vanta-api 1.0.5 → 1.1.1

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "vanta-api",
-  "version": "1.0.5",
+  "version": "1.1.1",
   "description": "Advanced API features and security configuration for Node.js/MongoDB.",
   "main": "index.js",
   "scripts": {

package/src/api-features.js

@@ -3,14 +3,13 @@ import winston from "winston";
 import { securityConfig } from "./config.js";
 import HandleERROR from "./handleError.js";
 
-// تنظیم logger با winston
 const logger = winston.createLogger({
   level: "info",
   format: winston.format.combine(
     winston.format.timestamp(),
     winston.format.json()
   ),
-  transports: [new winston.transports.Console()]
+  transports: [new winston.transports.Console()],
 });
 
 export class ApiFeatures {
@@ -21,7 +20,6 @@ export class ApiFeatures {
     this.pipeline = [];
     this.countPipeline = [];
     this.manualFilters = {};
-    // انتخاب استفاده از cursor برای پردازش داده‌های حجیم
     this.useCursor = false;
     this.#initialSanitization();
   }
@@ -33,7 +31,6 @@ export class ApiFeatures {
     const safeFilters = this.#applySecurityFilters(mergedFilters);
 
     if (Object.keys(safeFilters).length > 0) {
-      // اضافه کردن فیلتر به ابتدای pipeline جهت بهبود عملکرد
       this.pipeline.push({ $match: safeFilters });
       this.countPipeline.push({ $match: safeFilters });
     }
@@ -58,7 +55,7 @@ export class ApiFeatures {
     if (this.query.fields) {
       const allowedFields = this.query.fields
         .split(",")
-        .filter(f => !securityConfig.forbiddenFields.includes(f))
+        .filter((f) => !securityConfig.forbiddenFields.includes(f))
         .reduce((acc, curr) => ({ ...acc, [curr]: 1 }), {});
 
       this.pipeline.push({ $project: allowedFields });
@@ -67,25 +64,21 @@ export class ApiFeatures {
   }
 
   paginate() {
-    const { maxLimit } = securityConfig.accessLevels[this.userRole] || { maxLimit: 100 };
+    const { maxLimit } = securityConfig.accessLevels[this.userRole] || {
+      maxLimit: 100,
+    };
     const page = Math.max(parseInt(this.query.page, 10) || 1, 1);
-    const limit = Math.min(
-      parseInt(this.query.limit, 10) || 10,
-      maxLimit
-    );
-    
-    this.pipeline.push(
-      { $skip: (page - 1) * limit },
-      { $limit: limit }
-    );
+    const limit = Math.min(parseInt(this.query.limit, 10) || 10, maxLimit);
+
+    this.pipeline.push({ $skip: (page - 1) * limit }, { $limit: limit });
     return this;
   }
 
   populate(input = "") {
     let populateOptions = [];
-  
+
     if (Array.isArray(input)) {
-      input.forEach(item => {
+      input.forEach((item) => {
         if (typeof item === "object" && item.path) {
           populateOptions.push(item);
         } else if (typeof item === "string") {
@@ -95,19 +88,25 @@ export class ApiFeatures {
     } else if (typeof input === "object" && input.path) {
       populateOptions.push(input);
     } else if (typeof input === "string" && input.trim().length > 0) {
-      input.split(",").filter(Boolean).forEach(item => {
-        populateOptions.push(item.trim());
-      });
+      input
+        .split(",")
+        .filter(Boolean)
+        .forEach((item) => {
+          populateOptions.push(item.trim());
+        });
     }
-  
+
     if (this.query.populate) {
-      this.query.populate.split(",").filter(Boolean).forEach(item => {
-        populateOptions.push(item.trim());
-      });
+      this.query.populate
+        .split(",")
+        .filter(Boolean)
+        .forEach((item) => {
+          populateOptions.push(item.trim());
+        });
     }
-  
+
     const uniqueMap = new Map();
-    populateOptions.forEach(item => {
+    populateOptions.forEach((item) => {
       if (typeof item === "object" && item.path) {
         uniqueMap.set(item.path, item);
       } else if (typeof item === "string") {
@@ -115,39 +114,40 @@ export class ApiFeatures {
       }
     });
     const uniquePopulateOptions = Array.from(uniqueMap.values());
-  
-    uniquePopulateOptions.forEach(option => {
-      let field, projection = {};
+
+    uniquePopulateOptions.forEach((option) => {
+      let field,
+        projection = {};
       if (typeof option === "object") {
         field = option.path;
         if (option.select) {
-          option.select.split(" ").forEach(fieldName => {
+          option.select.split(" ").forEach((fieldName) => {
             if (fieldName) projection[fieldName.trim()] = 1;
           });
         }
       } else if (typeof option === "string") {
         field = option;
       }
-  
+
       field = field.trim();
       const { collection, isArray } = this.#getCollectionInfo(field);
-  
+
       let lookupStage = {};
       if (Object.keys(projection).length > 0) {
         lookupStage = {
           $lookup: {
             from: collection,
-            let: { localField: `$${field}` },
+            let: { localId: `$${field}` },
             pipeline: [
               {
                 $match: {
-                  $expr: { $eq: ["$_id", "$$localField"] }
-                }
+                  $expr: { $eq: ["$_id", "$$localId"] },
+                },
               },
-              { $project: projection }
+              { $project: projection },
             ],
-            as: field
-          }
+            as: field,
+          },
         };
       } else {
         lookupStage = {
@@ -155,23 +155,23 @@ export class ApiFeatures {
             from: collection,
             localField: field,
             foreignField: "_id",
-            as: field
-          }
+            as: field,
+          },
         };
       }
-  
+
       this.pipeline.push(lookupStage);
       this.pipeline.push({
         $unwind: {
           path: `$${field}`,
-          preserveNullAndEmptyArrays: true
-        }
+          preserveNullAndEmptyArrays: true,
+        },
       });
     });
-  
+
     return this;
   }
-  
+
   addManualFilters(filters) {
     if (filters) {
       this.manualFilters = { ...this.manualFilters, ...filters };
@@ -186,12 +186,13 @@ export class ApiFeatures {
       }
       const [countResult, dataResult] = await Promise.all([
         this.Model.aggregate([...this.countPipeline, { $count: "total" }]),
-        (this.useCursor
-          ? this.Model.aggregate(this.pipeline).cursor({ batchSize: 100 }).exec()
+        this.useCursor
+          ? this.Model.aggregate(this.pipeline)
+              .cursor({ batchSize: 100 })
+              .exec()
           : this.Model.aggregate(this.pipeline)
               .allowDiskUse(options.allowDiskUse || false)
-              .readConcern("majority")
-        )
+              .readConcern("majority"),
       ]);
 
       const count = countResult[0]?.total || 0;
@@ -204,11 +205,11 @@ export class ApiFeatures {
       } else {
         data = dataResult;
       }
-      
+
       return {
         success: true,
         count,
-        data
+        data,
       };
     } catch (error) {
       this.#handleError(error);
@@ -217,11 +218,11 @@ export class ApiFeatures {
 
   // ---------- Security and Sanitization Methods ----------
   #initialSanitization() {
-    ["$where", "$accumulator", "$function"].forEach(op => {
+    ["$where", "$accumulator", "$function"].forEach((op) => {
       delete this.query[op];
       delete this.manualFilters[op];
     });
-    ["page", "limit"].forEach(field => {
+    ["page", "limit"].forEach((field) => {
       if (this.query[field] && !/^\d+$/.test(this.query[field])) {
         throw new HandleERROR(`Invalid value for ${field}`, 400);
       }
@@ -230,39 +231,50 @@ export class ApiFeatures {
 
   #parseQueryFilters() {
     const queryObj = { ...this.query };
-    ["page", "limit", "sort", "fields", "populate"].forEach(el => delete queryObj[el]);
+    ["page", "limit", "sort", "fields", "populate"].forEach(
+      (el) => delete queryObj[el]
+    );
 
     return JSON.parse(
-      JSON.stringify(queryObj)
-        .replace(/\b(gte|gt|lte|lt|in|nin|eq|ne|regex|exists|size)\b/g, "$$$&")
+      JSON.stringify(queryObj).replace(
+        /\b(gte|gt|lte|lt|in|nin|eq|ne|regex|exists|size)\b/g,
+        "$$$&"
+      )
     );
   }
 
   #applySecurityFilters(filters) {
     let result = { ...filters };
-  
-    securityConfig.forbiddenFields.forEach(field => delete result[field]);
-  
+
+    securityConfig.forbiddenFields.forEach((field) => delete result[field]);
+
     if (this.userRole !== "admin" && this.Model.schema.path("isActive")) {
       result.isActive = true;
       result = this.#sanitizeNestedObjects(result);
     }
-  
+
     return result;
   }
 
   #sanitizeNestedObjects(obj) {
     return Object.entries(obj).reduce((acc, [key, value]) => {
       // Handle ObjectId fields with nested operators
-      if (key.endsWith("Id") && typeof value === "object" && !Array.isArray(value)) {
+      if (
+        key.endsWith("Id") &&
+        typeof value === "object" &&
+        !Array.isArray(value)
+      ) {
         const sanitizedObj = {};
         for (const [op, val] of Object.entries(value)) {
-          if (["$eq", "$ne", "$gt", "$gte", "$lt", "$lte"].includes(op) && mongoose.isValidObjectId(val)) {
+          if (
+            ["$eq", "$ne", "$gt", "$gte", "$lt", "$lte"].includes(op) &&
+            mongoose.isValidObjectId(val)
+          ) {
             sanitizedObj[op] = new mongoose.Types.ObjectId(val);
           } else if (["$in", "$nin"].includes(op) && Array.isArray(val)) {
             sanitizedObj[op] = val
-              .filter(v => mongoose.isValidObjectId(v))
-              .map(v => new mongoose.Types.ObjectId(v));
+              .filter((v) => mongoose.isValidObjectId(v))
+              .map((v) => new mongoose.Types.ObjectId(v));
           } else {
             sanitizedObj[op] = val;
           }
@@ -289,26 +301,49 @@ export class ApiFeatures {
     return value;
   }
 
+  #isVowel(char) {
+    return ["a", "e", "i", "o", "u"].includes(char.toLowerCase());
+  }
+  #getCollectionName(modelName) {
+    const lowerName = modelName.toLowerCase();
+    const lastChar = lowerName.slice(-1);
+    const lastTwoChars = lowerName.slice(-2);
+
+    if (lastChar === "y") {
+      const secondLastChar = lowerName.slice(-2, -1);
+      if (!this.#isVowel(secondLastChar)) {
+        return lowerName.slice(0, -1) + "ies";
+      }
+    }
+
+    if (
+      lastTwoChars === "ch" ||
+      lastTwoChars === "sh" ||
+      lastChar === "s" ||
+      lastChar === "x" ||
+      lastChar === "z"
+    ) {
+      return lowerName + "es";
+    }
+
+    return lowerName + "s";
+  }
   #getCollectionInfo(field) {
     const schemaPath = this.Model.schema.path(field);
     if (!schemaPath?.options?.ref) {
       throw new HandleERROR(`Invalid populate field: ${field}`, 400);
     }
-
-    const refModel = mongoose.model(schemaPath.options.ref);
-    if (refModel.schema.options.restricted && this.userRole !== "admin") {
-      throw new HandleERROR(`Unauthorized to populate ${field}`, 403);
-    }
-
     return {
-      collection: refModel.collection.name,
-      isArray: schemaPath.instance === "Array"
+      collection: this.#getCollectionName(schemaPath?.options?.ref),
+      isArray: schemaPath.instance === "Array",
     };
   }
 
   #handleError(error) {
     // ثبت خطا در logger همراه با stack trace
-    logger.error(`[API Features Error]: ${error.message}`, { stack: error.stack });
+    logger.error(`[API Features Error]: ${error.message}`, {
+      stack: error.stack,
+    });
     throw error;
   }
 }