vanta-api 1.4.2 → 1.4.4

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "vanta-api",
-  "version": "1.4.2",
+  "version": "1.4.4",
   "description": "Advanced API features and security configuration for Node.js/MongoDB.",
   "main": "index.js",
   "scripts": {

package/src/api-features.js

@@ -24,7 +24,6 @@ export class ApiFeatures {
     this.pipeline = [];
     this.manualFilters = {};
     this.useCursor = false;
-
     this.userRole =
       userRole && securityConfig.accessLevels?.[userRole] ? userRole : "guest";
 
@@ -33,10 +32,15 @@ export class ApiFeatures {
 
   filter() {
     const queryFilters = this._parseQueryFilters();
+    const normalizedManualFilters = this._normalizeLogicalOperators(
+      this.manualFilters
+    );
+
     const mergedFilters = this._deepMergeFilters(
       queryFilters,
-      this.manualFilters
+      normalizedManualFilters
     );
+
     const sanitizedFilters = this._sanitizeFilters(mergedFilters);
     const safeFilters = this._applySecurityFilters(sanitizedFilters);
 
@@ -49,7 +53,11 @@ export class ApiFeatures {
 
   addManualFilters(filters = {}) {
     if (filters && typeof filters === "object" && !Array.isArray(filters)) {
-      this.manualFilters = this._deepMergeFilters(this.manualFilters, filters);
+      const normalizedFilters = this._normalizeLogicalOperators(filters);
+      this.manualFilters = this._deepMergeFilters(
+        this.manualFilters,
+        normalizedFilters
+      );
     }
 
     return this;
@@ -57,11 +65,9 @@ export class ApiFeatures {
 
   search(fields = []) {
     const q = this.query.q;
-
     if (!q || !Array.isArray(fields) || !fields.length) return this;
 
     const safeQ = this._escapeRegex(String(q).trim());
-
     if (!safeQ) return this;
 
     const conditions = fields
@@ -109,7 +115,6 @@ export class ApiFeatures {
 
   limitFields(input = "") {
     const rawFields = [input, this.query.fields].filter(Boolean).join(",");
-
     if (!rawFields) return this;
 
     const fields = rawFields
@@ -128,9 +133,7 @@ export class ApiFeatures {
 
     for (const field of fields) {
       const cleanField = field.replace(/^-/, "");
-
       if (this._isForbiddenField(cleanField)) continue;
-
       project[cleanField] = field.startsWith("-") ? 0 : 1;
     }
 
@@ -205,7 +208,6 @@ export class ApiFeatures {
         });
 
         data = [];
-
         for await (const doc of cursor) {
           data.push(doc);
         }
@@ -225,507 +227,66 @@ export class ApiFeatures {
     }
   }
 
-  _addPopulateStages({
-    populateItem,
-    parentPath = "",
-    parentIsArray = false,
-    schema = null,
-    allowedPopulate = [],
-  }) {
-    if (!populateItem || !populateItem.path) return;
-
-    const path = populateItem.path;
-    const fullPath = parentPath ? `${parentPath}.${path}` : path;
-
-    if (!this._isPopulateAllowed(fullPath, allowedPopulate)) {
-      return;
-    }
-
-    const info = this._getPopulateInfo({
-      schema,
-      path,
-      fullPath,
-      parentPath,
-      parentIsArray,
-      populateItem,
-    });
-
-    if (!parentIsArray) {
-      this.pipeline.push({
-        $lookup: {
-          from: info.collection,
-          localField: info.localField,
-          foreignField: "_id",
-          as: info.as,
-        },
-      });
-
-      if (!info.isArray) {
-        this.pipeline.push({
-          $unwind: {
-            path: `$${info.as}`,
-            preserveNullAndEmptyArrays: true,
-          },
-        });
-      }
-
-      if (populateItem.populate) {
-        const nestedList = this._normalizeNestedPopulate(populateItem.populate);
-
-        for (const nested of nestedList) {
-          this._addPopulateStages({
-            populateItem: nested,
-            parentPath: info.as,
-            parentIsArray: info.isArray,
-            schema: info.refSchema,
-            allowedPopulate,
-          });
-        }
-      }
-
-      if (populateItem.select) {
-        this._applyPopulateSelect({
-          path: info.as,
-          select: populateItem.select,
-          isArray: info.isArray,
-        });
-      }
-
-      return;
-    }
-
-    const tempLookupName = this._makeTempLookupName(fullPath);
-
-    this.pipeline.push({
-      $lookup: {
-        from: info.collection,
-        localField: info.localField,
-        foreignField: "_id",
-        as: tempLookupName,
-      },
-    });
-
-    this.pipeline.push({
-      $set: {
-        [parentPath]: {
-          $map: {
-            input: { $ifNull: [`$${parentPath}`, []] },
-            as: "item",
-            in: {
-              $mergeObjects: [
-                "$$item",
-                {
-                  [path]: {
-                    $first: {
-                      $filter: {
-                        input: `$${tempLookupName}`,
-                        as: "joined",
-                        cond: {
-                          $eq: ["$$joined._id", `$$item.${path}`],
-                        },
-                      },
-                    },
-                  },
-                },
-              ],
-            },
-          },
-        },
-      },
-    });
-
-    this.pipeline.push({ $unset: tempLookupName });
-
-    if (populateItem.populate) {
-      const nestedList = this._normalizeNestedPopulate(populateItem.populate);
-
-      for (const nested of nestedList) {
-        this._addNestedPopulateInsideArrayItem({
-          arrayPath: parentPath,
-          objectPath: path,
-          populateItem: nested,
-          allowedPopulate,
-          schema: info.refSchema,
-        });
-      }
-    }
-
-    if (populateItem.select) {
-      this._applyNestedObjectSelectInsideArray({
-        arrayPath: parentPath,
-        objectPath: path,
-        select: populateItem.select,
-      });
-    }
-  }
-
-  _addNestedPopulateInsideArrayItem({
-    arrayPath,
-    objectPath,
-    populateItem,
-    allowedPopulate = [],
-    schema = null,
-  }) {
-    if (!populateItem || !populateItem.path) return;
-
-    const childPath = populateItem.path;
-    const fullPath = `${arrayPath}.${objectPath}.${childPath}`;
-
-    if (!this._isPopulateAllowed(fullPath, allowedPopulate)) {
-      return;
+  _normalizeLogicalOperators(filters = {}) {
+    if (Array.isArray(filters)) {
+      return filters.map((item) => this._normalizeLogicalOperators(item));
     }
 
-    const info = this._getPopulateInfo({
-      schema,
-      path: childPath,
-      fullPath,
-      parentPath: `${arrayPath}.${objectPath}`,
-      parentIsArray: true,
-      populateItem,
-    });
-
-    const tempLookupName = this._makeTempLookupName(fullPath);
-
-    this.pipeline.push({
-      $lookup: {
-        from: info.collection,
-        localField: `${arrayPath}.${objectPath}.${childPath}`,
-        foreignField: "_id",
-        as: tempLookupName,
-      },
-    });
-
-    this.pipeline.push({
-      $set: {
-        [arrayPath]: {
-          $map: {
-            input: { $ifNull: [`$${arrayPath}`, []] },
-            as: "item",
-            in: {
-              $mergeObjects: [
-                "$$item",
-                {
-                  [objectPath]: {
-                    $cond: [
-                      { $ne: [`$$item.${objectPath}`, null] },
-                      {
-                        $mergeObjects: [
-                          `$$item.${objectPath}`,
-                          {
-                            [childPath]: {
-                              $first: {
-                                $filter: {
-                                  input: `$${tempLookupName}`,
-                                  as: "joined",
-                                  cond: {
-                                    $eq: [
-                                      "$$joined._id",
-                                      `$$item.${objectPath}.${childPath}`,
-                                    ],
-                                  },
-                                },
-                              },
-                            },
-                          },
-                        ],
-                      },
-                      `$$item.${objectPath}`,
-                    ],
-                  },
-                },
-              ],
-            },
-          },
-        },
-      },
-    });
-
-    this.pipeline.push({ $unset: tempLookupName });
+    if (!filters || typeof filters !== "object") return filters;
 
-    if (populateItem.populate) {
-      const nestedList = this._normalizeNestedPopulate(populateItem.populate);
-
-      for (const nested of nestedList) {
-        this._addNestedPopulateInsideArrayItem({
-          arrayPath,
-          objectPath: `${objectPath}.${childPath}`,
-          populateItem: nested,
-          allowedPopulate,
-          schema: info.refSchema,
-        });
-      }
+    if (
+      filters instanceof mongoose.Types.ObjectId ||
+      filters instanceof ObjectId ||
+      filters instanceof Date
+    ) {
+      return filters;
     }
 
-    if (populateItem.select) {
-      this._applyNestedObjectSelectInsideArray({
-        arrayPath,
-        objectPath: `${objectPath}.${childPath}`,
-        select: populateItem.select,
-      });
-    }
-  }
-
-  _getPopulateInfo({
-    schema = null,
-    path,
-    fullPath,
-    parentPath = "",
-    parentIsArray = false,
-    populateItem = {},
-  }) {
-    const schemaPath = schema?.path?.(path);
-
-    const isArray =
-      populateItem.isArray === true ||
-      schemaPath?.instance === "Array" ||
-      Array.isArray(schemaPath?.options?.type);
-
-    const refModelName =
-      populateItem.ref ||
-      populateItem.modelName ||
-      schemaPath?.options?.ref ||
-      schemaPath?.caster?.options?.ref ||
-      (Array.isArray(schemaPath?.options?.type)
-        ? schemaPath.options.type[0]?.ref
-        : undefined) ||
-      this._inferModelNameFromPath(path);
-
-    const collection =
-      populateItem.collection ||
-      populateItem.from ||
-      this._resolveCollectionName(refModelName);
-
-    const refSchema = this._resolveRegisteredSchema(refModelName);
-
-    return {
-      path,
-      fullPath,
-      refModelName,
-      collection,
-      refSchema,
-      isArray,
-      localField: parentIsArray ? fullPath : fullPath,
-      as: fullPath,
-      parentPath,
-      parentIsArray,
-    };
-  }
-
-  _applyPopulateSelect({ path, select, isArray }) {
-    const parsed = this._parseSelect(select);
-
-    if (!parsed.fields.length) return;
-
-    if (parsed.mode === "exclude") {
-      this.pipeline.push({
-        $unset: parsed.fields.map((field) => `${path}.${field}`),
-      });
-      return;
-    }
-
-    const includeFields = this._ensureIdField(parsed.fields);
-
-    if (isArray) {
-      const selectedObject = {};
-
-      for (const field of includeFields) {
-        selectedObject[field] = `$$item.${field}`;
-      }
-
-      this.pipeline.push({
-        $set: {
-          [path]: {
-            $map: {
-              input: { $ifNull: [`$${path}`, []] },
-              as: "item",
-              in: selectedObject,
-            },
-          },
-        },
-      });
-
-      return;
-    }
-
-    const selectedObject = {};
-
-    for (const field of includeFields) {
-      selectedObject[field] = `$${path}.${field}`;
-    }
-
-    this.pipeline.push({
-      $set: {
-        [path]: {
-          $cond: [{ $ne: [`$${path}`, null] }, selectedObject, `$${path}`],
-        },
-      },
-    });
-  }
-
-  _applyNestedObjectSelectInsideArray({ arrayPath, objectPath, select }) {
-    const parsed = this._parseSelect(select);
-
-    if (!parsed.fields.length) return;
-
-    if (parsed.mode === "exclude") {
-      this.pipeline.push({
-        $unset: parsed.fields.map(
-          (field) => `${arrayPath}.${objectPath}.${field}`
-        ),
-      });
-      return;
-    }
-
-    const includeFields = this._ensureIdField(parsed.fields);
-    const selectedObject = {};
-
-    for (const field of includeFields) {
-      selectedObject[field] = `$$item.${objectPath}.${field}`;
-    }
-
-    this.pipeline.push({
-      $set: {
-        [arrayPath]: {
-          $map: {
-            input: { $ifNull: [`$${arrayPath}`, []] },
-            as: "item",
-            in: {
-              $mergeObjects: [
-                "$$item",
-                {
-                  [objectPath]: {
-                    $cond: [
-                      { $ne: [`$$item.${objectPath}`, null] },
-                      selectedObject,
-                      `$$item.${objectPath}`,
-                    ],
-                  },
-                },
-              ],
-            },
-          },
-        },
-      },
-    });
-  }
-
-  _parseSelect(select = "") {
-    const fields = String(select)
-      .split(/\s+/)
-      .map((field) => field.trim())
-      .filter(Boolean)
-      .filter((field) => {
-        const cleanField = field.replace(/^-/, "");
-        return !this._isForbiddenField(cleanField);
-      });
+    const out = {};
 
-    const hasInclude = fields.some((field) => !field.startsWith("-"));
-    const hasExclude = fields.some((field) => field.startsWith("-"));
+    for (const [key, value] of Object.entries(filters)) {
+      const normalizedKey =
+        key === "and" ? "$and" : key === "or" ? "$or" : key === "nor" ? "$nor" : key;
 
-    if (hasInclude && hasExclude) {
-      throw new HandleERROR(
-        "Cannot mix include and exclude in populate select",
-        400
-      );
+      out[normalizedKey] = this._normalizeLogicalOperators(value);
     }
 
-    return {
-      mode: hasExclude ? "exclude" : "include",
-      fields: fields.map((field) => field.replace(/^-/, "")),
-    };
-  }
-
-  _ensureIdField(fields = []) {
-    return fields.includes("_id") ? fields : ["_id", ...fields];
+    return out;
   }
 
-  _sanitization() {
-    for (const key of Object.keys(this.query)) {
+  _sanitizeFilters(filters = {}) {
+    const sanitizeNode = (node, key = "", parentKey = "") => {
       if (
-        key.startsWith("$") ||
-        ["$where", "$accumulator", "$function"].includes(key)
+        node instanceof mongoose.Types.ObjectId ||
+        node instanceof ObjectId ||
+        node instanceof Date
       ) {
-        delete this.query[key];
-      }
-    }
-
-    ["page", "limit"].forEach((field) => {
-      if (this.query[field] && !/^[0-9]+$/.test(String(this.query[field]))) {
-        throw new HandleERROR(`Invalid ${field}`, 400);
-      }
-    });
-  }
-
-  _parseQueryFilters() {
-    const obj = { ...this.query };
-
-    RESERVED_QUERY_KEYS.forEach((key) => delete obj[key]);
-
-    const out = {};
-
-    for (const [rawKey, rawVal] of Object.entries(obj)) {
-      const bracketMatch = rawKey.match(/^(.+)\[\$?(\w+)\]$/);
-
-      if (bracketMatch) {
-        const [, field, op] = bracketMatch;
-        const cleanOp = op.replace(/^\$/, "");
-
-        if (securityConfig.allowedOperators?.includes(cleanOp)) {
-          out[field] = {
-            ...(out[field] || {}),
-            [`$${cleanOp}`]: rawVal,
-          };
-        }
-
-        continue;
-      }
-
-      if (rawVal && typeof rawVal === "object" && !Array.isArray(rawVal)) {
-        out[rawKey] = out[rawKey] || {};
-
-        for (const [op, val] of Object.entries(rawVal)) {
-          const cleanOp = op.replace(/^\$/, "");
-
-          if (securityConfig.allowedOperators?.includes(cleanOp)) {
-            out[rawKey][`$${cleanOp}`] = val;
-          }
-        }
-
-        continue;
-      }
-
-      if (typeof rawVal === "string" && rawVal.includes(",")) {
-        out[rawKey] = rawVal.split(",").map((v) => v.trim());
-      } else {
-        out[rawKey] = rawVal;
+        return node;
       }
-    }
-
-    return out;
-  }
 
-  _sanitizeFilters(filters = {}) {
-    const sanitizeNode = (node, key = "") => {
       if (node === null || node === "null") return null;
       if (node === "true") return true;
       if (node === "false") return false;
 
       if (Array.isArray(node)) {
-        return node.map((item) => sanitizeNode(item, key));
+        return node.map((item) => sanitizeNode(item, key, parentKey));
       }
 
       if (node && typeof node === "object") {
         const result = {};
 
         for (const [childKey, childVal] of Object.entries(node)) {
-          result[childKey] = sanitizeNode(childVal, childKey);
+          result[childKey] = sanitizeNode(childVal, childKey, key);
         }
 
         return result;
       }
 
       if (typeof node === "string") {
-        if (this.#isStrictObjectId(node) && this._shouldConvertToObjectId(key)) {
+        if (
+          this.#isStrictObjectId(node) &&
+          this._shouldConvertToObjectId(key, parentKey)
+        ) {
           return new ObjectId(node);
         }
 
@@ -742,17 +303,26 @@ export class ApiFeatures {
     return sanitizeNode(filters);
   }
 
-  _shouldConvertToObjectId(key = "") {
+  _shouldConvertToObjectId(key = "", parentKey = "") {
     const cleanKey = String(key).replace(/^\$/, "").toLowerCase();
+    const cleanParentKey = String(parentKey).replace(/^\$/, "").toLowerCase();
 
-    return (
+    if (
       cleanKey === "_id" ||
       cleanKey === "id" ||
       cleanKey.endsWith("id") ||
-      cleanKey === "eq" ||
-      cleanKey === "ne" ||
-      cleanKey === "in" ||
-      cleanKey === "nin"
+      cleanParentKey === "_id" ||
+      cleanParentKey === "id" ||
+      cleanParentKey.endsWith("id")
+    ) {
+      return true;
+    }
+
+    return (
+      ["eq", "ne", "in", "nin"].includes(cleanKey) &&
+      (cleanParentKey === "_id" ||
+        cleanParentKey === "id" ||
+        cleanParentKey.endsWith("id"))
     );
   }
 
@@ -780,6 +350,14 @@ export class ApiFeatures {
 
   _applySecurityFilters(filters = {}) {
     const cleanNode = (node) => {
+      if (
+        node instanceof mongoose.Types.ObjectId ||
+        node instanceof ObjectId ||
+        node instanceof Date
+      ) {
+        return node;
+      }
+
       if (Array.isArray(node)) {
         return node.map(cleanNode);
       }
@@ -792,7 +370,6 @@ export class ApiFeatures {
 
       for (const [key, value] of Object.entries(node)) {
         if (this._isForbiddenField(key)) continue;
-
         result[key] = cleanNode(value);
       }
 
@@ -802,6 +379,74 @@ export class ApiFeatures {
     return cleanNode(filters);
   }
 
+  _addPopulateStages(args) {
+    return ApiFeatures.prototype.__proto__?._addPopulateStages?.call(this, args);
+  }
+
+  _parseQueryFilters() {
+    const obj = { ...this.query };
+    RESERVED_QUERY_KEYS.forEach((key) => delete obj[key]);
+
+    const out = {};
+
+    for (const [rawKey, rawVal] of Object.entries(obj)) {
+      const bracketMatch = rawKey.match(/^(.+)\[\$?(\w+)\]$/);
+
+      if (bracketMatch) {
+        const [, field, op] = bracketMatch;
+        const cleanOp = op.replace(/^\$/, "");
+
+        if (securityConfig.allowedOperators?.includes(cleanOp)) {
+          out[field] = {
+            ...(out[field] || {}),
+            [`$${cleanOp}`]: rawVal,
+          };
+        }
+
+        continue;
+      }
+
+      if (rawVal && typeof rawVal === "object" && !Array.isArray(rawVal)) {
+        out[rawKey] = out[rawKey] || {};
+
+        for (const [op, val] of Object.entries(rawVal)) {
+          const cleanOp = op.replace(/^\$/, "");
+
+          if (securityConfig.allowedOperators?.includes(cleanOp)) {
+            out[rawKey][`$${cleanOp}`] = val;
+          }
+        }
+
+        continue;
+      }
+
+      if (typeof rawVal === "string" && rawVal.includes(",")) {
+        out[rawKey] = rawVal.split(",").map((v) => v.trim());
+      } else {
+        out[rawKey] = rawVal;
+      }
+    }
+
+    return out;
+  }
+
+  _sanitization() {
+    for (const key of Object.keys(this.query)) {
+      if (
+        key.startsWith("$") ||
+        ["$where", "$accumulator", "$function"].includes(key)
+      ) {
+        delete this.query[key];
+      }
+    }
+
+    ["page", "limit"].forEach((field) => {
+      if (this.query[field] && !/^[0-9]+$/.test(String(this.query[field]))) {
+        throw new HandleERROR(`Invalid ${field}`, 400);
+      }
+    });
+  }
+
   _normalizePopulateInput(input = "") {
     const raw = [];
 
@@ -821,7 +466,6 @@ export class ApiFeatures {
 
       if (typeof item === "string") {
         const trimmed = item.trim();
-
         if (!trimmed) return;
 
         if (trimmed.includes(".")) {
@@ -877,9 +521,11 @@ export class ApiFeatures {
       return input
         .flatMap((item) => {
           if (typeof item === "string") return this._normalizePopulateInput(item);
+
           if (item && typeof item === "object" && item.path) {
             return [this._normalizePopulateObject(item)];
           }
+
           return [];
         })
         .filter(Boolean);