vanta-api 1.4.0 → 1.4.2

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "vanta-api",
-  "version": "1.4.0",
+  "version": "1.4.2",
   "description": "Advanced API features and security configuration for Node.js/MongoDB.",
   "main": "index.js",
   "scripts": {

package/src/api-features.js

@@ -15,6 +15,7 @@ const logger = winston.createLogger({
 });
 
 const RESERVED_QUERY_KEYS = ["page", "limit", "sort", "fields", "populate", "q"];
+const LOGICAL_OPERATORS = ["$and", "$or", "$nor"];
 
 export class ApiFeatures {
   constructor(model, query = {}, userRole = "") {
@@ -32,7 +33,10 @@ export class ApiFeatures {
 
   filter() {
     const queryFilters = this._parseQueryFilters();
-    const mergedFilters = this._deepMergeFilters(queryFilters, this.manualFilters);
+    const mergedFilters = this._deepMergeFilters(
+      queryFilters,
+      this.manualFilters
+    );
     const sanitizedFilters = this._sanitizeFilters(mergedFilters);
     const safeFilters = this._applySecurityFilters(sanitizedFilters);
 
@@ -60,15 +64,19 @@ export class ApiFeatures {
 
     if (!safeQ) return this;
 
-    this.pipeline.push({
-      $match: {
-        $or: fields
-          .filter((field) => typeof field === "string" && field.trim())
-          .map((field) => ({
-            [field]: { $regex: safeQ, $options: "i" },
-          })),
-      },
-    });
+    const conditions = fields
+      .filter((field) => typeof field === "string" && field.trim())
+      .map((field) => ({
+        [field]: { $regex: safeQ, $options: "i" },
+      }));
+
+    if (conditions.length) {
+      this.pipeline.push({
+        $match: {
+          $or: conditions,
+        },
+      });
+    }
 
     return this;
   }
@@ -81,7 +89,7 @@ export class ApiFeatures {
 
     String(this.query.sort)
       .split(",")
-      .map((p) => p.trim())
+      .map((part) => part.trim())
       .filter(Boolean)
       .forEach((part) => {
         const direction = part.startsWith("-") ? -1 : 1;
@@ -155,9 +163,10 @@ export class ApiFeatures {
 
     for (const populateItem of populateList) {
       this._addPopulateStages({
-        model: this.model,
         populateItem,
-        parentAlias: "",
+        parentPath: "",
+        parentIsArray: false,
+        schema: this.model.schema,
         allowedPopulate,
       });
     }
@@ -173,7 +182,7 @@ export class ApiFeatures {
         logger.info("Pipeline:", this.pipeline);
       }
 
-      if (this.pipeline.length > (securityConfig.maxPipelineStages || 50)) {
+      if (this.pipeline.length > (securityConfig.maxPipelineStages || 80)) {
         throw new HandleERROR("Too many pipeline stages", 400);
       }
 
@@ -216,6 +225,420 @@ export class ApiFeatures {
     }
   }
 
+  _addPopulateStages({
+    populateItem,
+    parentPath = "",
+    parentIsArray = false,
+    schema = null,
+    allowedPopulate = [],
+  }) {
+    if (!populateItem || !populateItem.path) return;
+
+    const path = populateItem.path;
+    const fullPath = parentPath ? `${parentPath}.${path}` : path;
+
+    if (!this._isPopulateAllowed(fullPath, allowedPopulate)) {
+      return;
+    }
+
+    const info = this._getPopulateInfo({
+      schema,
+      path,
+      fullPath,
+      parentPath,
+      parentIsArray,
+      populateItem,
+    });
+
+    if (!parentIsArray) {
+      this.pipeline.push({
+        $lookup: {
+          from: info.collection,
+          localField: info.localField,
+          foreignField: "_id",
+          as: info.as,
+        },
+      });
+
+      if (!info.isArray) {
+        this.pipeline.push({
+          $unwind: {
+            path: `$${info.as}`,
+            preserveNullAndEmptyArrays: true,
+          },
+        });
+      }
+
+      if (populateItem.populate) {
+        const nestedList = this._normalizeNestedPopulate(populateItem.populate);
+
+        for (const nested of nestedList) {
+          this._addPopulateStages({
+            populateItem: nested,
+            parentPath: info.as,
+            parentIsArray: info.isArray,
+            schema: info.refSchema,
+            allowedPopulate,
+          });
+        }
+      }
+
+      if (populateItem.select) {
+        this._applyPopulateSelect({
+          path: info.as,
+          select: populateItem.select,
+          isArray: info.isArray,
+        });
+      }
+
+      return;
+    }
+
+    const tempLookupName = this._makeTempLookupName(fullPath);
+
+    this.pipeline.push({
+      $lookup: {
+        from: info.collection,
+        localField: info.localField,
+        foreignField: "_id",
+        as: tempLookupName,
+      },
+    });
+
+    this.pipeline.push({
+      $set: {
+        [parentPath]: {
+          $map: {
+            input: { $ifNull: [`$${parentPath}`, []] },
+            as: "item",
+            in: {
+              $mergeObjects: [
+                "$$item",
+                {
+                  [path]: {
+                    $first: {
+                      $filter: {
+                        input: `$${tempLookupName}`,
+                        as: "joined",
+                        cond: {
+                          $eq: ["$$joined._id", `$$item.${path}`],
+                        },
+                      },
+                    },
+                  },
+                },
+              ],
+            },
+          },
+        },
+      },
+    });
+
+    this.pipeline.push({ $unset: tempLookupName });
+
+    if (populateItem.populate) {
+      const nestedList = this._normalizeNestedPopulate(populateItem.populate);
+
+      for (const nested of nestedList) {
+        this._addNestedPopulateInsideArrayItem({
+          arrayPath: parentPath,
+          objectPath: path,
+          populateItem: nested,
+          allowedPopulate,
+          schema: info.refSchema,
+        });
+      }
+    }
+
+    if (populateItem.select) {
+      this._applyNestedObjectSelectInsideArray({
+        arrayPath: parentPath,
+        objectPath: path,
+        select: populateItem.select,
+      });
+    }
+  }
+
+  _addNestedPopulateInsideArrayItem({
+    arrayPath,
+    objectPath,
+    populateItem,
+    allowedPopulate = [],
+    schema = null,
+  }) {
+    if (!populateItem || !populateItem.path) return;
+
+    const childPath = populateItem.path;
+    const fullPath = `${arrayPath}.${objectPath}.${childPath}`;
+
+    if (!this._isPopulateAllowed(fullPath, allowedPopulate)) {
+      return;
+    }
+
+    const info = this._getPopulateInfo({
+      schema,
+      path: childPath,
+      fullPath,
+      parentPath: `${arrayPath}.${objectPath}`,
+      parentIsArray: true,
+      populateItem,
+    });
+
+    const tempLookupName = this._makeTempLookupName(fullPath);
+
+    this.pipeline.push({
+      $lookup: {
+        from: info.collection,
+        localField: `${arrayPath}.${objectPath}.${childPath}`,
+        foreignField: "_id",
+        as: tempLookupName,
+      },
+    });
+
+    this.pipeline.push({
+      $set: {
+        [arrayPath]: {
+          $map: {
+            input: { $ifNull: [`$${arrayPath}`, []] },
+            as: "item",
+            in: {
+              $mergeObjects: [
+                "$$item",
+                {
+                  [objectPath]: {
+                    $cond: [
+                      { $ne: [`$$item.${objectPath}`, null] },
+                      {
+                        $mergeObjects: [
+                          `$$item.${objectPath}`,
+                          {
+                            [childPath]: {
+                              $first: {
+                                $filter: {
+                                  input: `$${tempLookupName}`,
+                                  as: "joined",
+                                  cond: {
+                                    $eq: [
+                                      "$$joined._id",
+                                      `$$item.${objectPath}.${childPath}`,
+                                    ],
+                                  },
+                                },
+                              },
+                            },
+                          },
+                        ],
+                      },
+                      `$$item.${objectPath}`,
+                    ],
+                  },
+                },
+              ],
+            },
+          },
+        },
+      },
+    });
+
+    this.pipeline.push({ $unset: tempLookupName });
+
+    if (populateItem.populate) {
+      const nestedList = this._normalizeNestedPopulate(populateItem.populate);
+
+      for (const nested of nestedList) {
+        this._addNestedPopulateInsideArrayItem({
+          arrayPath,
+          objectPath: `${objectPath}.${childPath}`,
+          populateItem: nested,
+          allowedPopulate,
+          schema: info.refSchema,
+        });
+      }
+    }
+
+    if (populateItem.select) {
+      this._applyNestedObjectSelectInsideArray({
+        arrayPath,
+        objectPath: `${objectPath}.${childPath}`,
+        select: populateItem.select,
+      });
+    }
+  }
+
+  _getPopulateInfo({
+    schema = null,
+    path,
+    fullPath,
+    parentPath = "",
+    parentIsArray = false,
+    populateItem = {},
+  }) {
+    const schemaPath = schema?.path?.(path);
+
+    const isArray =
+      populateItem.isArray === true ||
+      schemaPath?.instance === "Array" ||
+      Array.isArray(schemaPath?.options?.type);
+
+    const refModelName =
+      populateItem.ref ||
+      populateItem.modelName ||
+      schemaPath?.options?.ref ||
+      schemaPath?.caster?.options?.ref ||
+      (Array.isArray(schemaPath?.options?.type)
+        ? schemaPath.options.type[0]?.ref
+        : undefined) ||
+      this._inferModelNameFromPath(path);
+
+    const collection =
+      populateItem.collection ||
+      populateItem.from ||
+      this._resolveCollectionName(refModelName);
+
+    const refSchema = this._resolveRegisteredSchema(refModelName);
+
+    return {
+      path,
+      fullPath,
+      refModelName,
+      collection,
+      refSchema,
+      isArray,
+      localField: parentIsArray ? fullPath : fullPath,
+      as: fullPath,
+      parentPath,
+      parentIsArray,
+    };
+  }
+
+  _applyPopulateSelect({ path, select, isArray }) {
+    const parsed = this._parseSelect(select);
+
+    if (!parsed.fields.length) return;
+
+    if (parsed.mode === "exclude") {
+      this.pipeline.push({
+        $unset: parsed.fields.map((field) => `${path}.${field}`),
+      });
+      return;
+    }
+
+    const includeFields = this._ensureIdField(parsed.fields);
+
+    if (isArray) {
+      const selectedObject = {};
+
+      for (const field of includeFields) {
+        selectedObject[field] = `$$item.${field}`;
+      }
+
+      this.pipeline.push({
+        $set: {
+          [path]: {
+            $map: {
+              input: { $ifNull: [`$${path}`, []] },
+              as: "item",
+              in: selectedObject,
+            },
+          },
+        },
+      });
+
+      return;
+    }
+
+    const selectedObject = {};
+
+    for (const field of includeFields) {
+      selectedObject[field] = `$${path}.${field}`;
+    }
+
+    this.pipeline.push({
+      $set: {
+        [path]: {
+          $cond: [{ $ne: [`$${path}`, null] }, selectedObject, `$${path}`],
+        },
+      },
+    });
+  }
+
+  _applyNestedObjectSelectInsideArray({ arrayPath, objectPath, select }) {
+    const parsed = this._parseSelect(select);
+
+    if (!parsed.fields.length) return;
+
+    if (parsed.mode === "exclude") {
+      this.pipeline.push({
+        $unset: parsed.fields.map(
+          (field) => `${arrayPath}.${objectPath}.${field}`
+        ),
+      });
+      return;
+    }
+
+    const includeFields = this._ensureIdField(parsed.fields);
+    const selectedObject = {};
+
+    for (const field of includeFields) {
+      selectedObject[field] = `$$item.${objectPath}.${field}`;
+    }
+
+    this.pipeline.push({
+      $set: {
+        [arrayPath]: {
+          $map: {
+            input: { $ifNull: [`$${arrayPath}`, []] },
+            as: "item",
+            in: {
+              $mergeObjects: [
+                "$$item",
+                {
+                  [objectPath]: {
+                    $cond: [
+                      { $ne: [`$$item.${objectPath}`, null] },
+                      selectedObject,
+                      `$$item.${objectPath}`,
+                    ],
+                  },
+                },
+              ],
+            },
+          },
+        },
+      },
+    });
+  }
+
+  _parseSelect(select = "") {
+    const fields = String(select)
+      .split(/\s+/)
+      .map((field) => field.trim())
+      .filter(Boolean)
+      .filter((field) => {
+        const cleanField = field.replace(/^-/, "");
+        return !this._isForbiddenField(cleanField);
+      });
+
+    const hasInclude = fields.some((field) => !field.startsWith("-"));
+    const hasExclude = fields.some((field) => field.startsWith("-"));
+
+    if (hasInclude && hasExclude) {
+      throw new HandleERROR(
+        "Cannot mix include and exclude in populate select",
+        400
+      );
+    }
+
+    return {
+      mode: hasExclude ? "exclude" : "include",
+      fields: fields.map((field) => field.replace(/^-/, "")),
+    };
+  }
+
+  _ensureIdField(fields = []) {
+    return fields.includes("_id") ? fields : ["_id", ...fields];
+  }
+
   _sanitization() {
     for (const key of Object.keys(this.query)) {
       if (
@@ -344,7 +767,7 @@ export class ApiFeatures {
         out[key] &&
         typeof out[key] === "object" &&
         !Array.isArray(out[key]) &&
-        !["$and", "$or", "$nor"].includes(key)
+        !LOGICAL_OPERATORS.includes(key)
       ) {
         out[key] = this._deepMergeFilters(out[key], value);
       } else {
@@ -356,13 +779,27 @@ export class ApiFeatures {
   }
 
   _applySecurityFilters(filters = {}) {
-    const clean = { ...filters };
+    const cleanNode = (node) => {
+      if (Array.isArray(node)) {
+        return node.map(cleanNode);
+      }
 
-    for (const field of securityConfig.forbiddenFields || []) {
-      delete clean[field];
-    }
+      if (!node || typeof node !== "object") {
+        return node;
+      }
+
+      const result = {};
 
-    return clean;
+      for (const [key, value] of Object.entries(node)) {
+        if (this._isForbiddenField(key)) continue;
+
+        result[key] = cleanNode(value);
+      }
+
+      return result;
+    };
+
+    return cleanNode(filters);
   }
 
   _normalizePopulateInput(input = "") {
@@ -388,16 +825,7 @@ export class ApiFeatures {
         if (!trimmed) return;
 
         if (trimmed.includes(".")) {
-          const parts = trimmed.split(".").filter(Boolean);
-          const root = { path: parts[0] };
-          let current = root;
-
-          for (const part of parts.slice(1)) {
-            current.populate = { path: part };
-            current = current.populate;
-          }
-
-          normalized.push(root);
+          normalized.push(this._dotPathToPopulate(trimmed));
         } else {
           normalized.push({ path: trimmed });
         }
@@ -411,7 +839,7 @@ export class ApiFeatures {
       }
 
       if (item && typeof item === "object" && item.path) {
-        normalized.push(item);
+        normalized.push(this._normalizePopulateObject(item));
       }
     };
 
@@ -420,159 +848,105 @@ export class ApiFeatures {
     return this._dedupePopulate(normalized);
   }
 
-  _dedupePopulate(items) {
-    const map = new Map();
+  _normalizePopulateObject(item) {
+    const normalized = { ...item };
 
-    for (const item of items) {
-      map.set(item.path, item);
+    if (typeof normalized.path === "string") {
+      normalized.path = normalized.path.trim();
     }
 
-    return [...map.values()];
-  }
-
-  _addPopulateStages({ model, populateItem, parentAlias, allowedPopulate }) {
-    const path = populateItem.path;
-    const fullPath = parentAlias ? `${parentAlias}.${path}` : path;
-
-    if (!this._isPopulateAllowed(fullPath, allowedPopulate)) {
-      return;
+    if (typeof normalized.select === "string") {
+      normalized.select = normalized.select.trim();
     }
 
-    const info = this._getPopulateInfo(model, path, parentAlias);
-
-    this.pipeline.push({
-      $lookup: {
-        from: info.collection,
-        localField: info.localField,
-        foreignField: "_id",
-        as: info.as,
-      },
-    });
-
-    if (!info.isArray) {
-      this.pipeline.push({
-        $unwind: {
-          path: `$${info.as}`,
-          preserveNullAndEmptyArrays: true,
-        },
-      });
+    if (normalized.populate) {
+      normalized.populate = this._normalizeNestedPopulate(normalized.populate);
     }
 
-    if (populateItem.select) {
-      const project = this._buildPopulateProjection(populateItem.select, info.as);
-
-      if (Object.keys(project).length) {
-        this.pipeline.push({ $project: project });
-      }
-    }
-
-    if (populateItem.populate) {
-      const nestedList = this._normalizeNestedPopulate(populateItem.populate);
-
-      for (const nested of nestedList) {
-        this._addPopulateStages({
-          model: info.refModel,
-          populateItem: nested,
-          parentAlias: info.as,
-          allowedPopulate,
-        });
-      }
-    }
+    return normalized;
   }
 
   _normalizeNestedPopulate(input) {
     if (!input) return [];
 
-    if (Array.isArray(input)) {
-      return input.flatMap((item) => this._normalizeNestedPopulate(item));
-    }
-
     if (typeof input === "string") {
       return this._normalizePopulateInput(input);
     }
 
+    if (Array.isArray(input)) {
+      return input
+        .flatMap((item) => {
+          if (typeof item === "string") return this._normalizePopulateInput(item);
+          if (item && typeof item === "object" && item.path) {
+            return [this._normalizePopulateObject(item)];
+          }
+          return [];
+        })
+        .filter(Boolean);
+    }
+
     if (typeof input === "object" && input.path) {
-      return [input];
+      return [this._normalizePopulateObject(input)];
     }
 
     return [];
   }
 
-  _getPopulateInfo(model, path, parentAlias = "") {
-    const schemaPath = model.schema.path(path);
-
-    if (!schemaPath) {
-      throw new HandleERROR(`Invalid populate path: ${path}`, 400);
-    }
+  _dotPathToPopulate(path) {
+    const parts = path
+      .split(".")
+      .map((part) => part.trim())
+      .filter(Boolean);
 
-    const isArray = schemaPath.instance === "Array";
+    const root = { path: parts[0] };
+    let current = root;
 
-    const refModelName =
-      schemaPath.options?.ref ||
-      schemaPath.caster?.options?.ref ||
-      (Array.isArray(schemaPath.options?.type)
-        ? schemaPath.options.type[0]?.ref
-        : undefined);
-
-    if (!refModelName) {
-      throw new HandleERROR(`Populate path has no ref: ${path}`, 400);
+    for (const part of parts.slice(1)) {
+      current.populate = { path: part };
+      current = current.populate;
     }
 
-    const refModel = this._resolveModel(refModelName, model);
-
-    const as = parentAlias ? `${parentAlias}.${path}` : path;
-
-    return {
-      refModel,
-      collection: this._resolveCollectionName(refModelName, refModel),
-      localField: as,
-      foreignField: "_id",
-      as,
-      isArray,
-    };
+    return root;
   }
 
-  _resolveModel(refModelName, currentModel) {
-    const connection = currentModel?.db || this.model?.db || mongoose.connection;
+  _dedupePopulate(items) {
+    const map = new Map();
+
+    for (const item of items) {
+      if (!item?.path) continue;
 
-    return connection.models?.[refModelName] || mongoose.models?.[refModelName] || null;
-  }
+      if (!map.has(item.path)) {
+        map.set(item.path, item);
+        continue;
+      }
 
-  _resolveCollectionName(refModelName, refModel) {
-    if (refModel?.collection?.name) {
-      return refModel.collection.name;
+      const existing = map.get(item.path);
+      map.set(item.path, this._mergePopulateOptions(existing, item));
     }
 
-    return pluralize(String(refModelName).toLowerCase());
+    return [...map.values()];
   }
 
-  _buildPopulateProjection(select, alias) {
-    const fields = String(select)
-      .split(" ")
-      .map((field) => field.trim())
-      .filter(Boolean);
-
-    const hasInclude = fields.some((field) => !field.startsWith("-"));
-    const hasExclude = fields.some((field) => field.startsWith("-"));
+  _mergePopulateOptions(a, b) {
+    const merged = { ...a, ...b };
 
-    if (hasInclude && hasExclude) {
-      throw new HandleERROR(
-        "Cannot mix include and exclude in populate select",
-        400
-      );
-    }
+    if (a.populate || b.populate) {
+      const aList = Array.isArray(a.populate)
+        ? a.populate
+        : a.populate
+          ? [a.populate]
+          : [];
 
-    const project = {};
+      const bList = Array.isArray(b.populate)
+        ? b.populate
+        : b.populate
+          ? [b.populate]
+          : [];
 
-    for (const field of fields) {
-      const cleanField = field.replace(/^-/, "");
-
-      if (this._isForbiddenField(cleanField)) continue;
-
-      project[`${alias}.${cleanField}`] = field.startsWith("-") ? 0 : 1;
+      merged.populate = this._dedupePopulate([...aList, ...bList]);
     }
 
-    return project;
+    return merged;
   }
 
   _isPopulateAllowed(path, allowedPopulate = []) {
@@ -583,6 +957,36 @@ export class ApiFeatures {
     );
   }
 
+  _resolveCollectionName(refModelName = "") {
+    return pluralize(String(refModelName).toLowerCase());
+  }
+
+  _resolveRegisteredSchema(refModelName = "") {
+    const connection = this.model?.db || mongoose.connection;
+    const registeredModel =
+      connection.models?.[refModelName] || mongoose.models?.[refModelName];
+
+    return registeredModel?.schema || null;
+  }
+
+  _inferModelNameFromPath(path = "") {
+    let clean = String(path).split(".").pop();
+
+    clean = clean.replace(/Ids$/i, "");
+    clean = clean.replace(/Id$/i, "");
+    clean = pluralize.singular(clean);
+
+    return clean
+      .split(/[_-\s]+/)
+      .filter(Boolean)
+      .map((part) => part.charAt(0).toUpperCase() + part.slice(1))
+      .join("");
+  }
+
+  _makeTempLookupName(path = "") {
+    return `__vanta_lookup_${String(path).replace(/[^a-zA-Z0-9]/g, "_")}`;
+  }
+
   _isForbiddenField(field) {
     return (securityConfig.forbiddenFields || []).includes(field);
   }
@@ -593,7 +997,11 @@ export class ApiFeatures {
         "$skip" in stage ||
         "$limit" in stage ||
         "$sort" in stage ||
-        "$project" in stage
+        "$project" in stage ||
+        "$lookup" in stage ||
+        "$unwind" in stage ||
+        "$set" in stage ||
+        "$unset" in stage
       );
     });
   }

package/src/errorHandler.js

@@ -1,8 +1,6 @@
 const catchError=(err,req,res,next)=>{
     err.statusCode=err.statusCode || 500
-    err.status=err.status||'error'  
     res.status(err.statusCode).json({
-        status:err.status,
         success:false,
         message:err.message
     })