vanta-api 1.1.5 → 1.1.6

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "vanta-api",
-  "version": "1.1.5",
+  "version": "1.1.6",
   "description": "Advanced API features and security configuration for Node.js/MongoDB.",
   "main": "index.js",
   "scripts": {

package/src/api-features.js

@@ -215,24 +215,44 @@ export class ApiFeatures {
     });
   }
 
-  _parseQueryFilters() {
-    const obj = { ...this.query };
-    ["page", "limit", "sort", "fields", "populate"].forEach(
-      (k) => delete obj[k]
-    );
-
-    // Whitelist operators
-    const out = {};
-    for (const [k, v] of Object.entries(obj)) {
-      if (["or", "and"].includes(k)) {
-        out[`$${k}`] = Array.isArray(v) ? v : [v];
+_parseQueryFilters() {
+  const obj = { ...this.query };
+  // پاک کردن پارامترهای سیستماتیک
+  ["page", "limit", "sort", "fields", "populate"].forEach(k => delete obj[k]);
+
+  const out = {};
+
+  for (const [rawKey, rawVal] of Object.entries(obj)) {
+    if (typeof rawVal === 'object' && !Array.isArray(rawVal)) {
+      out[rawKey] = {};
+      for (let [op, val] of Object.entries(rawVal)) {
+        const cleanOp = op.replace(/^\$/, '');
+        if (securityConfig.allowedOperators.includes(cleanOp)) {
+          const v = /^[0-9]+$/.test(val) ? parseInt(val, 10) : val;
+          out[rawKey][`$${cleanOp}`] = v;
+        }
+      }
+    }
+    else if (/^\w+\[\$?\w+\]$/.test(rawKey)) {
+      const [, field, op] = rawKey.match(/^(\w+)\[\$?(\w+)\]$/);
+      if (securityConfig.allowedOperators.includes(op)) {
+        const v = /^[0-9]+$/.test(rawVal) ? parseInt(rawVal, 10) : rawVal;
+        out[field] = { [`$${op}`]: v };
+      }
+    }
+    else {
+      if (typeof rawVal === "string" && rawVal.includes(",")) {
+        out[rawKey] = rawVal.split(",");
       } else {
-        out[k] = typeof v === "string" && v.includes(",") ? v.split(",") : v;
+        out[rawKey] = rawVal;
       }
     }
-    return out;
   }
 
+  return out;
+}
+
+
   _sanitizeFilters(filters) {
     // Simple deep clone with ObjectId and boolean parsing
     return JSON.parse(JSON.stringify(filters), (key, val) => {

package/src/config.js

@@ -8,7 +8,6 @@ try {
   const userPath = path.resolve(process.cwd(), "security-config.js");
   userConfig = (await import(userPath))?.securityConfig || {};
 } catch (err) {
-  // کاربر security-config نداشت، مشکلی نیست
 }
 
 export const securityConfig = {