vanta-api 1.3.1 → 1.4.0

package/src/api-features.js

@@ -4,7 +4,7 @@ import pluralize from "pluralize";
 import HandleERROR from "./handleError.js";
 import { securityConfig } from "./config.js";
 import { ObjectId } from "bson";
-// Logger setup
+
 const logger = winston.createLogger({
   level: "info",
   format: winston.format.combine(
@@ -14,355 +14,606 @@ const logger = winston.createLogger({
   transports: [new winston.transports.Console()],
 });
 
+const RESERVED_QUERY_KEYS = ["page", "limit", "sort", "fields", "populate", "q"];
+
 export class ApiFeatures {
   constructor(model, query = {}, userRole = "") {
     this.model = model;
     this.query = { ...query };
-    if (!userRole || ! Object.keys(securityConfig.accessLevels).includes(userRole)) {
-      this.userRole = 'guest';
-    } else {
-      this.userRole = userRole;
-    }
-
     this.pipeline = [];
-    this.countPipeline = [];
     this.manualFilters = {};
     this.useCursor = false;
 
+    this.userRole =
+      userRole && securityConfig.accessLevels?.[userRole] ? userRole : "guest";
+
     this._sanitization();
   }
 
-  // ---------- Core Methods ----------
-
   filter() {
-    // Parse and sanitize both query and manual filters
     const queryFilters = this._parseQueryFilters();
-    const merged = this._sanitizeFilters({
-      ...queryFilters,
-      ...this.manualFilters,
-    });
-    const safe = this._applySecurityFilters(merged);
+    const mergedFilters = this._deepMergeFilters(queryFilters, this.manualFilters);
+    const sanitizedFilters = this._sanitizeFilters(mergedFilters);
+    const safeFilters = this._applySecurityFilters(sanitizedFilters);
 
-    if (Object.keys(safe).length) {
-      this.pipeline.push({ $match: safe });
-      this.countPipeline.push({ $match: safe });
+    if (Object.keys(safeFilters).length) {
+      this.pipeline.push({ $match: safeFilters });
     }
+
+    return this;
+  }
+
+  addManualFilters(filters = {}) {
+    if (filters && typeof filters === "object" && !Array.isArray(filters)) {
+      this.manualFilters = this._deepMergeFilters(this.manualFilters, filters);
+    }
+
+    return this;
+  }
+
+  search(fields = []) {
+    const q = this.query.q;
+
+    if (!q || !Array.isArray(fields) || !fields.length) return this;
+
+    const safeQ = this._escapeRegex(String(q).trim());
+
+    if (!safeQ) return this;
+
+    this.pipeline.push({
+      $match: {
+        $or: fields
+          .filter((field) => typeof field === "string" && field.trim())
+          .map((field) => ({
+            [field]: { $regex: safeQ, $options: "i" },
+          })),
+      },
+    });
+
     return this;
   }
 
   sort() {
     if (!this.query.sort) return this;
-    const parts = this.query.sort.split(",");
-    const validFields = Object.keys(this.model.schema.paths);
+
     const sortObj = {};
+    const validFields = new Set(Object.keys(this.model.schema.paths));
+
+    String(this.query.sort)
+      .split(",")
+      .map((p) => p.trim())
+      .filter(Boolean)
+      .forEach((part) => {
+        const direction = part.startsWith("-") ? -1 : 1;
+        const field = part.replace(/^[-+]/, "");
+
+        if (validFields.has(field)) {
+          sortObj[field] = direction;
+        }
+      });
 
-    for (const part of parts) {
-      const dir = part.startsWith("-") ? -1 : 1;
-      const key = part.replace(/^[-+]/, "");
-      if (validFields.includes(key)) sortObj[key] = dir;
+    if (Object.keys(sortObj).length) {
+      this.pipeline.push({ $sort: sortObj });
     }
 
-    if (Object.keys(sortObj).length) this.pipeline.push({ $sort: sortObj });
     return this;
   }
 
- limitFields(input = "") {
-  const rawFields = [input, this.query.fields].filter(Boolean).join(",");
-  if (!rawFields) return this;
-
-  const validFields = Object.keys(this.model.schema.paths).filter(
-    (f) => !securityConfig.forbiddenFields.includes(f)
-  );
-
-  const fieldsArray = rawFields
-    .split(",")
-    .map((f) => f.trim())
-    .filter(Boolean);
-
-  const includeFields = new Set();
-  const excludeFields = new Set();
-
-  fieldsArray.forEach((f) => {
-    if (f.startsWith("-")) excludeFields.add(f.slice(1));
-    else includeFields.add(f);
-  });
-  const project = {};
-  if (includeFields.size > 0) {
-    includeFields.forEach((f) => {
-      if (validFields.includes(f)) project[f] = 1;
-    });
-  } else if (excludeFields.size > 0) {
-    validFields.forEach((f) => {
-      if (!excludeFields.has(f)) project[f] = 1;
-    });
-  }
+  limitFields(input = "") {
+    const rawFields = [input, this.query.fields].filter(Boolean).join(",");
+
+    if (!rawFields) return this;
+
+    const fields = rawFields
+      .split(",")
+      .map((field) => field.trim())
+      .filter(Boolean);
 
-  if (Object.keys(project).length) {
-    this.pipeline.push({ $project: project });
+    const hasInclude = fields.some((field) => !field.startsWith("-"));
+    const hasExclude = fields.some((field) => field.startsWith("-"));
+
+    if (hasInclude && hasExclude) {
+      throw new HandleERROR("Cannot mix include and exclude fields", 400);
+    }
+
+    const project = {};
+
+    for (const field of fields) {
+      const cleanField = field.replace(/^-/, "");
+
+      if (this._isForbiddenField(cleanField)) continue;
+
+      project[cleanField] = field.startsWith("-") ? 0 : 1;
+    }
+
+    if (Object.keys(project).length) {
+      this.pipeline.push({ $project: project });
+    }
+
+    return this;
   }
 
-  return this;
-}
   paginate() {
-    const { maxLimit } = securityConfig.accessLevels[this.userRole] || {
-      maxLimit: 100,
-    };
+    const access = securityConfig.accessLevels?.[this.userRole] || {};
+    const maxLimit = access.maxLimit || 100;
+
     const page = Math.max(parseInt(this.query.page, 10) || 1, 1);
-    const lim = Math.min(
+    const limit = Math.min(
       Math.max(parseInt(this.query.limit, 10) || 10, 1),
       maxLimit
     );
 
-    this.pipeline.push({ $skip: (page - 1) * lim }, { $limit: lim });
+    this.pipeline.push({ $skip: (page - 1) * limit }, { $limit: limit });
+
     return this;
   }
 
   populate(input = "") {
-    let list = [];
-    const raw = Array.isArray(input) ? input : [input];
-    if (this.query.populate) raw.push(...this.query.populate.split(","));
-
-    raw.forEach((item) => {
-      if (typeof item === "string" && item.trim()) list.push(item.trim());
-      else if (item?.path) list.push(item);
-    });
-
-    const map = new Map();
-    list.forEach((opt) => {
-      const key = typeof opt === "string" ? opt : opt.path;
-      map.set(key, opt);
-    });
-
-    const allowed =
-      securityConfig.accessLevels[this.userRole]?.allowedPopulate || [];
-    const final = [];
-    map.forEach((opt, key) => {
-      if (allowed.includes("*") || allowed.includes(key)) final.push(opt);
-    });
-
-    for (const opt of final) {
-      const field = typeof opt === "string" ? opt : opt.path;
-      const proj =
-        typeof opt === "object" && opt.select
-          ? opt.select.split(" ").reduce(
-              (a, f) => {
-                a[f] = 1;
-                return a;
-              },
-              { _id: 1 }
-            )
-          : {};
-
-      const { collection, isArray } = this._getCollectionInfo(field);
-
-      const matchStage = isArray
-        ? { $match: { $expr: { $in: ["$_id", "$$id"] } } }
-        : { $match: { $expr: { $eq: ["$_id", "$$id"] } } };
-
-      const lookup =
-        proj && Object.keys(proj).length
-          ? {
-              from: collection,
-              let: { id: `$${field}` },
-              pipeline: [matchStage, { $project: proj }],
-              as: field,
-            }
-          : {
-              from: collection,
-              localField: field,
-              foreignField: "_id",
-              as: field,
-            };
-
-      this.pipeline.push({ $lookup: lookup });
-
-      if (!isArray) {
-        this.pipeline.push({
-          $unwind: { path: `$${field}`, preserveNullAndEmptyArrays: true },
-        });
-      }
+    const populateList = this._normalizePopulateInput(input);
+    const allowedPopulate =
+      securityConfig.accessLevels?.[this.userRole]?.allowedPopulate || [];
+
+    for (const populateItem of populateList) {
+      this._addPopulateStages({
+        model: this.model,
+        populateItem,
+        parentAlias: "",
+        allowedPopulate,
+      });
     }
 
     return this;
   }
 
-  addManualFilters(filters) {
-    if (filters) this.manualFilters = { ...this.manualFilters, ...filters };
-    return this;
-  }
-
   async execute(options = {}) {
     try {
       if (options.useCursor) this.useCursor = true;
-      if (options.debug) logger.info("Pipeline:", this.pipeline);
-      if (this.pipeline.length > (securityConfig.maxPipelineStages || 20)) {
+
+      if (options.debug) {
+        logger.info("Pipeline:", this.pipeline);
+      }
+
+      if (this.pipeline.length > (securityConfig.maxPipelineStages || 50)) {
         throw new HandleERROR("Too many pipeline stages", 400);
       }
 
-      let agg = this.model
-        .aggregate(this.pipeline)
-        .option({ maxTimeMS: 10000 });
-      const [cnt] = await this.model.aggregate([
-        ...this.countPipeline,
+      const countPipeline = this._buildCountPipeline();
+
+      const [countResult] = await this.model.aggregate([
+        ...countPipeline,
         { $count: "total" },
       ]);
-      const cursorOrData = this.useCursor
-        ? agg.cursor({ batchSize: 100 }).exec()
-        : agg
-            .allowDiskUse(options.allowDiskUse || false)
-            .readConcern("majority");
-
-      const data = this.useCursor
-        ? await cursorOrData.toArray()
-        : await cursorOrData;
-
-      const result = { success: true, count: cnt?.total || 0, data };
-      if (options.projection) {
-        result.data = result.data.map((doc) => {
-          const projDoc = {};
-          Object.keys(options.projection).forEach((f) => {
-            if (options.projection[f]) projDoc[f] = doc[f];
-          });
-          return projDoc;
+
+      const aggregation = this.model
+        .aggregate(this.pipeline)
+        .option({ maxTimeMS: options.maxTimeMS || 10000 });
+
+      let data;
+
+      if (this.useCursor) {
+        const cursor = aggregation.cursor({
+          batchSize: options.batchSize || 100,
         });
+
+        data = [];
+
+        for await (const doc of cursor) {
+          data.push(doc);
+        }
+      } else {
+        data = await aggregation
+          .allowDiskUse(Boolean(options.allowDiskUse))
+          .readConcern(options.readConcern || "majority");
       }
-      return result;
+
+      return {
+        success: true,
+        count: countResult?.total || 0,
+        data,
+      };
     } catch (err) {
       this._handleError(err);
     }
   }
 
-  // ---------- Private Helpers ----------
-
   _sanitization() {
-    // Remove unsafe ops
-    ["$", "$where", "$accumulator", "$function"].forEach((op) => {
-      delete this.query[op];
-    });
-    // Validate numeric
-    ["page", "limit"].forEach((f) => {
-      if (this.query[f] && !/^[0-9]+$/.test(this.query[f])) {
-        throw new HandleERROR(`Invalid ${f}`, 400);
+    for (const key of Object.keys(this.query)) {
+      if (
+        key.startsWith("$") ||
+        ["$where", "$accumulator", "$function"].includes(key)
+      ) {
+        delete this.query[key];
+      }
+    }
+
+    ["page", "limit"].forEach((field) => {
+      if (this.query[field] && !/^[0-9]+$/.test(String(this.query[field]))) {
+        throw new HandleERROR(`Invalid ${field}`, 400);
       }
     });
   }
 
   _parseQueryFilters() {
     const obj = { ...this.query };
-    ["page", "limit", "sort", "fields", "populate"].forEach(
-      (k) => delete obj[k]
-    );
+
+    RESERVED_QUERY_KEYS.forEach((key) => delete obj[key]);
 
     const out = {};
 
     for (const [rawKey, rawVal] of Object.entries(obj)) {
-      if (typeof rawVal === "object" && !Array.isArray(rawVal)) {
-        out[rawKey] = {};
-        for (let [op, val] of Object.entries(rawVal)) {
+      const bracketMatch = rawKey.match(/^(.+)\[\$?(\w+)\]$/);
+
+      if (bracketMatch) {
+        const [, field, op] = bracketMatch;
+        const cleanOp = op.replace(/^\$/, "");
+
+        if (securityConfig.allowedOperators?.includes(cleanOp)) {
+          out[field] = {
+            ...(out[field] || {}),
+            [`$${cleanOp}`]: rawVal,
+          };
+        }
+
+        continue;
+      }
+
+      if (rawVal && typeof rawVal === "object" && !Array.isArray(rawVal)) {
+        out[rawKey] = out[rawKey] || {};
+
+        for (const [op, val] of Object.entries(rawVal)) {
           const cleanOp = op.replace(/^\$/, "");
-          if (securityConfig.allowedOperators.includes(cleanOp)) {
-            const v = /^[0-9]+$/.test(val) ? parseInt(val, 10) : val;
-            out[rawKey][`$${cleanOp}`] = v;
+
+          if (securityConfig.allowedOperators?.includes(cleanOp)) {
+            out[rawKey][`$${cleanOp}`] = val;
           }
         }
-      } else if (/^\w+\[\$?\w+\]$/.test(rawKey)) {
-        const [, field, op] = rawKey.match(/^(\w+)\[\$?(\w+)\]$/);
-        if (securityConfig.allowedOperators.includes(op)) {
-          const v = /^[0-9]+$/.test(rawVal) ? parseInt(rawVal, 10) : rawVal;
-          out[field] = { [`$${op}`]: v };
-        }
+
+        continue;
+      }
+
+      if (typeof rawVal === "string" && rawVal.includes(",")) {
+        out[rawKey] = rawVal.split(",").map((v) => v.trim());
       } else {
-        if (typeof rawVal === "string" && rawVal.includes(",")) {
-          out[rawKey] = rawVal.split(",");
-        } else {
-          out[rawKey] = rawVal;
-        }
+        out[rawKey] = rawVal;
       }
     }
 
     return out;
   }
 
-  _sanitizeFilters(filters) {
-    const resultObj = {};
-    const resualt = Object.entries(filters).map((el) => {
-      const [keyObj, val] = el;
-      if (val === "null") {
-        resultObj[keyObj] = null;
-        return;
+  _sanitizeFilters(filters = {}) {
+    const sanitizeNode = (node, key = "") => {
+      if (node === null || node === "null") return null;
+      if (node === "true") return true;
+      if (node === "false") return false;
+
+      if (Array.isArray(node)) {
+        return node.map((item) => sanitizeNode(item, key));
       }
-      if (
-        typeof val === "object" &&
-        (this.#isStrictObjectId(val["$eq"]) ||
-          this.#isStrictObjectId(val["eq"]))
-      ) {
-        const newVal = { ...val };
-        if (this.#isStrictObjectId(val["$eq"])) {
-          newVal["$eq"] = new ObjectId(val["$eq"]);
+
+      if (node && typeof node === "object") {
+        const result = {};
+
+        for (const [childKey, childVal] of Object.entries(node)) {
+          result[childKey] = sanitizeNode(childVal, childKey);
+        }
+
+        return result;
+      }
+
+      if (typeof node === "string") {
+        if (this.#isStrictObjectId(node) && this._shouldConvertToObjectId(key)) {
+          return new ObjectId(node);
         }
-        if (this.#isStrictObjectId(val["eq"])) {
-          newVal["eq"] = new ObjectId(val["eq"]);
+
+        if (/^[0-9]+$/.test(node)) {
+          return node.length > 1 && node.startsWith("0")
+            ? node
+            : parseInt(node, 10);
         }
-        resultObj[keyObj] = newVal;
-        return;
       }
-      if (val === "true") {
-        resultObj[keyObj] = true;
-        return;
+
+      return node;
+    };
+
+    return sanitizeNode(filters);
+  }
+
+  _shouldConvertToObjectId(key = "") {
+    const cleanKey = String(key).replace(/^\$/, "").toLowerCase();
+
+    return (
+      cleanKey === "_id" ||
+      cleanKey === "id" ||
+      cleanKey.endsWith("id") ||
+      cleanKey === "eq" ||
+      cleanKey === "ne" ||
+      cleanKey === "in" ||
+      cleanKey === "nin"
+    );
+  }
+
+  _deepMergeFilters(a = {}, b = {}) {
+    const out = { ...a };
+
+    for (const [key, value] of Object.entries(b)) {
+      if (
+        value &&
+        typeof value === "object" &&
+        !Array.isArray(value) &&
+        out[key] &&
+        typeof out[key] === "object" &&
+        !Array.isArray(out[key]) &&
+        !["$and", "$or", "$nor"].includes(key)
+      ) {
+        out[key] = this._deepMergeFilters(out[key], value);
+      } else {
+        out[key] = value;
       }
-      if (val === "false") {
-        resultObj[keyObj] = false;
+    }
+
+    return out;
+  }
+
+  _applySecurityFilters(filters = {}) {
+    const clean = { ...filters };
+
+    for (const field of securityConfig.forbiddenFields || []) {
+      delete clean[field];
+    }
+
+    return clean;
+  }
+
+  _normalizePopulateInput(input = "") {
+    const raw = [];
+
+    if (input) {
+      if (Array.isArray(input)) raw.push(...input);
+      else raw.push(input);
+    }
+
+    if (this.query.populate) {
+      raw.push(...String(this.query.populate).split(","));
+    }
+
+    const normalized = [];
+
+    const normalizeOne = (item) => {
+      if (!item) return;
+
+      if (typeof item === "string") {
+        const trimmed = item.trim();
+
+        if (!trimmed) return;
+
+        if (trimmed.includes(".")) {
+          const parts = trimmed.split(".").filter(Boolean);
+          const root = { path: parts[0] };
+          let current = root;
+
+          for (const part of parts.slice(1)) {
+            current.populate = { path: part };
+            current = current.populate;
+          }
+
+          normalized.push(root);
+        } else {
+          normalized.push({ path: trimmed });
+        }
+
         return;
       }
 
-      if (typeof val === "string" && /^[0-9]+$/.test(val)) {
-        resultObj[keyObj] = parseInt(val, 10);
+      if (Array.isArray(item)) {
+        item.forEach(normalizeOne);
         return;
       }
-      if (typeof val === "string" && this.#isStrictObjectId(val)) {
-        resultObj[keyObj] = new ObjectId(val);
-        return;
+
+      if (item && typeof item === "object" && item.path) {
+        normalized.push(item);
       }
-      resultObj[keyObj] = val;
-    });
-    return resultObj;
+    };
+
+    raw.forEach(normalizeOne);
+
+    return this._dedupePopulate(normalized);
   }
 
-  #isStrictObjectId(id) {
-    return (
-      typeof id === "string" &&
-      mongoose.Types.ObjectId.isValid(id) &&
-      new mongoose.Types.ObjectId(id).toString() === id
-    );
+  _dedupePopulate(items) {
+    const map = new Map();
+
+    for (const item of items) {
+      map.set(item.path, item);
+    }
+
+    return [...map.values()];
+  }
+
+  _addPopulateStages({ model, populateItem, parentAlias, allowedPopulate }) {
+    const path = populateItem.path;
+    const fullPath = parentAlias ? `${parentAlias}.${path}` : path;
+
+    if (!this._isPopulateAllowed(fullPath, allowedPopulate)) {
+      return;
+    }
+
+    const info = this._getPopulateInfo(model, path, parentAlias);
+
+    this.pipeline.push({
+      $lookup: {
+        from: info.collection,
+        localField: info.localField,
+        foreignField: "_id",
+        as: info.as,
+      },
+    });
+
+    if (!info.isArray) {
+      this.pipeline.push({
+        $unwind: {
+          path: `$${info.as}`,
+          preserveNullAndEmptyArrays: true,
+        },
+      });
+    }
+
+    if (populateItem.select) {
+      const project = this._buildPopulateProjection(populateItem.select, info.as);
+
+      if (Object.keys(project).length) {
+        this.pipeline.push({ $project: project });
+      }
+    }
+
+    if (populateItem.populate) {
+      const nestedList = this._normalizeNestedPopulate(populateItem.populate);
+
+      for (const nested of nestedList) {
+        this._addPopulateStages({
+          model: info.refModel,
+          populateItem: nested,
+          parentAlias: info.as,
+          allowedPopulate,
+        });
+      }
+    }
   }
 
-  _applySecurityFilters(filters) {
-    let res = { ...filters };
-    securityConfig.forbiddenFields.forEach((f) => delete res[f]);
-    return res;
+  _normalizeNestedPopulate(input) {
+    if (!input) return [];
+
+    if (Array.isArray(input)) {
+      return input.flatMap((item) => this._normalizeNestedPopulate(item));
+    }
+
+    if (typeof input === "string") {
+      return this._normalizePopulateInput(input);
+    }
+
+    if (typeof input === "object" && input.path) {
+      return [input];
+    }
+
+    return [];
   }
 
-  _getCollectionInfo(field) {
-    const path = this.model.schema.path(field);
-    if (!path?.options?.ref && !path?.options?.type[0]?.ref)
-      throw new HandleERROR(`Invalid populate: ${field}`, 400);
+  _getPopulateInfo(model, path, parentAlias = "") {
+    const schemaPath = model.schema.path(path);
+
+    if (!schemaPath) {
+      throw new HandleERROR(`Invalid populate path: ${path}`, 400);
+    }
+
+    const isArray = schemaPath.instance === "Array";
 
     const refModelName =
-      path?.options?.ref?.toLowerCase() ||
-      path?.options?.type[0]?.ref.toLowerCase();
+      schemaPath.options?.ref ||
+      schemaPath.caster?.options?.ref ||
+      (Array.isArray(schemaPath.options?.type)
+        ? schemaPath.options.type[0]?.ref
+        : undefined);
+
+    if (!refModelName) {
+      throw new HandleERROR(`Populate path has no ref: ${path}`, 400);
+    }
 
-    const collectionName = pluralize(refModelName);
+    const refModel = this._resolveModel(refModelName, model);
+
+    const as = parentAlias ? `${parentAlias}.${path}` : path;
 
     return {
-      collection: collectionName,
-      isArray: path.instance === "Array",
+      refModel,
+      collection: this._resolveCollectionName(refModelName, refModel),
+      localField: as,
+      foreignField: "_id",
+      as,
+      isArray,
     };
   }
 
+  _resolveModel(refModelName, currentModel) {
+    const connection = currentModel?.db || this.model?.db || mongoose.connection;
+
+    return connection.models?.[refModelName] || mongoose.models?.[refModelName] || null;
+  }
+
+  _resolveCollectionName(refModelName, refModel) {
+    if (refModel?.collection?.name) {
+      return refModel.collection.name;
+    }
+
+    return pluralize(String(refModelName).toLowerCase());
+  }
+
+  _buildPopulateProjection(select, alias) {
+    const fields = String(select)
+      .split(" ")
+      .map((field) => field.trim())
+      .filter(Boolean);
+
+    const hasInclude = fields.some((field) => !field.startsWith("-"));
+    const hasExclude = fields.some((field) => field.startsWith("-"));
+
+    if (hasInclude && hasExclude) {
+      throw new HandleERROR(
+        "Cannot mix include and exclude in populate select",
+        400
+      );
+    }
+
+    const project = {};
+
+    for (const field of fields) {
+      const cleanField = field.replace(/^-/, "");
+
+      if (this._isForbiddenField(cleanField)) continue;
+
+      project[`${alias}.${cleanField}`] = field.startsWith("-") ? 0 : 1;
+    }
+
+    return project;
+  }
+
+  _isPopulateAllowed(path, allowedPopulate = []) {
+    return (
+      allowedPopulate.includes("*") ||
+      allowedPopulate.includes(path) ||
+      allowedPopulate.includes(path.split(".")[0])
+    );
+  }
+
+  _isForbiddenField(field) {
+    return (securityConfig.forbiddenFields || []).includes(field);
+  }
+
+  _buildCountPipeline() {
+    return this.pipeline.filter((stage) => {
+      return !(
+        "$skip" in stage ||
+        "$limit" in stage ||
+        "$sort" in stage ||
+        "$project" in stage
+      );
+    });
+  }
+
+  _escapeRegex(value) {
+    return String(value).replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+  }
+
+  #isStrictObjectId(id) {
+    return (
+      typeof id === "string" &&
+      mongoose.Types.ObjectId.isValid(id) &&
+      new mongoose.Types.ObjectId(id).toString() === id
+    );
+  }
+
   _handleError(err) {
     logger.error(`[ApiFeatures] ${err.message}`, { stack: err.stack });
     throw err;
   }
 }
 
-export default ApiFeatures;
+export default ApiFeatures;