vanta-api 1.2.6 → 1.2.8

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "vanta-api",
-  "version": "1.2.6",
+  "version": "1.2.8",
   "description": "Advanced API features and security configuration for Node.js/MongoDB.",
   "main": "index.js",
   "scripts": {

package/src/api-features.js

@@ -62,21 +62,46 @@ export class ApiFeatures {
     return this;
   }
 
-  limitFields() {
-    if (!this.query.fields) return this;
-    const validFields = Object.keys(this.model.schema.paths).filter(
-      (f) => !securityConfig.forbiddenFields.includes(f)
-    );
-    const project = {};
+ limitFields(input = "") {
+  const rawFields = [input, this.query.fields].filter(Boolean).join(",");
+  if (!rawFields) return this;
+
+  const validFields = Object.keys(this.model.schema.paths).filter(
+    (f) => !securityConfig.forbiddenFields.includes(f)
+  );
+
+  const fieldsArray = rawFields
+    .split(",")
+    .map((f) => f.trim())
+    .filter(Boolean);
+
+  const includeFields = new Set();
+  const excludeFields = new Set();
+
+  fieldsArray.forEach((f) => {
+    if (f.startsWith("-")) excludeFields.add(f.slice(1));
+    else includeFields.add(f);
+  });
+
+  const project = {};
 
-    this.query.fields.split(",").forEach((f) => {
+  if (includeFields.size > 0) {
+    includeFields.forEach((f) => {
       if (validFields.includes(f)) project[f] = 1;
     });
+  } else if (excludeFields.size > 0) {
+    validFields.forEach((f) => {
+      if (!excludeFields.has(f)) project[f] = 1;
+    });
+  }
 
-    if (Object.keys(project).length) this.pipeline.push({ $project: project });
-    return this;
+  if (Object.keys(project).length) {
+    this.pipeline.push({ $project: project });
   }
 
+  return this;
+}
+
   paginate() {
     const { maxLimit } = securityConfig.accessLevels[this.userRole] || {
       maxLimit: 100,
@@ -91,70 +116,74 @@ export class ApiFeatures {
     return this;
   }
 
-populate(input = "") {
-  let list = [];
-  const raw = Array.isArray(input) ? input : [input];
-  if (this.query.populate) raw.push(...this.query.populate.split(","));
+  populate(input = "") {
+    let list = [];
+    const raw = Array.isArray(input) ? input : [input];
+    if (this.query.populate) raw.push(...this.query.populate.split(","));
 
-  raw.forEach((item) => {
-    if (typeof item === "string" && item.trim()) list.push(item.trim());
-    else if (item?.path) list.push(item);
-  });
+    raw.forEach((item) => {
+      if (typeof item === "string" && item.trim()) list.push(item.trim());
+      else if (item?.path) list.push(item);
+    });
 
-  const map = new Map();
-  list.forEach((opt) => {
-    const key = typeof opt === "string" ? opt : opt.path;
-    map.set(key, opt);
-  });
+    const map = new Map();
+    list.forEach((opt) => {
+      const key = typeof opt === "string" ? opt : opt.path;
+      map.set(key, opt);
+    });
 
-  const allowed =
-    securityConfig.accessLevels[this.userRole]?.allowedPopulate || [];
-  const final = [];
-  map.forEach((opt, key) => {
-    if (allowed.includes("*") || allowed.includes(key)) final.push(opt);
-  });
+    const allowed =
+      securityConfig.accessLevels[this.userRole]?.allowedPopulate || [];
+    const final = [];
+    map.forEach((opt, key) => {
+      if (allowed.includes("*") || allowed.includes(key)) final.push(opt);
+    });
 
-  for (const opt of final) {
-    const field = typeof opt === "string" ? opt : opt.path;
-    const proj =
-      typeof opt === "object" && opt.select
-        ? opt.select.split(" ").reduce((a, f) => {
-            a[f] = 1;
-            return a;
-          }, {})
-        : {};
-
-    const { collection, isArray } = this._getCollectionInfo(field);
-
-    const lookup =
-      proj && Object.keys(proj).length
-        ? {
-            from: collection,
-            let: { id: `$${field}` },
-            pipeline: [
-              { $match: { $expr: { $eq: ["$_id", "$$id"] } } },
-              { $project: proj },
-            ],
-            as: field,
-          }
-        : {
-            from: collection,
-            localField: field,
-            foreignField: "_id",
-            as: field,
-          };
-
-    this.pipeline.push({ $lookup: lookup });
-
-    if (!isArray) {
-      this.pipeline.push({
-        $unwind: { path: `$${field}`, preserveNullAndEmptyArrays: true },
-      });
+    for (const opt of final) {
+      const field = typeof opt === "string" ? opt : opt.path;
+      const proj =
+        typeof opt === "object" && opt.select
+          ? opt.select.split(" ").reduce(
+              (a, f) => {
+                a[f] = 1;
+                return a;
+              },
+              { _id: 1 }
+            )
+          : {};
+
+      const { collection, isArray } = this._getCollectionInfo(field);
+
+      const matchStage = isArray
+        ? { $match: { $expr: { $in: ["$_id", "$$id"] } } }
+        : { $match: { $expr: { $eq: ["$_id", "$$id"] } } };
+
+      const lookup =
+        proj && Object.keys(proj).length
+          ? {
+              from: collection,
+              let: { id: `$${field}` },
+              pipeline: [matchStage, { $project: proj }],
+              as: field,
+            }
+          : {
+              from: collection,
+              localField: field,
+              foreignField: "_id",
+              as: field,
+            };
+
+      this.pipeline.push({ $lookup: lookup });
+
+      if (!isArray) {
+        this.pipeline.push({
+          $unwind: { path: `$${field}`, preserveNullAndEmptyArrays: true },
+        });
+      }
     }
-  }
 
-  return this;
-}
+    return this;
+  }
 
   addManualFilters(filters) {
     if (filters) this.manualFilters = { ...this.manualFilters, ...filters };
@@ -285,7 +314,7 @@ populate(input = "") {
         resultObj[keyObj] = false;
         return;
       }
-       
+
       if (typeof val === "string" && /^[0-9]+$/.test(val)) {
         resultObj[keyObj] = parseInt(val, 10);
         return;