vanta-api 1.0.4 → 1.1.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "vanta-api",
-  "version": "1.0.4",
+  "version": "1.1.0",
   "description": "Advanced API features and security configuration for Node.js/MongoDB.",
   "main": "index.js",
   "scripts": {

package/src/api-features.js

@@ -1,10 +1,8 @@
-// api-features.js
 import mongoose from "mongoose";
 import winston from "winston";
 import { securityConfig } from "./config.js";
 import HandleERROR from "./handleError.js";
 
-// تنظیم logger با winston
 const logger = winston.createLogger({
   level: "info",
   format: winston.format.combine(
@@ -22,7 +20,6 @@ export class ApiFeatures {
     this.pipeline = [];
     this.countPipeline = [];
     this.manualFilters = {};
-    // انتخاب استفاده از cursor برای پردازش داده‌های حجیم
     this.useCursor = false;
     this.#initialSanitization();
   }
@@ -34,7 +31,6 @@ export class ApiFeatures {
     const safeFilters = this.#applySecurityFilters(mergedFilters);
 
     if (Object.keys(safeFilters).length > 0) {
-      // اضافه کردن فیلتر به ابتدای pipeline جهت بهبود عملکرد
       this.pipeline.push({ $match: safeFilters });
       this.countPipeline.push({ $match: safeFilters });
     }
@@ -138,11 +134,11 @@ export class ApiFeatures {
         lookupStage = {
           $lookup: {
             from: collection,
-            let: { localField: `$${field}` },
+            let: { localId: `$${field}` },
             pipeline: [
               {
                 $match: {
-                  $expr: { $eq: ["$_id", "$$localField"] }
+                  $expr: { $eq: ["$_id", "$$localId"] }
                 }
               },
               { $project: projection }
@@ -170,8 +166,6 @@ export class ApiFeatures {
       });
     });
   
-    // پشتیبانی از nested populate: در صورت نیاز، منطق تو در تو را می‌توانید اینجا اضافه کنید.
-  
     return this;
   }
   
@@ -184,11 +178,9 @@ export class ApiFeatures {
 
   async execute(options = {}) {
     try {
-      // انتخاب حالت cursor در مواقع پردازش داده‌های حجیم
       if (options.useCursor === true) {
         this.useCursor = true;
       }
-      // اجرای موازی pipeline‌های شمارش و داده
       const [countResult, dataResult] = await Promise.all([
         this.Model.aggregate([...this.countPipeline, { $count: "total" }]),
         (this.useCursor
@@ -258,7 +250,22 @@ export class ApiFeatures {
 
   #sanitizeNestedObjects(obj) {
     return Object.entries(obj).reduce((acc, [key, value]) => {
-      if (typeof value === "object" && !Array.isArray(value)) {
+      // Handle ObjectId fields with nested operators
+      if (key.endsWith("Id") && typeof value === "object" && !Array.isArray(value)) {
+        const sanitizedObj = {};
+        for (const [op, val] of Object.entries(value)) {
+          if (["$eq", "$ne", "$gt", "$gte", "$lt", "$lte"].includes(op) && mongoose.isValidObjectId(val)) {
+            sanitizedObj[op] = new mongoose.Types.ObjectId(val);
+          } else if (["$in", "$nin"].includes(op) && Array.isArray(val)) {
+            sanitizedObj[op] = val
+              .filter(v => mongoose.isValidObjectId(v))
+              .map(v => new mongoose.Types.ObjectId(v));
+          } else {
+            sanitizedObj[op] = val;
+          }
+        }
+        acc[key] = sanitizedObj;
+      } else if (typeof value === "object" && !Array.isArray(value)) {
         acc[key] = this.#sanitizeNestedObjects(value);
       } else {
         acc[key] = this.#sanitizeValue(key, value);
@@ -274,7 +281,7 @@ export class ApiFeatures {
     if (typeof value === "string") {
       if (value === "true") return true;
       if (value === "false") return false;
-      if (/^\d+$/.test(value)) return parseInt(value);
+      if (/^\d+$/.test(value)) return parseInt(value, 10);
     }
     return value;
   }
@@ -285,13 +292,8 @@ export class ApiFeatures {
       throw new HandleERROR(`Invalid populate field: ${field}`, 400);
     }
 
-    const refModel = mongoose.model(schemaPath.options.ref);
-    if (refModel.schema.options.restricted && this.userRole !== "admin") {
-      throw new HandleERROR(`Unauthorized to populate ${field}`, 403);
-    }
-
     return {
-      collection: refModel.collection.name,
+      collection:  schemaPath.options.ref.toLowerCase()+'s',
       isArray: schemaPath.instance === "Array"
     };
   }
@@ -303,4 +305,4 @@ export class ApiFeatures {
   }
 }
 
-export default ApiFeatures;
+export default ApiFeatures;