vanta-api 1.1.5 → 1.1.7

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "vanta-api",
-  "version": "1.1.5",
+  "version": "1.1.7",
   "description": "Advanced API features and security configuration for Node.js/MongoDB.",
   "main": "index.js",
   "scripts": {
@@ -19,6 +19,7 @@
   "author": "Alireza Aghaee",
   "license": "MIT",
   "dependencies": {
+    "bson": "^6.10.3",
     "mongoose": "^7.0.0",
     "pluralize": "^8.0.0",
     "winston": "^3.0.0"

package/src/api-features.js

@@ -117,7 +117,7 @@ export class ApiFeatures {
 
     // Apply lookups
     for (const opt of final) {
-      const field = typeof opt === 'string' ? opt.toLowerCase() : opt.path.toLowerCase();
+      const field = typeof opt === 'string' ? opt : opt.path;
       const proj =
         typeof opt === "object" && opt.select
           ? opt.select.split(" ").reduce((a, f) => {
@@ -215,35 +215,87 @@ export class ApiFeatures {
     });
   }
 
-  _parseQueryFilters() {
-    const obj = { ...this.query };
-    ["page", "limit", "sort", "fields", "populate"].forEach(
-      (k) => delete obj[k]
-    );
-
-    // Whitelist operators
-    const out = {};
-    for (const [k, v] of Object.entries(obj)) {
-      if (["or", "and"].includes(k)) {
-        out[`$${k}`] = Array.isArray(v) ? v : [v];
+_parseQueryFilters() {
+  const obj = { ...this.query };
+  // پاک کردن پارامترهای سیستماتیک
+  ["page", "limit", "sort", "fields", "populate"].forEach(k => delete obj[k]);
+
+  const out = {};
+
+  for (const [rawKey, rawVal] of Object.entries(obj)) {
+    if (typeof rawVal === 'object' && !Array.isArray(rawVal)) {
+      out[rawKey] = {};
+      for (let [op, val] of Object.entries(rawVal)) {
+        const cleanOp = op.replace(/^\$/, '');
+        if (securityConfig.allowedOperators.includes(cleanOp)) {
+          const v = /^[0-9]+$/.test(val) ? parseInt(val, 10) : val;
+          out[rawKey][`$${cleanOp}`] = v;
+        }
+      }
+    }
+    else if (/^\w+\[\$?\w+\]$/.test(rawKey)) {
+      const [, field, op] = rawKey.match(/^(\w+)\[\$?(\w+)\]$/);
+      if (securityConfig.allowedOperators.includes(op)) {
+        const v = /^[0-9]+$/.test(rawVal) ? parseInt(rawVal, 10) : rawVal;
+        out[field] = { [`$${op}`]: v };
+      }
+    }
+    else {
+      if (typeof rawVal === "string" && rawVal.includes(",")) {
+        out[rawKey] = rawVal.split(",");
       } else {
-        out[k] = typeof v === "string" && v.includes(",") ? v.split(",") : v;
+        out[rawKey] = rawVal;
       }
     }
-    return out;
   }
 
-  _sanitizeFilters(filters) {
-    // Simple deep clone with ObjectId and boolean parsing
+  return out;
+}
+
+
+   _sanitizeFilters(filters) {
     return JSON.parse(JSON.stringify(filters), (key, val) => {
-      if (key.endsWith("Id") && mongoose.isValidObjectId(val))
-        return new mongoose.Types.ObjectId(val);
+      // اگر val شیئی حاوی $eq یا eq باشد و آن فیلد ObjectId معتبر باشد
+      if (
+        typeof val === 'object' &&
+        val !== null &&
+        (this.#isStrictObjectId(val['$eq']) || this.#isStrictObjectId(val['eq']))
+      ) {
+        const newVal = { ...val };
+        if (this.#isStrictObjectId(val['$eq'])) {
+          newVal['$eq'] = new mongoose.Types.ObjectId(val['$eq']);
+        }
+        if (this.#isStrictObjectId(val['eq'])) {
+          newVal['eq'] = new mongoose.Types.ObjectId(val['eq']);
+        }
+        return newVal;
+      }
+
+      // تبدیل true/false
       if (val === "true") return true;
       if (val === "false") return false;
-      if (/^[0-9]+$/.test(val)) return parseInt(val, 10);
+
+      // تبدیل عدد صحیح
+      if (typeof val === 'string' && /^[0-9]+$/.test(val)) return parseInt(val, 10);
+
+      // اگر val یک رشته است و ObjectId معتبر باشد، به ObjectId تبدیل شود
+      if (
+        typeof val === 'string' &&
+        this.#isStrictObjectId(val)
+      ) {
+        return new mongoose.Types.ObjectId(val);
+      }
+
       return val;
     });
   }
+#isStrictObjectId(id) {
+  return (
+    typeof id === 'string' &&
+    mongoose.Types.ObjectId.isValid(id) &&
+    (new mongoose.Types.ObjectId(id)).toString() === id
+  );
+}
 
   _applySecurityFilters(filters) {
     let res = { ...filters };

package/src/config.js

@@ -8,7 +8,6 @@ try {
   const userPath = path.resolve(process.cwd(), "security-config.js");
   userConfig = (await import(userPath))?.securityConfig || {};
 } catch (err) {
-  // کاربر security-config نداشت، مشکلی نیست
 }
 
 export const securityConfig = {