "*") {
119
+ isUnbounded = true;
120
+ }
121
+ else if (c === "{") {
122
+ isUnbounded = this.isUnboundedRange(pattern, i) === true;
123
+ }
124
+ if (isUnbounded && groups.length > 0) {
125
+ groups[groups.length - 1].hasQuantifiedAtom = true;
126
+ }
127
+ }
128
+ }
129
+ /**
130
+ * Splits a group body on top-level alternation operators and reports whether
131
+ * any two branches overlap, i.e. one is a strict prefix of another. Branch
132
+ * overlap on an unboundedly quantified group is what produces exponential
133
+ * backtracking in patterns like `(a|aa)+`.
134
+ * @param body - The characters between a group's '(' and ')'.
135
+ * @returns true when an overlapping branch pair is found.
136
+ */
137
+ static hasOverlappingAlternation(body) {
138
+ const branches = this.splitTopLevel(body);
139
+ if (branches.length < 2)
140
+ return false;
141
+ for (let i = 0; i < branches.length; i++) {
142
+ for (let j = 0; j < branches.length; j++) {
143
+ if (i === j)
144
+ continue;
145
+ const a = branches[i];
146
+ const b = branches[j];
147
+ // An empty branch can match zero width, so no line is consumed - the
148
+ // classic `(|x)+` / `(a|)+` ambiguity.
149
+ if (a === "" || b === "")
150
+ return true;
151
+ if (b.length > a.length && b.startsWith(a))
152
+ return true;
153
+ if (a.length > b.length && a.startsWith(b))
154
+ return true;
155
+ if (a === b)
156
+ return true; // duplicate branches are always ambiguous
157
+ }
158
+ }
159
+ return false;
160
+ }
161
+ /**
162
+ * Strips the special group marker (`?:`, `?=`, `?!`, `?<=`, `?<!`, `?<name>`)
163
+ * from a group body so branch analysis sees the actual alternation content.
164
+ * @param body - The raw text between '(' and ')'.
165
+ * @returns The body without its leading marker, if one was present.
166
+ */
167
+ static stripGroupMarker(body) {
168
+ if (body[0] === "?" && body[1] === "<") {
169
+ const close = body.indexOf(">");
170
+ return close >= 0 ? body.slice(close + 1) : body;
171
+ }
172
+ if (body[0] === "?" && (body[1] === ":" || body[1] === "=" || body[1] === "!")) {
173
+ return body.slice(2);
174
+ }
175
+ return body;
176
+ }
177
+ /**
178
+ * Splits a group body on '|' operators that are not nested inside a
179
+ * sub-group or character class.
180
+ * @param body - The group's raw body text.
181
+ * @returns The top-level alternation branches (at least one element).
182
+ */
183
+ static splitTopLevel(body) {
184
+ const branches = [];
185
+ let depth = 0;
186
+ let inClass = false;
187
+ let escaped = false;
188
+ let current = "";
189
+ for (const c of body) {
190
+ if (escaped) {
191
+ escaped = false;
192
+ current += c;
193
+ continue;
194
+ }
195
+ if (c === "\\") {
196
+ escaped = true;
197
+ current += c;
198
+ continue;
199
+ }
200
+ if (inClass) {
201
+ current += c;
202
+ if (c === "]")
203
+ inClass = false;
204
+ continue;
205
+ }
206
+ if (c === "[") {
207
+ inClass = true;
208
+ current += c;
209
+ continue;
210
+ }
211
+ if (c === "(") {
212
+ depth++;
213
+ current += c;
214
+ continue;
215
+ }
216
+ if (c === ")") {
217
+ depth--;
218
+ current += c;
219
+ continue;
220
+ }
221
+ if (c === "|" && depth === 0) {
222
+ branches.push(current);
223
+ current = "";
224
+ continue;
225
+ }
226
+ current += c;
227
+ }
228
+ branches.push(current);
229
+ return branches;
230
+ }
231
+ /**
232
+ * Determines what kind of quantifier (if any) follows a closing parenthesis.
233
+ * @param pattern - The full regex source.
234
+ * @param closeIndex - Index of the ')' that just closed a group.
235
+ * @returns "none" when no quantifier follows, "unbounded" for `*`, `+`, or an
236
+ * open-ended `{n,}` range, otherwise "bounded".
237
+ */
238
+ static peekGroupQuantifier(pattern, closeIndex) {
239
+ const next = pattern[closeIndex + 1];
240
+ if (next === "*" || next === "+")
241
+ return "unbounded";
242
+ if (next === "{") {
243
+ const bounded = this.isUnboundedRange(pattern, closeIndex + 1);
244
+ return bounded === true ? "unbounded" : bounded === false ? "bounded" : "none";
245
+ }
246
+ if (next === "?")
247
+ return "bounded";
248
+ return "none";
249
+ }
250
+ /**
251
+ * Parses a `{...}` quantifier starting at the given index.
252
+ * @param pattern - The full regex source.
253
+ * @param openIndex - Index of the '{'.
254
+ * @returns true for an unbounded `{n,}` range, false for a bounded `{n}` or
255
+ * `{n,m}`, and null when the character is not actually a quantifier
256
+ * (e.g. a literal brace inside a larger construct).
257
+ */
258
+ static isUnboundedRange(pattern, openIndex) {
259
+ let closeIndex = openIndex + 1;
260
+ while (closeIndex < pattern.length && pattern[closeIndex] !== "}") {
261
+ closeIndex++;
262
+ }
263
+ if (closeIndex >= pattern.length)
264
+ return null;
265
+ const body = pattern.slice(openIndex + 1, closeIndex);
266
+ if (/^\d+$/.test(body))
267
+ return false;
268
+ if (/^\d+,\d+$/.test(body))
269
+ return false;
270
+ if (/^\d+,$/.test(body))
271
+ return true;
272
+ return null;
273
+ }
274
+ }
275
+ /** Upper bound on pattern length. */
276
+ RegexGuard.MAX_PATTERN_LENGTH = 512;
277
+ exports.default = RegexGuard;
@@ -0,0 +1,18 @@
1
+ /**
2
+ * SafeErrorMessage - Redacts filesystem paths and internal details from error
3
+ * messages before they are returned to remote clients.
4
+ * @class SafeErrorMessage
5
+ * @example
6
+ * SafeErrorMessage.sanitize(new Error("open '/home/user/db'"));
7
+ * // 'open <path>'
8
+ */
9
+ export default class SafeErrorMessage {
10
+ static readonly MAX_MESSAGE_LENGTH = 300;
11
+ static readonly FALLBACK_MESSAGE = "An internal error occurred. Please try again later.";
12
+ /**
13
+ * Sanitizes an error for transmission to a remote client.
14
+ * @param error - The caught error (may be any unknown).
15
+ * @returns A single-line, path-redacted message with a bounded length.
16
+ */
17
+ static sanitize(error: unknown): string;
18
+ }
@@ -0,0 +1,41 @@
1
+ "use strict";
2
+ Object.defineProperty(exports, "__esModule", { value: true });
3
+ /**
4
+ * SafeErrorMessage - Redacts filesystem paths and internal details from error
5
+ * messages before they are returned to remote clients.
6
+ * @class SafeErrorMessage
7
+ * @example
8
+ * SafeErrorMessage.sanitize(new Error("open '/home/user/db'"));
9
+ * // 'open <path>'
10
+ */
11
+ class SafeErrorMessage {
12
+ /**
13
+ * Sanitizes an error for transmission to a remote client.
14
+ * @param error - The caught error (may be any unknown).
15
+ * @returns A single-line, path-redacted message with a bounded length.
16
+ */
17
+ static sanitize(error) {
18
+ const raw = error instanceof Error
19
+ ? error.message
20
+ : typeof error === "string"
21
+ ? error
22
+ : error !== undefined
23
+ ? String(error)
24
+ : "";
25
+ let message = raw;
26
+ message = message.replace(/[a-zA-Z]:\\[^\s"'`]+/g, "<path>");
27
+ message = message.replace(/(^|[\s(['"`])[\/][^\s"'`]+/g, "$1<path>");
28
+ message = message.replace(/(^|[\s(['"`])(?:\.\.?(?:[\/\\]|$))[^\s"'`]*/g, "$1<path>");
29
+ message = message.replace(/['"`]\s*<path>\s*['"`]/g, "<path>");
30
+ message = message.replace(/\r?\n/g, " | ").replace(/\s{2,}/g, " ").trim();
31
+ if (!message || message === "<path>")
32
+ return this.FALLBACK_MESSAGE;
33
+ if (message.length > this.MAX_MESSAGE_LENGTH) {
34
+ message = message.slice(0, this.MAX_MESSAGE_LENGTH - 3) + "...";
35
+ }
36
+ return message;
37
+ }
38
+ }
39
+ SafeErrorMessage.MAX_MESSAGE_LENGTH = 300;
40
+ SafeErrorMessage.FALLBACK_MESSAGE = "An internal error occurred. Please try again later.";
41
+ exports.default = SafeErrorMessage;
@@ -102,4 +102,3 @@ class SortedIndexValues {
102
102
  }
103
103
  }
104
104
  exports.default = SortedIndexValues;
105
- //# sourceMappingURL=SortedIndexValues.helper.js.map
@@ -25,4 +25,3 @@ class UniqueGenerator {
25
25
  }
26
26
  }
27
27
  exports.default = UniqueGenerator;
28
- //# sourceMappingURL=UniqueGenerator.helper.js.map
@@ -46,4 +46,3 @@ class ResponseHelper {
46
46
  }
47
47
  }
48
48
  exports.default = ResponseHelper;
49
- //# sourceMappingURL=response.helper.js.map
@@ -293,4 +293,3 @@ class InMemoryCache {
293
293
  }
294
294
  }
295
295
  exports.InMemoryCache = InMemoryCache;
296
- //# sourceMappingURL=memory.operation.js.map
@@ -102,4 +102,3 @@ class Aggregation {
102
102
  }
103
103
  }
104
104
  exports.default = Aggregation;
105
- //# sourceMappingURL=Aggregation.Operation.js.map
@@ -32,4 +32,3 @@ class OperatorRegistry {
32
32
  }
33
33
  exports.OperatorRegistry = OperatorRegistry;
34
34
  OperatorRegistry.operators = new Map();
35
- //# sourceMappingURL=OperatorRegistry.js.map
@@ -134,4 +134,3 @@ exports.BUILT_IN_ACCUMULATORS = {
134
134
  $stdDevSamp: accumulatorStdDevSamp,
135
135
  $count: accumulatorCount,
136
136
  };
137
- //# sourceMappingURL=accumulatorOperators.js.map
@@ -1,8 +1,12 @@
1
1
  "use strict";
2
+ var __importDefault = (this && this.__importDefault) || function (mod) {
3
+ return (mod && mod.__esModule) ? mod : { "default": mod };
4
+ };
2
5
  Object.defineProperty(exports, "__esModule", { value: true });
3
6
  exports.getNestedValue = getNestedValue;
4
7
  exports.setNestedValue = setNestedValue;
5
8
  exports.evaluateExpression = evaluateExpression;
9
+ const RegexGuard_helper_1 = __importDefault(require("../../../Helper/RegexGuard.helper"));
6
10
  function getNestedValue(obj, path) {
7
11
  if (!path || !obj)
8
12
  return undefined;
@@ -153,7 +157,7 @@ function evaluateExpression(doc, expr) {
153
157
  case "$regexMatch": {
154
158
  const input = exprObj.$regexMatch;
155
159
  const str = String(evaluateExpression(doc, input.input));
156
- const regex = new RegExp(input.regex, input.options || "");
160
+ const regex = RegexGuard_helper_1.default.compileRegex(input.regex, input.options || "");
157
161
  return regex.test(str);
158
162
  }
159
163
  case "$cmp": {
@@ -587,4 +591,3 @@ function convertType(value, to) {
587
591
  default: return value;
588
592
  }
589
593
  }
590
- //# sourceMappingURL=expressionOperators.js.map
@@ -8,6 +8,9 @@ var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, ge
8
8
  step((generator = generator.apply(thisArg, _arguments || [])).next());
9
9
  });
10
10
  };
11
+ var __importDefault = (this && this.__importDefault) || function (mod) {
12
+ return (mod && mod.__esModule) ? mod : { "default": mod };
13
+ };
11
14
  Object.defineProperty(exports, "__esModule", { value: true });
12
15
  exports.BUILT_IN_STAGE_OPERATORS = void 0;
13
16
  exports.executeMatch = executeMatch;
@@ -32,6 +35,7 @@ exports.executeMergeObjects = executeMergeObjects;
32
35
  const expressionOperators_1 = require("./expressionOperators");
33
36
  const accumulatorOperators_1 = require("./accumulatorOperators");
34
37
  const OperatorRegistry_1 = require("../OperatorRegistry");
38
+ const RegexGuard_helper_1 = __importDefault(require("../../../Helper/RegexGuard.helper"));
35
39
  function matchesCondition(itemValue, condition) {
36
40
  if (condition === null || condition === undefined) {
37
41
  return itemValue === null || itemValue === undefined;
@@ -44,7 +48,7 @@ function matchesCondition(itemValue, condition) {
44
48
  if (typeof condition === "object") {
45
49
  if ("$regex" in condition) {
46
50
  try {
47
- return new RegExp(String(condition.$regex), condition.$options || "").test(String(itemValue));
51
+ return RegexGuard_helper_1.default.compileRegex(String(condition.$regex), condition.$options || "").test(String(itemValue));
48
52
  }
49
53
  catch (_a) {
50
54
  return false;
@@ -561,4 +565,3 @@ exports.BUILT_IN_STAGE_OPERATORS = {
561
565
  $replaceRoot: executeReplaceRoot,
562
566
  $replaceWith: executeReplaceRoot,
563
567
  };
564
- //# sourceMappingURL=stageOperators.js.map
@@ -14,4 +14,3 @@ const events_1 = require("events");
14
14
  class AuthEvents extends events_1.EventEmitter {
15
15
  }
16
16
  exports.default = new AuthEvents();
17
- //# sourceMappingURL=AuthEvents.service.js.map
@@ -95,4 +95,3 @@ class AuthSeeder {
95
95
  }
96
96
  }
97
97
  exports.default = AuthSeeder;
98
- //# sourceMappingURL=AuthSeeder.service.js.map
@@ -263,4 +263,3 @@ class AuthService {
263
263
  }
264
264
  }
265
265
  exports.default = AuthService;
266
- //# sourceMappingURL=AuthService.service.js.map
@@ -44,4 +44,3 @@ class ConfigDatabase {
44
44
  }
45
45
  }
46
46
  exports.default = ConfigDatabase.getInstance();
47
- //# sourceMappingURL=ConfigDatabase.service.js.map
@@ -27,4 +27,3 @@ class CookieCodec {
27
27
  }
28
28
  }
29
29
  exports.default = CookieCodec;
30
- //# sourceMappingURL=CookieCodec.helper.js.map
@@ -86,4 +86,3 @@ class LoginRateLimiter {
86
86
  }
87
87
  }
88
88
  exports.default = LoginRateLimiter.getInstance();
89
- //# sourceMappingURL=LoginRateLimiter.service.js.map
@@ -51,4 +51,3 @@ class PasswordHasher {
51
51
  }
52
52
  }
53
53
  exports.default = PasswordHasher;
54
- //# sourceMappingURL=PasswordHasher.helper.js.map
@@ -41,4 +41,3 @@ class PermissionChecker {
41
41
  }
42
42
  }
43
43
  exports.default = PermissionChecker.getInstance();
44
- //# sourceMappingURL=PermissionChecker.helper.js.map
@@ -93,4 +93,3 @@ class SessionStore {
93
93
  }
94
94
  }
95
95
  exports.default = SessionStore.getInstance();
96
- //# sourceMappingURL=SessionStore.service.js.map
@@ -92,4 +92,3 @@ class Insertion {
92
92
  }
93
93
  }
94
94
  exports.default = Insertion;
95
- //# sourceMappingURL=Create.operation.js.map
@@ -185,4 +185,3 @@ class DeleteOperation {
185
185
  }
186
186
  }
187
187
  exports.default = DeleteOperation;
188
- //# sourceMappingURL=Delete.operation.js.map
@@ -475,4 +475,3 @@ class Reader {
475
475
  }
476
476
  }
477
477
  exports.default = Reader;
478
- //# sourceMappingURL=Reader.operation.js.map
@@ -202,4 +202,3 @@ class UpdateOperation {
202
202
  }
203
203
  }
204
204
  exports.default = UpdateOperation;
205
- //# sourceMappingURL=Update.operation.js.map
@@ -314,4 +314,3 @@ class Collection {
314
314
  }
315
315
  }
316
316
  exports.default = Collection;
317
- //# sourceMappingURL=collection.operation.js.map