vanta-api 1.2.5 → 1.2.6

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "vanta-api",
-  "version": "1.2.5",
+  "version": "1.2.6",
   "description": "Advanced API features and security configuration for Node.js/MongoDB.",
   "main": "index.js",
   "scripts": {

package/src/api-features.js

@@ -91,71 +91,71 @@ export class ApiFeatures {
     return this;
   }
 
-  populate(input = "") {
-    // Build list from input and query.populate
-    let list = [];
-    const raw = Array.isArray(input) ? input : [input];
-    if (this.query.populate) raw.push(...this.query.populate.split(","));
-
-    raw.forEach((item) => {
-      if (typeof item === "string" && item.trim()) list.push(item.trim());
-      else if (item?.path) list.push(item);
-    });
-
-    // Deduplicate
-    const map = new Map();
-    list.forEach((opt) => {
-      const key = typeof opt === "string" ? opt : opt.path;
-      map.set(key, opt);
-    });
+populate(input = "") {
+  let list = [];
+  const raw = Array.isArray(input) ? input : [input];
+  if (this.query.populate) raw.push(...this.query.populate.split(","));
+
+  raw.forEach((item) => {
+    if (typeof item === "string" && item.trim()) list.push(item.trim());
+    else if (item?.path) list.push(item);
+  });
+
+  const map = new Map();
+  list.forEach((opt) => {
+    const key = typeof opt === "string" ? opt : opt.path;
+    map.set(key, opt);
+  });
+
+  const allowed =
+    securityConfig.accessLevels[this.userRole]?.allowedPopulate || [];
+  const final = [];
+  map.forEach((opt, key) => {
+    if (allowed.includes("*") || allowed.includes(key)) final.push(opt);
+  });
+
+  for (const opt of final) {
+    const field = typeof opt === "string" ? opt : opt.path;
+    const proj =
+      typeof opt === "object" && opt.select
+        ? opt.select.split(" ").reduce((a, f) => {
+            a[f] = 1;
+            return a;
+          }, {})
+        : {};
+
+    const { collection, isArray } = this._getCollectionInfo(field);
+
+    const lookup =
+      proj && Object.keys(proj).length
+        ? {
+            from: collection,
+            let: { id: `$${field}` },
+            pipeline: [
+              { $match: { $expr: { $eq: ["$_id", "$$id"] } } },
+              { $project: proj },
+            ],
+            as: field,
+          }
+        : {
+            from: collection,
+            localField: field,
+            foreignField: "_id",
+            as: field,
+          };
 
-    // Enforce role-based populate
-    const allowed =
-      securityConfig.accessLevels[this.userRole]?.allowedPopulate || [];
-    const final = [];
-    map.forEach((opt, key) => {
-      if (allowed.includes("*") || allowed.includes(key)) final.push(opt);
-    });
+    this.pipeline.push({ $lookup: lookup });
 
-    // Apply lookups
-    for (const opt of final) {
-      const field = typeof opt === "string" ? opt : opt.path;
-      const proj =
-        typeof opt === "object" && opt.select
-          ? opt.select.split(" ").reduce((a, f) => {
-              a[f] = 1;
-              return a;
-            }, {})
-          : {};
-
-      const { collection } = this._getCollectionInfo(field);
-      const lookup =
-        proj && Object.keys(proj).length
-          ? {
-              from: collection,
-              let: { id: `$${field}` },
-              pipeline: [
-                { $match: { $expr: { $eq: ["$_id", "$$id"] } } },
-                { $project: proj },
-              ],
-              as: field,
-            }
-          : {
-              from: collection,
-              localField: field,
-              foreignField: "_id",
-              as: field,
-            };
-
-      this.pipeline.push({ $lookup: lookup });
+    if (!isArray) {
       this.pipeline.push({
         $unwind: { path: `$${field}`, preserveNullAndEmptyArrays: true },
       });
     }
-
-    return this;
   }
 
+  return this;
+}
+
   addManualFilters(filters) {
     if (filters) this.manualFilters = { ...this.manualFilters, ...filters };
     return this;