vanta-api 1.2.5 → 1.2.7

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "vanta-api",
-  "version": "1.2.5",
+  "version": "1.2.7",
   "description": "Advanced API features and security configuration for Node.js/MongoDB.",
   "main": "index.js",
   "scripts": {

package/src/api-features.js

@@ -92,7 +92,6 @@ export class ApiFeatures {
   }
 
   populate(input = "") {
-    // Build list from input and query.populate
     let list = [];
     const raw = Array.isArray(input) ? input : [input];
     if (this.query.populate) raw.push(...this.query.populate.split(","));
@@ -102,14 +101,12 @@ export class ApiFeatures {
       else if (item?.path) list.push(item);
     });
 
-    // Deduplicate
     const map = new Map();
     list.forEach((opt) => {
       const key = typeof opt === "string" ? opt : opt.path;
       map.set(key, opt);
     });
 
-    // Enforce role-based populate
     const allowed =
       securityConfig.accessLevels[this.userRole]?.allowedPopulate || [];
     const final = [];
@@ -117,27 +114,31 @@ export class ApiFeatures {
       if (allowed.includes("*") || allowed.includes(key)) final.push(opt);
     });
 
-    // Apply lookups
     for (const opt of final) {
       const field = typeof opt === "string" ? opt : opt.path;
       const proj =
         typeof opt === "object" && opt.select
-          ? opt.select.split(" ").reduce((a, f) => {
-              a[f] = 1;
-              return a;
-            }, {})
+          ? opt.select.split(" ").reduce(
+              (a, f) => {
+                a[f] = 1;
+                return a;
+              },
+              { _id: 1 }
+            )
           : {};
 
-      const { collection } = this._getCollectionInfo(field);
+      const { collection, isArray } = this._getCollectionInfo(field);
+
+      const matchStage = isArray
+        ? { $match: { $expr: { $in: ["$_id", "$$id"] } } }
+        : { $match: { $expr: { $eq: ["$_id", "$$id"] } } };
+
       const lookup =
         proj && Object.keys(proj).length
           ? {
               from: collection,
               let: { id: `$${field}` },
-              pipeline: [
-                { $match: { $expr: { $eq: ["$_id", "$$id"] } } },
-                { $project: proj },
-              ],
+              pipeline: [matchStage, { $project: proj }],
               as: field,
             }
           : {
@@ -148,9 +149,12 @@ export class ApiFeatures {
             };
 
       this.pipeline.push({ $lookup: lookup });
-      this.pipeline.push({
-        $unwind: { path: `$${field}`, preserveNullAndEmptyArrays: true },
-      });
+
+      if (!isArray) {
+        this.pipeline.push({
+          $unwind: { path: `$${field}`, preserveNullAndEmptyArrays: true },
+        });
+      }
     }
 
     return this;
@@ -285,7 +289,7 @@ export class ApiFeatures {
         resultObj[keyObj] = false;
         return;
       }
-       
+
       if (typeof val === "string" && /^[0-9]+$/.test(val)) {
         resultObj[keyObj] = parseInt(val, 10);
         return;