vanta-api 1.1.6 → 1.1.8

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "vanta-api",
-  "version": "1.1.6",
+  "version": "1.1.8",
   "description": "Advanced API features and security configuration for Node.js/MongoDB.",
   "main": "index.js",
   "scripts": {
@@ -19,6 +19,7 @@
   "author": "Alireza Aghaee",
   "license": "MIT",
   "dependencies": {
+    "bson": "^6.10.3",
     "mongoose": "^7.0.0",
     "pluralize": "^8.0.0",
     "winston": "^3.0.0"

package/src/api-features.js

@@ -33,8 +33,10 @@ export class ApiFeatures {
   filter() {
     // Parse and sanitize both query and manual filters
     const queryFilters = this._parseQueryFilters();
-    const manual = this._sanitizeFilters(this.manualFilters);
-    const merged = { ...queryFilters, ...manual };
+    const merged = this._sanitizeFilters({
+      ...queryFilters,
+      ...this.manualFilters,
+    });
     const safe = this._applySecurityFilters(merged);
 
     if (Object.keys(safe).length) {
@@ -117,7 +119,7 @@ export class ApiFeatures {
 
     // Apply lookups
     for (const opt of final) {
-      const field = typeof opt === 'string' ? opt.toLowerCase() : opt.path.toLowerCase();
+      const field = typeof opt === "string" ? opt : opt.path;
       const proj =
         typeof opt === "object" && opt.select
           ? opt.select.split(" ").reduce((a, f) => {
@@ -215,54 +217,89 @@ export class ApiFeatures {
     });
   }
 
-_parseQueryFilters() {
-  const obj = { ...this.query };
-  // پاک کردن پارامترهای سیستماتیک
-  ["page", "limit", "sort", "fields", "populate"].forEach(k => delete obj[k]);
-
-  const out = {};
-
-  for (const [rawKey, rawVal] of Object.entries(obj)) {
-    if (typeof rawVal === 'object' && !Array.isArray(rawVal)) {
-      out[rawKey] = {};
-      for (let [op, val] of Object.entries(rawVal)) {
-        const cleanOp = op.replace(/^\$/, '');
-        if (securityConfig.allowedOperators.includes(cleanOp)) {
-          const v = /^[0-9]+$/.test(val) ? parseInt(val, 10) : val;
-          out[rawKey][`$${cleanOp}`] = v;
+  _parseQueryFilters() {
+    const obj = { ...this.query };
+    // پاک کردن پارامترهای سیستماتیک
+    ["page", "limit", "sort", "fields", "populate"].forEach(
+      (k) => delete obj[k]
+    );
+
+    const out = {};
+
+    for (const [rawKey, rawVal] of Object.entries(obj)) {
+      if (typeof rawVal === "object" && !Array.isArray(rawVal)) {
+        out[rawKey] = {};
+        for (let [op, val] of Object.entries(rawVal)) {
+          const cleanOp = op.replace(/^\$/, "");
+          if (securityConfig.allowedOperators.includes(cleanOp)) {
+            const v = /^[0-9]+$/.test(val) ? parseInt(val, 10) : val;
+            out[rawKey][`$${cleanOp}`] = v;
+          }
+        }
+      } else if (/^\w+\[\$?\w+\]$/.test(rawKey)) {
+        const [, field, op] = rawKey.match(/^(\w+)\[\$?(\w+)\]$/);
+        if (securityConfig.allowedOperators.includes(op)) {
+          const v = /^[0-9]+$/.test(rawVal) ? parseInt(rawVal, 10) : rawVal;
+          out[field] = { [`$${op}`]: v };
         }
-      }
-    }
-    else if (/^\w+\[\$?\w+\]$/.test(rawKey)) {
-      const [, field, op] = rawKey.match(/^(\w+)\[\$?(\w+)\]$/);
-      if (securityConfig.allowedOperators.includes(op)) {
-        const v = /^[0-9]+$/.test(rawVal) ? parseInt(rawVal, 10) : rawVal;
-        out[field] = { [`$${op}`]: v };
-      }
-    }
-    else {
-      if (typeof rawVal === "string" && rawVal.includes(",")) {
-        out[rawKey] = rawVal.split(",");
       } else {
-        out[rawKey] = rawVal;
+        if (typeof rawVal === "string" && rawVal.includes(",")) {
+          out[rawKey] = rawVal.split(",");
+        } else {
+          out[rawKey] = rawVal;
+        }
       }
     }
-  }
-
-  return out;
-}
 
+    return out;
+  }
 
   _sanitizeFilters(filters) {
-    // Simple deep clone with ObjectId and boolean parsing
-    return JSON.parse(JSON.stringify(filters), (key, val) => {
-      if (key.endsWith("Id") && mongoose.isValidObjectId(val))
-        return new mongoose.Types.ObjectId(val);
-      if (val === "true") return true;
-      if (val === "false") return false;
-      if (/^[0-9]+$/.test(val)) return parseInt(val, 10);
-      return val;
+    const resultObj = {};
+    const resualt = Object.entries(filters).map((el) => {
+      const [keyObj, val] = el;
+      if (
+        typeof val === "object" &&
+        (this.#isStrictObjectId(val["$eq"]) ||
+          this.#isStrictObjectId(val["eq"]))
+      ) {
+        const newVal = { ...val };
+        if (this.#isStrictObjectId(val["$eq"])) {
+          newVal["$eq"] = new ObjectId(val["$eq"]);
+        }
+        if (this.#isStrictObjectId(val["eq"])) {
+          newVal["eq"] = new ObjectId(val["eq"]);
+        }
+        resultObj[keyObj] = newVal;
+        return;
+      }
+      if (val === "true") {
+        resultObj[keyObj] = true;
+        return;
+      }
+      if (val === "false") {
+        resultObj[keyObj] = false;
+        return;
+      }
+      if (typeof val === "string" && /^[0-9]+$/.test(val)) {
+        resultObj[keyObj] = parseInt(val, 10);
+        return;
+      }
+      if (typeof val === "string" && this.#isStrictObjectId(val)) {
+        resultObj[keyObj] = new ObjectId(val);
+        return;
+      }
+      resultObj[keyObj] = val;
     });
+    return resultObj;
+  }
+
+  #isStrictObjectId(id) {
+    return (
+      typeof id === "string" &&
+      mongoose.Types.ObjectId.isValid(id) &&
+      new mongoose.Types.ObjectId(id).toString() === id
+    );
   }
 
   _applySecurityFilters(filters) {