vanta-api 1.2.8 → 1.3.1

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "vanta-api",
-  "version": "1.2.8",
+  "version": "1.3.1",
   "description": "Advanced API features and security configuration for Node.js/MongoDB.",
   "main": "index.js",
   "scripts": {

package/src/api-features.js

@@ -15,10 +15,14 @@ const logger = winston.createLogger({
 });
 
 export class ApiFeatures {
-  constructor(model, query = {}, userRole = "guest") {
+  constructor(model, query = {}, userRole = "") {
     this.model = model;
     this.query = { ...query };
-    this.userRole = userRole;
+    if (!userRole || ! Object.keys(securityConfig.accessLevels).includes(userRole)) {
+      this.userRole = 'guest';
+    } else {
+      this.userRole = userRole;
+    }
 
     this.pipeline = [];
     this.countPipeline = [];
@@ -82,9 +86,7 @@ export class ApiFeatures {
     if (f.startsWith("-")) excludeFields.add(f.slice(1));
     else includeFields.add(f);
   });
-
   const project = {};
-
   if (includeFields.size > 0) {
     includeFields.forEach((f) => {
       if (validFields.includes(f)) project[f] = 1;
@@ -101,7 +103,6 @@ export class ApiFeatures {
 
   return this;
 }
-
   paginate() {
     const { maxLimit } = securityConfig.accessLevels[this.userRole] || {
       maxLimit: 100,
@@ -248,7 +249,6 @@ export class ApiFeatures {
 
   _parseQueryFilters() {
     const obj = { ...this.query };
-    // پاک کردن پارامترهای سیستماتیک
     ["page", "limit", "sort", "fields", "populate"].forEach(
       (k) => delete obj[k]
     );
@@ -339,9 +339,6 @@ export class ApiFeatures {
   _applySecurityFilters(filters) {
     let res = { ...filters };
     securityConfig.forbiddenFields.forEach((f) => delete res[f]);
-    if (this.userRole !== "admin" && this.model.schema.path("isActive")) {
-      res.isActive = true;
-    }
     return res;
   }