jxp 2.14.6 → 2.15.0

package/libs/datamunging.js

@@ -1,6 +1,6 @@
 var _ = require("underscore");
 
-var input1 = { 
+var input1 = {
 	due_date: '2016-02-01T00:00:00Z',
 	from_document: '',
 	allow_online_payment: 'false',
@@ -41,45 +41,51 @@ var input1 = {
 	id: '93490358',
 }
 
-var test1 = { due_date: '2016-02-01T00:00:00Z',
-  from_document: '',
-  allow_online_payment: 'false',
-  paid: 'true',
-  locked: 'false',
-  customer_id: '2446859',
-  modified: '2016-02-02T15:09:06.983',
-  created: '2016-02-01T21:09:37.873',
-  date: '2016-02-01T00:00:00Z',
-  inclusive: 'false',
-  discount_percentage: '0',
-  tax_reference: '',
-  discount: '0',
-  amount_due: '0',
-  printed: 'false',
-  editable: 'true',
-  has_attachments: 'false',
-  has_notes: 'false',
-  has_anticipated_date: 'false',
-  lines:
-   [ { SelectionId: '6824935',
-       TaxTypeId: '965302',
-       ID: '74465675',
-       LineType: '0',
-       Quantity: '1',
-       Unit: '',
-       TaxPercentage: '0.14',
-       DiscountPercentage: '0',
-       Discount: '0' },
-     { ID: '74465676',
-       LineType: '0',
-       Quantity: '4',
-       Unit: '',
-       TaxPercentage: '0.14',
-       DiscountPercentage: '0',
-       Discount: '0',
-       Comments: '' } ],
-  location: '547d506b184d110c0601314c',
-  id: '93490358' }
+var test1 = {
+	due_date: '2016-02-01T00:00:00Z',
+	from_document: '',
+	allow_online_payment: 'false',
+	paid: 'true',
+	locked: 'false',
+	customer_id: '2446859',
+	modified: '2016-02-02T15:09:06.983',
+	created: '2016-02-01T21:09:37.873',
+	date: '2016-02-01T00:00:00Z',
+	inclusive: 'false',
+	discount_percentage: '0',
+	tax_reference: '',
+	discount: '0',
+	amount_due: '0',
+	printed: 'false',
+	editable: 'true',
+	has_attachments: 'false',
+	has_notes: 'false',
+	has_anticipated_date: 'false',
+	lines:
+		[{
+			SelectionId: '6824935',
+			TaxTypeId: '965302',
+			ID: '74465675',
+			LineType: '0',
+			Quantity: '1',
+			Unit: '',
+			TaxPercentage: '0.14',
+			DiscountPercentage: '0',
+			Discount: '0'
+		},
+		{
+			ID: '74465676',
+			LineType: '0',
+			Quantity: '4',
+			Unit: '',
+			TaxPercentage: '0.14',
+			DiscountPercentage: '0',
+			Discount: '0',
+			Comments: ''
+		}],
+	location: '547d506b184d110c0601314c',
+	id: '93490358'
+}
 
 input2 = {
 	'test[0][Yo]': "0Yo",
@@ -161,39 +167,45 @@ var allMatch = /^[a-zA-Z\d_\-]+|\[[a-zA-Z\d_\-][a-zA-Z_\-\d]*\]|\[\d+\]/g;
 
 // Based conceptually on the _.extend() function in underscore.js ( see http://documentcloud.github.com/underscore/#extend for more details )
 
-function deepExtend(obj) {
-  var parentRE = /#{\s*?_\s*?}/,
-  slice = Array.prototype.slice;
+function deepExtend(obj, depth = 0) {
+	const MAX_DEPTH = 20; // Prevent infinite recursion
+	if (depth > MAX_DEPTH) {
+		console.warn('Maximum depth exceeded in deepExtend');
+		return obj;
+	}
+
+	var parentRE = /#{\s*?_\s*?}/,
+		slice = Array.prototype.slice;
 
-  _.each(slice.call(arguments, 1), function(source) {
-    for (var prop in source) {
-      if (_.isUndefined(obj[prop]) || _.isFunction(obj[prop]) || _.isNull(source[prop]) || _.isDate(source[prop])) {
-        obj[prop] = source[prop];
-      }
-      else if (_.isString(source[prop]) && parentRE.test(source[prop])) {
-        if (_.isString(obj[prop])) {
-          obj[prop] = source[prop].replace(parentRE, obj[prop]);
-        }
-      }
-      else if (_.isArray(obj[prop]) || _.isArray(source[prop])){
-        if (!_.isArray(obj[prop]) || !_.isArray(source[prop])){
-          throw new Error('Trying to combine an array with a non-array (' + prop + ')');
-        } else {
-          obj[prop] = _.reject(_.deepExtend(_.clone(obj[prop]), source[prop]), function (item) { return _.isNull(item);});
-        }
-      }
-      else if (_.isObject(obj[prop]) || _.isObject(source[prop])){
-        if (!_.isObject(obj[prop]) || !_.isObject(source[prop])){
-          throw new Error('Trying to combine an object with a non-object (' + prop + ')');
-        } else {
-          obj[prop] = _.deepExtend(_.clone(obj[prop]), source[prop]);
-        }
-      } else {
-        obj[prop] = source[prop];
-      }
-    }
-  });
-  return obj;
+	_.each(slice.call(arguments, 1), function (source) {
+		for (var prop in source) {
+			if (_.isUndefined(obj[prop]) || _.isFunction(obj[prop]) || _.isNull(source[prop]) || _.isDate(source[prop])) {
+				obj[prop] = source[prop];
+			}
+			else if (_.isString(source[prop]) && parentRE.test(source[prop])) {
+				if (_.isString(obj[prop])) {
+					obj[prop] = source[prop].replace(parentRE, obj[prop]);
+				}
+			}
+			else if (_.isArray(obj[prop]) || _.isArray(source[prop])) {
+				if (!_.isArray(obj[prop]) || !_.isArray(source[prop])) {
+					throw new Error('Trying to combine an array with a non-array (' + prop + ')');
+				} else {
+					obj[prop] = _.reject(_.deepExtend(_.clone(obj[prop]), source[prop], depth + 1), function (item) { return _.isNull(item); });
+				}
+			}
+			else if (_.isObject(obj[prop]) || _.isObject(source[prop])) {
+				if (!_.isObject(obj[prop]) || !_.isObject(source[prop])) {
+					throw new Error('Trying to combine an object with a non-object (' + prop + ')');
+				} else {
+					obj[prop] = _.deepExtend(_.clone(obj[prop]), source[prop], depth + 1);
+				}
+			} else {
+				obj[prop] = source[prop];
+			}
+		}
+	});
+	return obj;
 };
 
 _.mixin({ 'deepExtend': deepExtend });
@@ -259,7 +271,13 @@ function isArray(a) {
 	return Array.isArray(a);
 }
 
-var assignPropVal = function(parts, result, val) {
+var assignPropVal = function (parts, result, val, depth = 0) {
+	const MAX_DEPTH = 20; // Prevent infinite recursion
+	if (depth > MAX_DEPTH) {
+		console.warn('Maximum depth exceeded in assignPropVal');
+		return result;
+	}
+
 	var part = parts.shift().replace(/\[|\]/g, "");
 	if (parts.length) {
 		if (isNumeric(parts[0].replace(/\[|\]/g, ""))) {
@@ -267,14 +285,14 @@ var assignPropVal = function(parts, result, val) {
 		} else {
 			result[part] = {};
 		}
-		assignPropVal(parts, result[part], val);
+		assignPropVal(parts, result[part], val, depth + 1);
 	} else {
 		result[part] = val;
 	}
 	return result;
 }
 
-var deserialize = function(input) {
+var deserialize = function (input) {
 	// console.log("INPUT", input);
 	var result = {};
 	var newobj = {};
@@ -283,20 +301,19 @@ var deserialize = function(input) {
 		// console.log(prop, parts);
 		var val = input[prop];
 		if (parts) {
-			var tmp = assignPropVal(parts, result, val);
-			newobj = _.deepExtend(newobj, tmp);
+			var tmp = assignPropVal(parts, result, val, 0);
+			newobj = _.deepExtend(newobj, tmp, 0);
 		} else {
 			// console.log("NOT ARRAY", parts);
 			newobj[prop] = input[prop];
 		}
-		
 	}
 	// input = newobj;
 	// console.log("Munge!", newobj);
 	return newobj;
 }
 
-var runTest = function(name, input, test) {
+var runTest = function (name, input, test) {
 	var result = deserialize(input);
 	if (_.isEqual(result, test)) {
 		console.log("PASSED " + name);
@@ -306,7 +323,7 @@ var runTest = function(name, input, test) {
 	}
 }
 
-var test = function() {
+var test = function () {
 	runTest("Test 1", input1, test1);
 	runTest("Test 2", input2, test2);
 	runTest("Test 3", input3, test3);

package/libs/docs.js

@@ -8,6 +8,50 @@ const readFile = util.promisify(fs.readFile);
 const schema_description = require("./schema_description");
 const errors = require("restify-errors");
 
+// Helper function to safely serialize schema fields
+const serializeField = (field) => {
+    const safeField = {
+        path: field.path,
+        instance: field.instance,
+        options: { ...field.options },
+        validators: field.validators?.map(v => ({
+            type: v.type?.name,
+            message: v.message
+        })),
+        isRequired: field.isRequired
+    };
+
+    // Handle default value
+    if (typeof field.defaultValue === 'function') {
+        safeField.defaultValue = '[Function]';
+    } else if (field.defaultValue === undefined && field.options.default !== undefined) {
+        if (typeof field.options.default === 'function') {
+            safeField.defaultValue = '[Function]';
+        } else {
+            safeField.defaultValue = field.options.default;
+        }
+    } else {
+        safeField.defaultValue = field.defaultValue;
+    }
+
+    // Handle special cases for different field types
+    if (field.instance === 'Array' && field.caster) {
+        safeField.arrayType = field.caster.instance;
+        // Handle array defaults specially
+        if (Array.isArray(safeField.defaultValue)) {
+            safeField.defaultValue = JSON.stringify(safeField.defaultValue);
+        }
+    }
+    if (field.instance === 'Embedded' || field.instance === 'DocumentArray') {
+        safeField.schema = Object.keys(field.schema.paths).map(p => ({
+            path: p,
+            type: field.schema.paths[p].instance
+        }));
+    }
+
+    return safeField;
+};
+
 class Docs {
     constructor(opts) {
         this.config = Object.assign({}, opts.config);
@@ -16,7 +60,7 @@ class Docs {
         this.package = require(path.join(process.cwd(), "package.json"));
     }
 
-    renderTemplate(res, template_file, data={}) {
+    renderTemplate(res, template_file, data = {}) {
         try {
             const template = pug.compileFile(path.join(__dirname, `../templates/${template_file}.pug`));
             data.title = data.title || `${this.package.name} API Documentation`;
@@ -28,10 +72,10 @@ class Docs {
             res.writeHead(200, {
                 'Content-Length': Buffer.byteLength(body),
                 'Content-Type': 'text/html'
-              });
+            });
             res.write(body);
             res.end();
-        } catch(err) {
+        } catch (err) {
             console.error(err);
             return new errors.InternalServerError(err.toString());
         }
@@ -64,7 +108,7 @@ class Docs {
         try {
             res.send(this.models);
             next();
-        } catch(err) {
+        } catch (err) {
             return new errors.InternalServerError(err.toString());
         }
     }
@@ -73,7 +117,7 @@ class Docs {
         try {
             this.renderTemplate(res, "index", {});
             next();
-        } catch(err) {
+        } catch (err) {
             return new errors.InternalServerError(err.toString());
         }
     }
@@ -83,7 +127,7 @@ class Docs {
             const body = await readFile(path.join(__dirname, `../docs`, req.params.md_doc));
             const md_contents = md.render(body.toString()).body;
             this.renderTemplate(res, "md", { md_contents });
-        } catch(err) {
+        } catch (err) {
             return new errors.InternalServerError(err.toString());
         }
     }
@@ -91,13 +135,25 @@ class Docs {
     model(req, res, next) {
         try {
             const model = this.models[req.params.modelname];
-            console.dir(model.schema.opts);
-            const fields = Object.keys(model.schema.paths);     
+            const fields = Object.keys(model.schema.paths);
             fields.sort();
             const perms = model.schema.opts.perms;
-            this.renderTemplate(res, "model", { model, fields, perms });
+
+            // Prepare safe field data for template
+            const safeFields = {};
+            fields.forEach(fieldName => {
+                safeFields[fieldName] = serializeField(model.schema.paths[fieldName]);
+            });
+
+            this.renderTemplate(res, "model", {
+                model,
+                fields,
+                perms,
+                safeFields
+            });
             next();
-        } catch(err) {
+        } catch (err) {
+            console.error(err);
             return new errors.InternalServerError(err.toString());
         }
     }

package/libs/jxp.js

@@ -72,7 +72,7 @@ const outputCSV = (req, res, next) => {
 	try {
 		const data = res.result.data.map(row => row._doc);
 		if (!data.length) {
-			throw("")
+			throw ("")
 		}
 		res.writeHead(200, {
 			'Content-Type': 'text/csv',
@@ -91,7 +91,7 @@ const outputCSV = (req, res, next) => {
 const actionGet = async (req, res) => {
 	const opname = `get ${req.modelname} ${ops++}`;
 	console.time(opname);
-	const parseSearch = function(search) {
+	const parseSearch = function (search) {
 		let result = {};
 		for (let i in search) {
 			result[i] = new RegExp(search[i], "i");
@@ -120,9 +120,9 @@ const actionGet = async (req, res) => {
 	}
 	if (req.query.search) {
 		// console.log({ search: req.query.search });
-		q = req.Model.find({ $text: { $search: req.query.search }}, { score : { $meta: "textScore" } }).sort( { score: { $meta : "textScore" } } );
-		countquery = Object.assign({ $text: { $search: req.query.search }}, countquery);
-		qcount = req.Model.find({ $text: { $search: req.query.search }});
+		q = req.Model.find({ $text: { $search: req.query.search } }, { score: { $meta: "textScore" } }).sort({ score: { $meta: "textScore" } });
+		countquery = Object.assign({ $text: { $search: req.query.search } }, countquery);
+		qcount = req.Model.find({ $text: { $search: req.query.search } });
 	}
 	if (res.user) {
 		q.options = ({ user: res.user });
@@ -164,7 +164,7 @@ const actionGet = async (req, res) => {
 			} else {
 				q.populate(req.query.populate);
 			}
-			result.populate = req.query.populate;	
+			result.populate = req.query.populate;
 		}
 		if (req.query.autopopulate) {
 			for (let key in req.Model.schema.paths) {
@@ -189,7 +189,7 @@ const actionGet = async (req, res) => {
 		result.data = await q.exec();
 		res.result = result;
 		if (debug) console.timeEnd(opname);
-	} catch(err) {
+	} catch (err) {
 		console.error(new Date(), err);
 		if (debug) console.timeEnd(opname);
 		if (err.code) throw err;
@@ -204,7 +204,7 @@ const actionGetOne = async (req, res) => {
 		const data = await getOne(req.Model, req.params.item_id, req.query, { user: res.user });
 		res.result = { data };
 		if (debug) console.timeEnd(opname);
-	} catch(err) {
+	} catch (err) {
 		console.error(new Date(), err);
 		if (debug) console.timeEnd(opname);
 		if (err.code) throw err;
@@ -262,7 +262,7 @@ const actionPut = async (req, res) => {
 		let silence = req.params._silence;
 		if (req.body && req.body._silence) silence = true;
 		if (!silence) {
-			req.config.callbacks.put.call(null, req.modelname, item, res.user );
+			req.config.callbacks.put.call(null, req.modelname, item, res.user);
 			ws.putHook.call(null, req.modelname, item, res.user);
 		}
 		res.json({
@@ -283,12 +283,12 @@ const actionUpdate = async (req, res) => {
 	const opname = `update ${req.modelname}/${req.params.item_id} ${ops++}`;
 	console.time(opname);
 	try {
-		let body_data =  datamunging.deserialize(req.body);
+		let body_data = datamunging.deserialize(req.body);
 		const data = await req.Model.update({ _id: req.params.item_id }, body_data);
 		let silence = req.params._silence;
 		if (req.body && req.body._silence) silence = true;
 		if (!silence) {
-			req.config.callbacks.put.call(null, req.modelname, data, res.user );
+			req.config.callbacks.put.call(null, req.modelname, data, res.user);
 			ws.putHook.call(null, req.modelname, data, res.user);
 		}
 		res.json({
@@ -370,10 +370,10 @@ const actionDelete = async (req, res) => {
 		}
 		res.json({
 			status: "ok",
-			message: `${req.modelname}/${ req.params.item_id } deleted`
+			message: `${req.modelname}/${req.params.item_id} deleted`
 		});
 		if (debug) console.timeEnd(opname);
-	} catch(err) {
+	} catch (err) {
 		console.error(new Date(), err);
 		if (debug) console.timeEnd(opname);
 		if (err.code) throw err;
@@ -384,7 +384,7 @@ const actionDelete = async (req, res) => {
 const actionCount = async (req, res) => {
 	const opname = `count ${req.modelname} ${ops++}`;
 	console.time(opname);
-	const parseSearch = function(search) {
+	const parseSearch = function (search) {
 		let result = {};
 		for (let i in search) {
 			result[i] = new RegExp(search[i], "i");
@@ -409,7 +409,7 @@ const actionCount = async (req, res) => {
 		const count = await req.Model.countDocuments(filters).exec();
 		res.result = { count };
 		if (debug) console.timeEnd(opname);
-	} catch(err) {
+	} catch (err) {
 		console.error(new Date(), err);
 		if (debug) console.timeEnd(opname);
 		if (err.code) throw err;
@@ -424,7 +424,7 @@ const actionCall = async (req, res) => {
 	try {
 		const result = await req.Model[req.params.method_name](req.body);
 		res.json(result);
-	} catch(err) {
+	} catch (err) {
 		console.error(new Date(), err);
 		if (err.code) throw err;
 		throw new errors.InternalServerError(err.toString());
@@ -440,7 +440,7 @@ const actionCallItem = async (req, res) => {
 		req.params.__user = res.user || null;
 		const result = await req.Model[req.params.method_name](item);
 		res.json(result);
-	} catch(err) {
+	} catch (err) {
 		console.trace(err);
 		if (err.code) throw err;
 		throw new errors.InternalServerError(err.toString());
@@ -493,7 +493,7 @@ const actionQuery = async (req, res) => {
 			} else {
 				q.populate(req.query.populate);
 			}
-			result.populate = req.query.populate;	
+			result.populate = req.query.populate;
 		}
 		if (req.query.autopopulate) {
 			for (let key in req.Model.schema.paths) {
@@ -516,7 +516,7 @@ const actionQuery = async (req, res) => {
 		res.result = result;
 		if (debug) console.timeEnd(opname);
 		res.json(result);
-	} catch(err) {
+	} catch (err) {
 		console.error(new Date(), err);
 		if (debug) console.timeEnd(opname);
 		if (err.code) throw err;
@@ -611,7 +611,7 @@ const actionBulkWrite = async (req, res) => {
 const getOne = async (Model, item_id, params, options) => {
 	const query = Model.findById(item_id, {}, options);
 	if (params.populate) {
-		if ((typeof params.populate === "object")  && !Array.isArray(params.populate)) {
+		if ((typeof params.populate === "object") && !Array.isArray(params.populate)) {
 			for (let i in params.populate) {
 				query.populate(i, params.populate[i].replace(/,/g, " "));
 			}
@@ -641,56 +641,71 @@ const getOne = async (Model, item_id, params, options) => {
 		//Don't ever return passwords
 		delete item.password;
 		return item;
-	} catch(err) {
+	} catch (err) {
 		console.error(err);
 		if (err.code) throw err;
 		throw new errors.InternalServerError(err.toString());
 	}
 };
 
-const parseFilter = (filter) => {
-	if (!filter)
-		return {};
-	if (typeof filter == "object") {
-		Object.keys(filter).forEach(function(key) {
-			var val = filter[key];
-			if (filter[key] === "false") filter[key] = false;
-			if (filter[key] === "true") filter[key] = true;
-			if (val.indexOf) {
-				if (val.indexOf(":") !== -1) {
-					let tmp = val.split(":");
-					filter[key] = {};
-					let tmpkey = tmp.shift();
-					let tmpval = tmp.join(":");
-					if ((tmpval[0] === "[") && (tmpval[tmpval.length - 1] === "]")) { // Could be an array for a $in or similar
-						let arr = tmpval.slice(1, tmpval.length - 1).split(",");
-						tmpval = arr;
-					}
-					filter[key][tmpkey] = tmpval;
-					if (tmpkey === "$regex" && tmpval[0] === "/") {
-						let match = tmpval.match(new RegExp('^/(.*?)/([gimy]*)$'));
+const parseFilter = (filter, depth = 0) => {
+	const MAX_DEPTH = 10; // Prevent infinite recursion
+
+	if (!filter) return {};
+	if (depth > MAX_DEPTH) {
+		console.warn('Maximum filter depth exceeded');
+		return filter;
+	}
+
+	if (typeof filter !== "object" || filter === null) return filter;
+
+	Object.keys(filter).forEach(function (key) {
+		var val = filter[key];
+		if (filter[key] === "false") filter[key] = false;
+		if (filter[key] === "true") filter[key] = true;
+		if (val && val.indexOf) {
+			if (val.indexOf(":") !== -1) {
+				let tmp = val.split(":");
+				filter[key] = {};
+				let tmpkey = tmp.shift();
+				let tmpval = tmp.join(":");
+				if ((tmpval[0] === "[") && (tmpval[tmpval.length - 1] === "]")) {
+					let arr = tmpval.slice(1, tmpval.length - 1).split(",");
+					tmpval = arr;
+				}
+				filter[key][tmpkey] = tmpval;
+				if (tmpkey === "$regex" && tmpval[0] === "/") {
+					let match = tmpval.match(new RegExp('^/(.*?)/([gimy]*)$'));
+					if (match) {
 						let regex = new RegExp(match[1], match[2]);
 						filter[key][tmpkey] = regex;
 					}
 				}
-				if (typeof val == "object") {
-					let result = parseFilter(val);
+			}
+			if (typeof val == "object") {
+				let result = parseFilter(val, depth + 1);
+				if (result && typeof result === 'object') {
 					filter[key] = {};
-					for (let x = 0; x < result.length; x++) {
-						filter[key][Object.keys(result[x])[0]] =
-							result[x][Object.keys(result[x])[0]];
-					}
+					Object.keys(result).forEach(resultKey => {
+						filter[key][resultKey] = result[resultKey];
+					});
 				}
 			}
-		});
-	}
+		}
+	});
 	return filter;
 }
 
 const _deSerialize = (data) => {
 	function assign(obj, keyPath, value) {
-		// http://stackoverflow.com/questions/5484673/javascript-how-to-dynamically-create-nested-objects-using-object-names-given-by
+		const MAX_DEPTH = 20; // Prevent excessive nesting
 		const lastKeyIndex = keyPath.length - 1;
+
+		if (lastKeyIndex >= MAX_DEPTH) {
+			console.warn('Maximum nesting depth exceeded in _deSerialize');
+			return;
+		}
+
 		for (let i = 0; i < lastKeyIndex; ++i) {
 			let key = keyPath[i];
 			if (!(key in obj)) obj[key] = {};
@@ -698,10 +713,13 @@ const _deSerialize = (data) => {
 		}
 		obj[keyPath[lastKeyIndex]] = value;
 	}
+
+	if (!data || typeof data !== 'object') return;
+
 	for (let datum in data) {
 		const matches = datum.match(/\[(.+?)\]/g);
 		if (matches) {
-			const params = matches.map(function(match) {
+			const params = matches.map(function (match) {
 				return match.replace(/[[\]]/g, "");
 			});
 			if (isNaN(params[0])) {
@@ -765,7 +783,7 @@ const changeUrlParams = (req, key, val) => {
 	return req.config.url + req.path() + "?" + querystring.stringify(q);
 };
 
-const JXP = function(options) {
+const JXP = function (options) {
 	const server = restify.createServer();
 	const model_dir = options.model_dir || modeldir.findModelDir(path.dirname(process.argv[1]));
 	//Set up config with default
@@ -773,12 +791,12 @@ const JXP = function(options) {
 		model_dir: path.join(model_dir),
 		mongo: options.mongo,
 		callbacks: {
-			put: function() {},
-			post: function() {},
-			delete: function() {},
-			get: function() {},
-			getOne: function() {},
-			update: function() {},
+			put: function () { },
+			post: function () { },
+			delete: function () { },
+			get: function () { },
+			getOne: function () { },
+			update: function () { },
 		},
 		log: "access.log",
 		pre_hooks: {
@@ -841,13 +859,13 @@ const JXP = function(options) {
 	global.apikey = config.apikey;
 	global.server = config.server;
 	global.model_dir = model_dir;
-	
+
 	// Pre-load models
 	var files = fs.readdirSync(config.model_dir);
-	let modelnames = files.filter(function(fname) {
+	let modelnames = files.filter(function (fname) {
 		return fname.indexOf("_model.js") !== -1;
 	});
-	modelnames.forEach(function(fname) {
+	modelnames.forEach(function (fname) {
 		var modelname = fname.replace("_model.js", "");
 		models[modelname] = require(path.join(config.model_dir, fname));
 	});
@@ -856,9 +874,9 @@ const JXP = function(options) {
 	security.init(config);
 	login.init(config);
 	groups.init(config);
-	ws.init({models});
+	ws.init({ models });
 	cache.init(config);
-	const docs = new Docs({config, models});
+	const docs = new Docs({ config, models });
 
 	// Set up our API server
 
@@ -877,7 +895,7 @@ const JXP = function(options) {
 	const cors = corsMiddleware({
 		preflightMaxAge: 5, //Optional
 		origins: ['*'],
-		allowHeaders: ['X-Requested-With','Authorization'],
+		allowHeaders: ['X-Requested-With', 'Authorization'],
 		exposeHeaders: ['Authorization']
 	});
 

package/libs/schema_description.js

@@ -1,40 +1,87 @@
 const fs = require("fs");
 const path = require("path");
+const mongoose = require("mongoose");
 
 const getModelFileContents = (model_dir) => {
     return new Promise((resolve, reject) => {
         try {
-            fs.readdir(model_dir, function(err, files) {
+            fs.readdir(model_dir, function (err, files) {
                 if (err) {
                     return reject(err);
                 }
+
+                // Filter for only model files first
+                const modelFiles = files.filter(file =>
+                    file.endsWith('_model.js') &&
+                    fs.statSync(path.join(model_dir, file)).isFile()
+                );
+
+                // Limit number of files processed at once
+                const MAX_FILES = 1000;
+                if (modelFiles.length > MAX_FILES) {
+                    return reject(new Error(`Too many model files (${modelFiles.length}). Maximum allowed is ${MAX_FILES}`));
+                }
+
                 let models = [];
-                for (const file of files) {
+                let errors = [];
+
+                for (const file of modelFiles) {
                     const modelname = path.basename(file, ".js").replace("_model", "");
                     try {
-                        const modelobj = require(path.join(model_dir, file));
-                        if (
-                            modelobj.schema &&
-                            modelobj.schema.get("_perms") &&
-                            (modelobj.schema.get("_perms").admin ||
-                                modelobj.schema.get("_perms").user ||
-                                modelobj.schema.get("_perms").owner ||
-                                modelobj.schema.get("_perms").all)
-                        ) {
-                            let model = {
-                                model: modelname,
-                                file: file,
-                                perms: modelobj.schema.get("_perms")
-                            };
-                            models.push(model);
+                        // Try to get the model from mongoose first
+                        let modelobj;
+                        try {
+                            // Convert modelname to proper case for mongoose (first letter uppercase)
+                            const modelKey = modelname.charAt(0).toUpperCase() + modelname.slice(1);
+                            modelobj = mongoose.models[modelKey];
+
+                            // If model doesn't exist in mongoose, try to load it from file
+                            if (!modelobj) {
+                                const filePath = path.join(model_dir, file);
+                                delete require.cache[require.resolve(filePath)];
+                                modelobj = require(filePath);
+                            }
+                        } catch (e) {
+                            // If getting from mongoose fails, try loading from file
+                            const filePath = path.join(model_dir, file);
+                            delete require.cache[require.resolve(filePath)];
+                            modelobj = require(filePath);
+                        }
+
+                        // Check if we have a valid model with schema and permissions
+                        if (modelobj && modelobj.schema) {
+                            const perms = modelobj.schema.get("_perms");
+                            if (perms && (perms.admin || perms.user || perms.owner || perms.all)) {
+                                models.push({
+                                    model: modelname,
+                                    file: file,
+                                    perms: perms
+                                });
+                                continue; // Skip error handling if successful
+                            }
                         }
+
+                        // If we get here, the model was loaded but didn't have proper schema/perms
+                        errors.push(`Invalid model structure for ${modelname}`);
+
                     } catch (error) {
-                        console.error("Error with model " + modelname, error);
+                        // Only add to errors if it's not an OverwriteModelError
+                        if (!error.message.includes('Cannot overwrite')) {
+                            errors.push(`Error with model ${modelname}: ${error.message}`);
+                            console.error(`Error processing model ${modelname}:`, error);
+                        }
                     }
                 }
+
+                // If we have errors but also some valid models, just log the errors
+                if (errors.length > 0 && models.length > 0) {
+                    console.warn('Some models failed to load:', errors);
+                }
+
+                // Return empty array if no models found, but don't treat it as an error
                 return resolve(models);
             });
-        } catch(err) {
+        } catch (err) {
             return reject(err);
         }
     });

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "jxp",
   "description:": "An opinionated RESTful API library based on Mongoose and Restify. Make an API by just writing Mongoose models.",
-  "version": "2.14.6",
+  "version": "2.15.0",
   "private": false,
   "main": "libs/jxp.js",
   "scripts": {
@@ -29,12 +29,12 @@
     "url": "https://github.com/WorkSpaceMan/jxp/issues"
   },
   "dependencies": {
-    "axios": "^1.6.5",
-    "bcryptjs": "^2.4.3",
-    "commander": "^11.1.0",
-    "config": "^3.3.10",
-    "dotenv": "^16.4.0",
-    "glob": "10.3.10",
+    "axios": "^1.8.4",
+    "bcryptjs": "^3.0.2",
+    "commander": "^13.1.0",
+    "config": "^3.3.12",
+    "dotenv": "^16.4.7",
+    "glob": "11.0.1",
     "js-yaml": "4.1.0",
     "json2csv": "^5.0.7",
     "jsonwebtoken": "^9.0.2",
@@ -46,22 +46,22 @@
     "mongoose-friendly": "^0.1.4",
     "morgan": "^1.10.0",
     "node-cache": "^5.1.2",
-    "nodemailer": "^6.9.8",
+    "nodemailer": "^6.10.0",
     "nodemailer-smtp-transport": "^2.7.4",
     "path": "^0.12.7",
-    "pug": "^3.0.2",
+    "pug": "^3.0.3",
     "querystring": "^0.2.1",
     "rand-token": "^1.0.1",
     "readline-sync": "^1.4.10",
     "restify": "^11.1.0",
     "restify-cors-middleware2": "^2.2.1",
     "restify-errors": "^8.0.2",
-    "traverse": "^0.6.8",
-    "underscore": "^1.13.6",
-    "ws": "^8.16.0"
+    "traverse": "^0.6.11",
+    "underscore": "^1.13.7",
+    "ws": "^8.18.1"
   },
   "devDependencies": {
-    "chai": "^4.3.7",
+    "chai": "^4.3.10",
     "chai-http": "^4.4.0",
     "mocha": "^10.2.0",
     "moment": "^2.29.4",

package/templates/model.pug

@@ -36,21 +36,40 @@ block content
                 th Default
                 th Indexed?
                 th Unique?
+                th Required?
         tbody
             each fieldname in fields
-                - let field = model.schema.paths[fieldname]
+                - let field = safeFields[fieldname]
                 if (field.path)
                     tr
                         td= field.path
-                        td= field.instance
+                        td
+                            if field.arrayType
+                                | Array of #{field.arrayType}
+                            else
+                                = field.instance
                         td= field.options.link
                         td= field.options.map_to
                         td= field.defaultValue
                         td= (field.options.index) ? "x" : ""
                         td= (field.options.unique) ? "x" : ""
+                        td= field.isRequired ? "x" : ""
     hr
-    h1 Raw definition
+    h2 Field Details
     each fieldname in fields
-        - let field = model.schema.paths[fieldname]
-        pre.pre= JSON.stringify(field, null, "\t")
+        - let field = safeFields[fieldname]
+        if field
+            .field-details
+                h3= field.path
+                pre.pre= JSON.stringify(field, null, 2)
+                if field.schema
+                    h4 Nested Schema
+                    ul
+                        each nestedField in field.schema
+                            li #{nestedField.path}: #{nestedField.type}
+                if field.validators && field.validators.length
+                    h4 Validators
+                    ul
+                        each validator in field.validators
+                            li #{validator.type}: #{validator.message}