fix(core): Improve error handling and logging; enhance search query sanitization; update dependency versions and documentation

ts/classes.doc.ts

@@ -1,6 +1,7 @@
 import * as plugins from './plugins.js';
 
 import { SmartdataDb } from './classes.db.js';
+import { logger } from './logging.js';
 import { SmartdataDbCursor } from './classes.cursor.js';
 import { type IManager, SmartdataCollection } from './classes.collection.js';
 import { SmartdataDbWatcher } from './classes.watcher.js';
@@ -31,7 +32,7 @@ export type TDocCreation = 'db' | 'new' | 'mixed';
 
 export function globalSvDb() {
   return (target: SmartDataDbDoc<unknown, unknown>, key: string) => {
-    console.log(`called svDb() on >${target.constructor.name}.${key}<`);
+    logger.log('debug', `called svDb() on >${target.constructor.name}.${key}<`);
     if (!target.globalSaveableProperties) {
       target.globalSaveableProperties = [];
     }
@@ -54,7 +55,7 @@ export interface SvDbOptions {
  */
 export function svDb(options?: SvDbOptions) {
   return (target: SmartDataDbDoc<unknown, unknown>, key: string) => {
-    console.log(`called svDb() on >${target.constructor.name}.${key}<`);
+    logger.log('debug', `called svDb() on >${target.constructor.name}.${key}<`);
     if (!target.saveableProperties) {
       target.saveableProperties = [];
     }
@@ -94,7 +95,7 @@ function escapeForRegex(input: string): string {
  */
 export function unI() {
   return (target: SmartDataDbDoc<unknown, unknown>, key: string) => {
-    console.log(`called unI on >>${target.constructor.name}.${key}<<`);
+    logger.log('debug', `called unI on >>${target.constructor.name}.${key}<<`);
 
     // mark the index as unique
     if (!target.uniqueIndexes) {
@@ -126,7 +127,7 @@ export interface IIndexOptions {
  */
 export function index(options?: IIndexOptions) {
   return (target: SmartDataDbDoc<unknown, unknown>, key: string) => {
-    console.log(`called index() on >${target.constructor.name}.${key}<`);
+    logger.log('debug', `called index() on >${target.constructor.name}.${key}<`);
     
     // Initialize regular indexes array if it doesn't exist
     if (!target.regularIndexes) {
@@ -152,7 +153,8 @@ export function index(options?: IIndexOptions) {
 
 export const convertFilterForMongoDb = (filterArg: { [key: string]: any }) => {
   // Special case: detect MongoDB operators and pass them through directly
-  const topLevelOperators = ['$and', '$or', '$nor', '$not', '$text', '$where', '$regex'];
+  // SECURITY: Removed $where to prevent server-side JS execution
+  const topLevelOperators = ['$and', '$or', '$nor', '$not', '$text', '$regex'];
   for (const key of Object.keys(filterArg)) {
     if (topLevelOperators.includes(key)) {
       return filterArg; // Return the filter as-is for MongoDB operators
@@ -164,11 +166,16 @@ export const convertFilterForMongoDb = (filterArg: { [key: string]: any }) => {
 
   const convertFilterArgument = (keyPathArg2: string, filterArg2: any) => {
     if (Array.isArray(filterArg2)) {
-      // Directly assign arrays (they might be using operators like $in or $all)
-      convertFilterArgument(keyPathArg2, filterArg2[0]);
+      // FIX: Properly handle arrays for operators like $in, $all, or plain equality
+      convertedFilter[keyPathArg2] = filterArg2;
+      return;
     } else if (typeof filterArg2 === 'object' && filterArg2 !== null) {
       for (const key of Object.keys(filterArg2)) {
         if (key.startsWith('$')) {
+          // Prevent dangerous operators
+          if (key === '$where') {
+            throw new Error('$where operator is not allowed for security reasons');
+          }
           convertedFilter[keyPathArg2] = filterArg2;
           return;
         } else if (key.includes('.')) {
@@ -614,7 +621,7 @@ export class SmartDataDbDoc<T extends TImplements, TImplements, TManager extends
         this.creationStatus = 'db';
         break;
       default:
-        console.error('neither new nor in db?');
+        logger.log('error', 'neither new nor in db?');
     }
     // allow hook after saving
     if (typeof (this as any).afterSave === 'function') {
@@ -661,8 +668,11 @@ export class SmartDataDbDoc<T extends TImplements, TImplements, TManager extends
   /**
    * updates an object from db
    */
-  public async updateFromDb() {
+  public async updateFromDb(): Promise<boolean> {
     const mongoDbNativeDoc = await this.collection.findOne(await this.createIdentifiableObject());
+    if (!mongoDbNativeDoc) {
+      return false; // Document not found in database
+    }
     for (const key of Object.keys(mongoDbNativeDoc)) {
       const rawValue = mongoDbNativeDoc[key];
       const optionsMap = (this.constructor as any)._svDbOptions || {};
@@ -671,6 +681,7 @@ export class SmartDataDbDoc<T extends TImplements, TImplements, TManager extends
         ? opts.deserialize(rawValue)
         : rawValue;
     }
+    return true;
   }
 
   /**
@@ -678,7 +689,9 @@ export class SmartDataDbDoc<T extends TImplements, TImplements, TManager extends
    */
   public async createSavableObject(): Promise<TImplements> {
     const saveableObject: unknown = {}; // is not exposed to outside, so any is ok here
-    const saveableProperties = [...this.globalSaveableProperties, ...this.saveableProperties];
+    const globalProps = this.globalSaveableProperties || [];
+    const specificProps = this.saveableProperties || [];
+    const saveableProperties = [...globalProps, ...specificProps];
     // apply custom serialization if configured
     const optionsMap = (this.constructor as any)._svDbOptions || {};
     for (const propertyNameString of saveableProperties) {