@terreno/api 0.0.1

package/dist/api.js

@@ -0,0 +1,1024 @@
+"use strict";
+var __assign = (this && this.__assign) || function () {
+    __assign = Object.assign || function(t) {
+        for (var s, i = 1, n = arguments.length; i < n; i++) {
+            s = arguments[i];
+            for (var p in s) if (Object.prototype.hasOwnProperty.call(s, p))
+                t[p] = s[p];
+        }
+        return t;
+    };
+    return __assign.apply(this, arguments);
+};
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, generator) {
+    function adopt(value) { return value instanceof P ? value : new P(function (resolve) { resolve(value); }); }
+    return new (P || (P = Promise))(function (resolve, reject) {
+        function fulfilled(value) { try { step(generator.next(value)); } catch (e) { reject(e); } }
+        function rejected(value) { try { step(generator["throw"](value)); } catch (e) { reject(e); } }
+        function step(result) { result.done ? resolve(result.value) : adopt(result.value).then(fulfilled, rejected); }
+        step((generator = generator.apply(thisArg, _arguments || [])).next());
+    });
+};
+var __generator = (this && this.__generator) || function (thisArg, body) {
+    var _ = { label: 0, sent: function() { if (t[0] & 1) throw t[1]; return t[1]; }, trys: [], ops: [] }, f, y, t, g = Object.create((typeof Iterator === "function" ? Iterator : Object).prototype);
+    return g.next = verb(0), g["throw"] = verb(1), g["return"] = verb(2), typeof Symbol === "function" && (g[Symbol.iterator] = function() { return this; }), g;
+    function verb(n) { return function (v) { return step([n, v]); }; }
+    function step(op) {
+        if (f) throw new TypeError("Generator is already executing.");
+        while (g && (g = 0, op[0] && (_ = 0)), _) try {
+            if (f = 1, y && (t = op[0] & 2 ? y["return"] : op[0] ? y["throw"] || ((t = y["return"]) && t.call(y), 0) : y.next) && !(t = t.call(y, op[1])).done) return t;
+            if (y = 0, t) op = [op[0] & 2, t.value];
+            switch (op[0]) {
+                case 0: case 1: t = op; break;
+                case 4: _.label++; return { value: op[1], done: false };
+                case 5: _.label++; y = op[1]; op = [0]; continue;
+                case 7: op = _.ops.pop(); _.trys.pop(); continue;
+                default:
+                    if (!(t = _.trys, t = t.length > 0 && t[t.length - 1]) && (op[0] === 6 || op[0] === 2)) { _ = 0; continue; }
+                    if (op[0] === 3 && (!t || (op[1] > t[0] && op[1] < t[3]))) { _.label = op[1]; break; }
+                    if (op[0] === 6 && _.label < t[1]) { _.label = t[1]; t = op; break; }
+                    if (t && _.label < t[2]) { _.label = t[2]; _.ops.push(op); break; }
+                    if (t[2]) _.ops.pop();
+                    _.trys.pop(); continue;
+            }
+            op = body.call(thisArg, _);
+        } catch (e) { op = [6, e]; y = 0; } finally { f = t = 0; }
+        if (op[0] & 5) throw op[1]; return { value: op[0] ? op[1] : void 0, done: true };
+    }
+};
+var __values = (this && this.__values) || function(o) {
+    var s = typeof Symbol === "function" && Symbol.iterator, m = s && o[s], i = 0;
+    if (m) return m.call(o);
+    if (o && typeof o.length === "number") return {
+        next: function () {
+            if (o && i >= o.length) o = void 0;
+            return { value: o && o[i++], done: !o };
+        }
+    };
+    throw new TypeError(s ? "Object is not iterable." : "Symbol.iterator is not defined.");
+};
+var __read = (this && this.__read) || function (o, n) {
+    var m = typeof Symbol === "function" && o[Symbol.iterator];
+    if (!m) return o;
+    var i = m.call(o), r, ar = [], e;
+    try {
+        while ((n === void 0 || n-- > 0) && !(r = i.next()).done) ar.push(r.value);
+    }
+    catch (error) { e = { error: error }; }
+    finally {
+        try {
+            if (r && !r.done && (m = i["return"])) m.call(i);
+        }
+        finally { if (e) throw e.error; }
+    }
+    return ar;
+};
+var __spreadArray = (this && this.__spreadArray) || function (to, from, pack) {
+    if (pack || arguments.length === 2) for (var i = 0, l = from.length, ar; i < l; i++) {
+        if (ar || !(i in from)) {
+            if (!ar) ar = Array.prototype.slice.call(from, 0, i);
+            ar[i] = from[i];
+        }
+    }
+    return to.concat(ar || Array.prototype.slice.call(from));
+};
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.gooseRestRouter = exports.asyncHandler = void 0;
+exports.addPopulateToQuery = addPopulateToQuery;
+exports.getModel = getModel;
+exports.modelRouter = modelRouter;
+/**
+ * This is the doc comment for api.ts
+ *
+ * @packageDocumentation
+ */
+var Sentry = __importStar(require("@sentry/node"));
+var express_1 = __importDefault(require("express"));
+var cloneDeep_1 = __importDefault(require("lodash/cloneDeep"));
+var mongoose_1 = __importDefault(require("mongoose"));
+var auth_1 = require("./auth");
+var errors_1 = require("./errors");
+var logger_1 = require("./logger");
+var openApi_1 = require("./openApi");
+var permissions_1 = require("./permissions");
+var transformers_1 = require("./transformers");
+var utils_1 = require("./utils");
+function addPopulateToQuery(builtQuery, populatePaths) {
+    var e_1, _a;
+    var paths = populatePaths !== null && populatePaths !== void 0 ? populatePaths : [];
+    var query = builtQuery;
+    try {
+        for (var paths_1 = __values(paths), paths_1_1 = paths_1.next(); !paths_1_1.done; paths_1_1 = paths_1.next()) {
+            var populatePath = paths_1_1.value;
+            var path = populatePath.path;
+            var select = populatePath.fields;
+            query = builtQuery.populate({ path: path, select: select });
+        }
+    }
+    catch (e_1_1) { e_1 = { error: e_1_1 }; }
+    finally {
+        try {
+            if (paths_1_1 && !paths_1_1.done && (_a = paths_1.return)) _a.call(paths_1);
+        }
+        finally { if (e_1) throw e_1.error; }
+    }
+    return query;
+}
+// TODOS:
+// Support bulk actions
+// Support more complex query fields
+// Rate limiting
+// These are the query params that are reserved for pagination.
+var PAGINATION_QUERY_PARAMS = ["limit", "page", "sort"];
+// Add support for more complex queries.
+var COMPLEX_QUERY_PARAMS = ["$and", "$or"];
+// A function to decide which model to use. If no discriminators are provided,
+// just returns the base model. If
+function getModel(baseModel, body, options) {
+    var _a, _b;
+    var discriminatorKey = (_a = options === null || options === void 0 ? void 0 : options.discriminatorKey) !== null && _a !== void 0 ? _a : "__t";
+    var modelName = body === null || body === void 0 ? void 0 : body[discriminatorKey];
+    if (!modelName) {
+        return baseModel;
+    }
+    var model = (_b = baseModel.discriminators) === null || _b === void 0 ? void 0 : _b[modelName];
+    if (!model) {
+        throw new Error("Could not find discriminator model for key ".concat(modelName, ", baseModel: ").concat(baseModel));
+    }
+    return model;
+}
+// Ensures query params are allowed. Also checks nested query params when using $and/$or.
+function checkQueryParamAllowed(queryParam, queryParamValue, queryFields) {
+    var e_2, _a, e_3, _b;
+    if (queryFields === void 0) { queryFields = []; }
+    // Check the values of each of the complex query params. We don't support recursive queries here,
+    // just one level of and/or
+    if (COMPLEX_QUERY_PARAMS.includes(queryParam)) {
+        try {
+            // Complex query of the form `$and: [{key1: value1}, {key2: value2}]`
+            for (var queryParamValue_1 = __values(queryParamValue), queryParamValue_1_1 = queryParamValue_1.next(); !queryParamValue_1_1.done; queryParamValue_1_1 = queryParamValue_1.next()) {
+                var subQuery = queryParamValue_1_1.value;
+                try {
+                    for (var _c = (e_3 = void 0, __values(Object.keys(subQuery))), _d = _c.next(); !_d.done; _d = _c.next()) {
+                        var subKey = _d.value;
+                        checkQueryParamAllowed(subKey, subQuery[subKey], queryFields);
+                    }
+                }
+                catch (e_3_1) { e_3 = { error: e_3_1 }; }
+                finally {
+                    try {
+                        if (_d && !_d.done && (_b = _c.return)) _b.call(_c);
+                    }
+                    finally { if (e_3) throw e_3.error; }
+                }
+            }
+        }
+        catch (e_2_1) { e_2 = { error: e_2_1 }; }
+        finally {
+            try {
+                if (queryParamValue_1_1 && !queryParamValue_1_1.done && (_a = queryParamValue_1.return)) _a.call(queryParamValue_1);
+            }
+            finally { if (e_2) throw e_2.error; }
+        }
+        return;
+    }
+    if (!queryFields.includes(queryParam)) {
+        throw new errors_1.APIError({
+            status: 400,
+            title: "".concat(queryParam, " is not allowed as a query param."),
+        });
+    }
+}
+// Handles dot notation patches, creates a normal object to be used for updates.
+// function flattenDotNotationPatch(data: any) {
+//   const result = {};
+//
+//   for (const key in data) {
+//     if (data.hasOwnProperty(key)) {
+//       if (typeof data[key] === "object" && !key.includes(".")) {
+//         // If the value is an object and the key does not contain a dot, merge it
+//         merge(result, {[key]: data[key]});
+//       } else {
+//         // Otherwise, use _.set() to handle dot notation
+//         set(result, key, data[key]);
+//       }
+//     }
+//   }
+//
+//   return result;
+// }
+/**
+ * Create a set of CRUD routes given a Mongoose model $baseModel and configuration options.
+ *
+ * @param baseModel A Mongoose Model
+ * @param options Options for configuring the REST API, such as permissions, transformers, and hooks.
+ */
+function modelRouter(baseModel, options) {
+    var _this = this;
+    var _a;
+    var router = express_1.default.Router();
+    // Do before the other router options so endpoints take priority.
+    if (options.endpoints) {
+        options.endpoints(router);
+    }
+    var responseHandler = (_a = options.responseHandler) !== null && _a !== void 0 ? _a : transformers_1.defaultResponseHandler;
+    router.post("/", [
+        (0, auth_1.authenticateMiddleware)(options.allowAnonymous),
+        (0, openApi_1.createOpenApiMiddleware)(baseModel, options),
+        (0, permissions_1.permissionMiddleware)(baseModel, options),
+    ], (0, exports.asyncHandler)(function (req, res) { return __awaiter(_this, void 0, void 0, function () {
+        var model, body, error_1, data, error_2, populateQuery, error_3, error_4, serialized, error_5;
+        var _a;
+        return __generator(this, function (_b) {
+            switch (_b.label) {
+                case 0:
+                    model = getModel(baseModel, (_a = req.body) === null || _a === void 0 ? void 0 : _a.__t, options);
+                    try {
+                        body = (0, transformers_1.transform)(options, req.body, "create", req.user);
+                    }
+                    catch (error) {
+                        throw new errors_1.APIError({
+                            disableExternalErrorTracking: (0, errors_1.getDisableExternalErrorTracking)(error),
+                            error: error,
+                            status: 400,
+                            title: error.message,
+                        });
+                    }
+                    if (!options.preCreate) return [3 /*break*/, 5];
+                    _b.label = 1;
+                case 1:
+                    _b.trys.push([1, 3, , 4]);
+                    return [4 /*yield*/, options.preCreate(body, req)];
+                case 2:
+                    body = _b.sent();
+                    return [3 /*break*/, 4];
+                case 3:
+                    error_1 = _b.sent();
+                    if ((0, errors_1.isAPIError)(error_1)) {
+                        throw error_1;
+                    }
+                    throw new errors_1.APIError({
+                        disableExternalErrorTracking: (0, errors_1.getDisableExternalErrorTracking)(error_1),
+                        error: error_1,
+                        status: 400,
+                        title: "preCreate hook error: ".concat(error_1.message),
+                    });
+                case 4:
+                    if (body === undefined) {
+                        throw new errors_1.APIError({
+                            detail: "A body must be returned from preCreate",
+                            status: 403,
+                            title: "Create not allowed",
+                        });
+                    }
+                    if (body === null) {
+                        throw new errors_1.APIError({
+                            detail: "preCreate hook returned null",
+                            status: 403,
+                            title: "Create not allowed",
+                        });
+                    }
+                    _b.label = 5;
+                case 5:
+                    if (body === undefined) {
+                        throw new errors_1.APIError({
+                            detail: "Body is undefined",
+                            status: 400,
+                            title: "Invalid request body",
+                        });
+                    }
+                    _b.label = 6;
+                case 6:
+                    _b.trys.push([6, 8, , 9]);
+                    return [4 /*yield*/, model.create(body)];
+                case 7:
+                    data = _b.sent();
+                    return [3 /*break*/, 9];
+                case 8:
+                    error_2 = _b.sent();
+                    throw new errors_1.APIError({
+                        disableExternalErrorTracking: (0, errors_1.getDisableExternalErrorTracking)(error_2),
+                        error: error_2,
+                        status: 400,
+                        title: error_2.message,
+                    });
+                case 9:
+                    if (!options.populatePaths) return [3 /*break*/, 13];
+                    _b.label = 10;
+                case 10:
+                    _b.trys.push([10, 12, , 13]);
+                    populateQuery = model.findById(data._id);
+                    populateQuery = addPopulateToQuery(populateQuery, options.populatePaths);
+                    return [4 /*yield*/, populateQuery.exec()];
+                case 11:
+                    data = _b.sent();
+                    return [3 /*break*/, 13];
+                case 12:
+                    error_3 = _b.sent();
+                    throw new errors_1.APIError({
+                        disableExternalErrorTracking: (0, errors_1.getDisableExternalErrorTracking)(error_3),
+                        error: error_3,
+                        status: 400,
+                        title: "Populate error: ".concat(error_3.message),
+                    });
+                case 13:
+                    if (!options.postCreate) return [3 /*break*/, 17];
+                    _b.label = 14;
+                case 14:
+                    _b.trys.push([14, 16, , 17]);
+                    return [4 /*yield*/, options.postCreate(data, req)];
+                case 15:
+                    _b.sent();
+                    return [3 /*break*/, 17];
+                case 16:
+                    error_4 = _b.sent();
+                    throw new errors_1.APIError({
+                        disableExternalErrorTracking: (0, errors_1.getDisableExternalErrorTracking)(error_4),
+                        error: error_4,
+                        status: 400,
+                        title: "postCreate hook error: ".concat(error_4.message),
+                    });
+                case 17:
+                    _b.trys.push([17, 19, , 20]);
+                    return [4 /*yield*/, responseHandler(data, "create", req, options)];
+                case 18:
+                    serialized = _b.sent();
+                    return [2 /*return*/, res.status(201).json({ data: serialized })];
+                case 19:
+                    error_5 = _b.sent();
+                    throw new errors_1.APIError({
+                        disableExternalErrorTracking: (0, errors_1.getDisableExternalErrorTracking)(error_5),
+                        error: error_5,
+                        title: "responseHandler error: ".concat(error_5.message),
+                    });
+                case 20: return [2 /*return*/];
+            }
+        });
+    }); }));
+    // TODO add rate limit
+    router.get("/", [
+        (0, auth_1.authenticateMiddleware)(options.allowAnonymous),
+        (0, permissions_1.permissionMiddleware)(baseModel, options),
+        (0, openApi_1.listOpenApiMiddleware)(baseModel, options),
+    ], (0, exports.asyncHandler)(function (req, res) { return __awaiter(_this, void 0, void 0, function () {
+        var model, query, _a, _b, queryParam, _c, _d, queryParam, queryFilter, error_6, limit, builtQuery, total, populatedQuery, data, error_7, serialized, error_8, more, msg;
+        var e_4, _e, e_5, _f;
+        var _g, _h, _j, _k, _l, _m;
+        return __generator(this, function (_o) {
+            switch (_o.label) {
+                case 0:
+                    model = baseModel;
+                    query = {};
+                    try {
+                        for (_a = __values(Object.keys((_g = options.defaultQueryParams) !== null && _g !== void 0 ? _g : [])), _b = _a.next(); !_b.done; _b = _a.next()) {
+                            queryParam = _b.value;
+                            query[queryParam] = (_h = options.defaultQueryParams) === null || _h === void 0 ? void 0 : _h[queryParam];
+                        }
+                    }
+                    catch (e_4_1) { e_4 = { error: e_4_1 }; }
+                    finally {
+                        try {
+                            if (_b && !_b.done && (_e = _a.return)) _e.call(_a);
+                        }
+                        finally { if (e_4) throw e_4.error; }
+                    }
+                    try {
+                        for (_c = __values(Object.keys(req.query)), _d = _c.next(); !_d.done; _d = _c.next()) {
+                            queryParam = _d.value;
+                            if (PAGINATION_QUERY_PARAMS.includes(queryParam)) {
+                                continue;
+                            }
+                            checkQueryParamAllowed(queryParam, req.query[queryParam], options.queryFields);
+                            // Not sure if this is necessary or if mongoose does the right thing.
+                            if (req.query[queryParam] === "true") {
+                                query[queryParam] = true;
+                            }
+                            else if (req.query[queryParam] === "false") {
+                                query[queryParam] = false;
+                            }
+                            else {
+                                query[queryParam] = req.query[queryParam];
+                            }
+                        }
+                    }
+                    catch (e_5_1) { e_5 = { error: e_5_1 }; }
+                    finally {
+                        try {
+                            if (_d && !_d.done && (_f = _c.return)) _f.call(_c);
+                        }
+                        finally { if (e_5) throw e_5.error; }
+                    }
+                    // Special operators. NOTE: these request Mongo Atlas.
+                    if (req.query.$search) {
+                        (_j = mongoose_1.default.connection.db) === null || _j === void 0 ? void 0 : _j.collection(model.collection.collectionName);
+                    }
+                    if (req.query.$autocomplete) {
+                        (_k = mongoose_1.default.connection.db) === null || _k === void 0 ? void 0 : _k.collection(model.collection.collectionName);
+                    }
+                    if (!options.queryFilter) return [3 /*break*/, 5];
+                    queryFilter = void 0;
+                    _o.label = 1;
+                case 1:
+                    _o.trys.push([1, 3, , 4]);
+                    return [4 /*yield*/, options.queryFilter(req.user, query)];
+                case 2:
+                    queryFilter = _o.sent();
+                    return [3 /*break*/, 4];
+                case 3:
+                    error_6 = _o.sent();
+                    throw new errors_1.APIError({
+                        disableExternalErrorTracking: (0, errors_1.getDisableExternalErrorTracking)(error_6),
+                        error: error_6,
+                        status: 400,
+                        title: "Query filter error: ".concat(error_6),
+                    });
+                case 4:
+                    // If the query filter returns null specifically, we know this is a query that shouldn't
+                    // return any results.
+                    if (queryFilter === null) {
+                        return [2 /*return*/, res.json({ data: [] })];
+                    }
+                    query = __assign(__assign({}, query), queryFilter);
+                    _o.label = 5;
+                case 5:
+                    limit = (_l = options.defaultLimit) !== null && _l !== void 0 ? _l : 100;
+                    if (Number(req.query.limit)) {
+                        limit = Math.min(Number(req.query.limit), (_m = options.maxLimit) !== null && _m !== void 0 ? _m : 500);
+                    }
+                    if (query.period) {
+                        // need to remove 'period' since it isn't part of any schemas but parsed and applied in
+                        // queryFilter instead
+                        query.period = undefined;
+                    }
+                    builtQuery = model.find(query).limit(limit + 1);
+                    return [4 /*yield*/, model.countDocuments(query)];
+                case 6:
+                    total = _o.sent();
+                    if (req.query.page) {
+                        if (Number(req.query.page) === 0 || Number.isNaN(Number(req.query.page))) {
+                            throw new errors_1.APIError({
+                                status: 400,
+                                title: "Invalid page: ".concat(req.query.page),
+                            });
+                        }
+                        builtQuery = builtQuery.skip((Number(req.query.page) - 1) * limit);
+                    }
+                    // Query param sort takes precedence over options.sort.
+                    if (req.query.sort) {
+                        builtQuery = builtQuery.sort(req.query.sort);
+                    }
+                    else if (options.sort) {
+                        builtQuery = builtQuery.sort(options.sort);
+                    }
+                    populatedQuery = addPopulateToQuery(builtQuery, options.populatePaths);
+                    _o.label = 7;
+                case 7:
+                    _o.trys.push([7, 9, , 10]);
+                    return [4 /*yield*/, populatedQuery.exec()];
+                case 8:
+                    data = _o.sent();
+                    return [3 /*break*/, 10];
+                case 9:
+                    error_7 = _o.sent();
+                    throw new errors_1.APIError({
+                        disableExternalErrorTracking: (0, errors_1.getDisableExternalErrorTracking)(error_7),
+                        error: error_7,
+                        title: "List error: ".concat(error_7.stack),
+                    });
+                case 10:
+                    _o.trys.push([10, 12, , 13]);
+                    return [4 /*yield*/, responseHandler(data, "list", req, options)];
+                case 11:
+                    serialized = _o.sent();
+                    return [3 /*break*/, 13];
+                case 12:
+                    error_8 = _o.sent();
+                    throw new errors_1.APIError({
+                        disableExternalErrorTracking: (0, errors_1.getDisableExternalErrorTracking)(error_8),
+                        error: error_8,
+                        title: "responseHandler error: ".concat(error_8.message),
+                    });
+                case 13:
+                    try {
+                        if (serialized && Array.isArray(serialized)) {
+                            more = serialized.length === limit + 1 && serialized.length > 0;
+                            if (more) {
+                                // Slice off the extra document we fetched to determine if more is true or not.
+                                serialized = serialized.slice(0, limit);
+                                if (!req.query.page) {
+                                    msg = "More than ".concat(limit, " results returned for ").concat(model.collection.name, " without pagination, data may be silently truncated. req.query: ").concat(JSON.stringify(req.query));
+                                    logger_1.logger.warn(msg);
+                                    try {
+                                        Sentry.captureMessage(msg);
+                                    }
+                                    catch (error) {
+                                        logger_1.logger.error("Error capturing message: ".concat(error));
+                                    }
+                                }
+                            }
+                            return [2 /*return*/, res.json({
+                                    data: serialized,
+                                    limit: limit,
+                                    more: more,
+                                    page: req.query.page,
+                                    total: total,
+                                })];
+                        }
+                        return [2 /*return*/, res.json({ data: serialized })];
+                    }
+                    catch (error) {
+                        throw new errors_1.APIError({
+                            disableExternalErrorTracking: (0, errors_1.getDisableExternalErrorTracking)(error),
+                            error: error,
+                            title: "Serialization error: ".concat(error.message),
+                        });
+                    }
+                    return [2 /*return*/];
+            }
+        });
+    }); }));
+    router.get("/:id", [
+        (0, auth_1.authenticateMiddleware)(options.allowAnonymous),
+        (0, openApi_1.getOpenApiMiddleware)(baseModel, options),
+        (0, permissions_1.permissionMiddleware)(baseModel, options),
+    ], (0, exports.asyncHandler)(function (req, res) { return __awaiter(_this, void 0, void 0, function () {
+        var data, serialized, error_9;
+        return __generator(this, function (_a) {
+            switch (_a.label) {
+                case 0:
+                    data = req.obj;
+                    _a.label = 1;
+                case 1:
+                    _a.trys.push([1, 3, , 4]);
+                    return [4 /*yield*/, responseHandler(data, "read", req, options)];
+                case 2:
+                    serialized = _a.sent();
+                    return [2 /*return*/, res.json({ data: serialized })];
+                case 3:
+                    error_9 = _a.sent();
+                    throw new errors_1.APIError({
+                        disableExternalErrorTracking: (0, errors_1.getDisableExternalErrorTracking)(error_9),
+                        error: error_9,
+                        title: "responseHandler error: ".concat(error_9.message),
+                    });
+                case 4: return [2 /*return*/];
+            }
+        });
+    }); }));
+    router.put("/:id", (0, auth_1.authenticateMiddleware)(options.allowAnonymous), (0, exports.asyncHandler)(function (_req, _res) { return __awaiter(_this, void 0, void 0, function () {
+        return __generator(this, function (_a) {
+            // Patch is what we want 90% of the time
+            throw new errors_1.APIError({
+                title: "PUT is not supported.",
+            });
+        });
+    }); }));
+    router.patch("/:id", [
+        (0, auth_1.authenticateMiddleware)(options.allowAnonymous),
+        (0, openApi_1.patchOpenApiMiddleware)(baseModel, options),
+        (0, permissions_1.permissionMiddleware)(baseModel, options),
+    ], (0, exports.asyncHandler)(function (req, res) { return __awaiter(_this, void 0, void 0, function () {
+        var model, doc, body, error_10, prevDoc, error_11, populateQuery, error_12, serialized, error_13;
+        var _a;
+        return __generator(this, function (_b) {
+            switch (_b.label) {
+                case 0:
+                    model = getModel(baseModel, req.body, options);
+                    doc = req.obj;
+                    try {
+                        body = (0, transformers_1.transform)(options, req.body, "update", req.user);
+                    }
+                    catch (error) {
+                        throw new errors_1.APIError({
+                            disableExternalErrorTracking: (0, errors_1.getDisableExternalErrorTracking)(error),
+                            error: error,
+                            status: 403,
+                            title: "PATCH failed on ".concat(req.params.id, " for user ").concat((_a = req.user) === null || _a === void 0 ? void 0 : _a.id, ": ").concat(error.message),
+                        });
+                    }
+                    if (!options.preUpdate) return [3 /*break*/, 5];
+                    _b.label = 1;
+                case 1:
+                    _b.trys.push([1, 3, , 4]);
+                    return [4 /*yield*/, options.preUpdate(body, req)];
+                case 2:
+                    // TODO: Send flattened dot notation body to preUpdate, then merge the returned body
+                    // with the original body, maintaining the dot notation. This way we don't have to write
+                    // two preUpdate branches downstream, one looking at the dot notation style and
+                    // one looking at normal object style.
+                    body = _b.sent();
+                    return [3 /*break*/, 4];
+                case 3:
+                    error_10 = _b.sent();
+                    if ((0, errors_1.isAPIError)(error_10)) {
+                        throw error_10;
+                    }
+                    throw new errors_1.APIError({
+                        disableExternalErrorTracking: (0, errors_1.getDisableExternalErrorTracking)(error_10),
+                        error: error_10,
+                        status: 400,
+                        title: "preUpdate hook error on ".concat(req.params.id, ": ").concat(error_10.message),
+                    });
+                case 4:
+                    if (body === undefined) {
+                        throw new errors_1.APIError({
+                            detail: "A body must be returned from preUpdate",
+                            status: 403,
+                            title: "Update not allowed",
+                        });
+                    }
+                    if (body === null) {
+                        throw new errors_1.APIError({
+                            detail: "preUpdate hook on ".concat(req.params.id, " returned null"),
+                            status: 403,
+                            title: "Update not allowed",
+                        });
+                    }
+                    _b.label = 5;
+                case 5:
+                    prevDoc = (0, cloneDeep_1.default)(doc);
+                    _b.label = 6;
+                case 6:
+                    _b.trys.push([6, 8, , 9]);
+                    doc.set(body);
+                    return [4 /*yield*/, doc.save()];
+                case 7:
+                    _b.sent();
+                    return [3 /*break*/, 9];
+                case 8:
+                    error_11 = _b.sent();
+                    throw new errors_1.APIError({
+                        disableExternalErrorTracking: (0, errors_1.getDisableExternalErrorTracking)(error_11),
+                        error: error_11,
+                        status: 400,
+                        title: "preUpdate hook save error on ".concat(req.params.id, ": ").concat(error_11.message),
+                    });
+                case 9:
+                    if (!options.populatePaths) return [3 /*break*/, 11];
+                    populateQuery = model.findById(doc._id);
+                    populateQuery = addPopulateToQuery(populateQuery, options.populatePaths);
+                    return [4 /*yield*/, populateQuery.exec()];
+                case 10:
+                    doc = _b.sent();
+                    _b.label = 11;
+                case 11:
+                    if (!options.postUpdate) return [3 /*break*/, 15];
+                    _b.label = 12;
+                case 12:
+                    _b.trys.push([12, 14, , 15]);
+                    return [4 /*yield*/, options.postUpdate(doc, body, req, prevDoc)];
+                case 13:
+                    _b.sent();
+                    return [3 /*break*/, 15];
+                case 14:
+                    error_12 = _b.sent();
+                    throw new errors_1.APIError({
+                        disableExternalErrorTracking: (0, errors_1.getDisableExternalErrorTracking)(error_12),
+                        error: error_12,
+                        status: 400,
+                        title: "postUpdate hook error on ".concat(req.params.id, ": ").concat(error_12.message),
+                    });
+                case 15:
+                    _b.trys.push([15, 17, , 18]);
+                    return [4 /*yield*/, responseHandler(doc, "update", req, options)];
+                case 16:
+                    serialized = _b.sent();
+                    return [2 /*return*/, res.json({ data: serialized })];
+                case 17:
+                    error_13 = _b.sent();
+                    throw new errors_1.APIError({
+                        disableExternalErrorTracking: (0, errors_1.getDisableExternalErrorTracking)(error_13),
+                        error: error_13,
+                        title: "responseHandler error: ".concat(error_13.message),
+                    });
+                case 18: return [2 /*return*/];
+            }
+        });
+    }); }));
+    router.delete("/:id", [
+        (0, auth_1.authenticateMiddleware)(options.allowAnonymous),
+        (0, openApi_1.deleteOpenApiMiddleware)(baseModel, options),
+        (0, permissions_1.permissionMiddleware)(baseModel, options),
+    ], (0, exports.asyncHandler)(function (req, res) { return __awaiter(_this, void 0, void 0, function () {
+        var model, doc, body, error_14, error_15, error_16;
+        return __generator(this, function (_a) {
+            switch (_a.label) {
+                case 0:
+                    model = getModel(baseModel, req.body, options);
+                    doc = req.obj;
+                    if (!options.preDelete) return [3 /*break*/, 5];
+                    body = void 0;
+                    _a.label = 1;
+                case 1:
+                    _a.trys.push([1, 3, , 4]);
+                    return [4 /*yield*/, options.preDelete(doc, req)];
+                case 2:
+                    body = _a.sent();
+                    return [3 /*break*/, 4];
+                case 3:
+                    error_14 = _a.sent();
+                    if ((0, errors_1.isAPIError)(error_14)) {
+                        throw error_14;
+                    }
+                    throw new errors_1.APIError({
+                        disableExternalErrorTracking: (0, errors_1.getDisableExternalErrorTracking)(error_14),
+                        error: error_14,
+                        status: 403,
+                        title: "preDelete hook error on ".concat(req.params.id, ": ").concat(error_14.message),
+                    });
+                case 4:
+                    if (body === undefined) {
+                        throw new errors_1.APIError({
+                            detail: "A body must be returned from preDelete",
+                            status: 403,
+                            title: "Delete not allowed",
+                        });
+                    }
+                    if (body === null) {
+                        throw new errors_1.APIError({
+                            detail: "preDelete hook for ".concat(req.params.id, " returned null"),
+                            status: 403,
+                            title: "Delete not allowed",
+                        });
+                    }
+                    _a.label = 5;
+                case 5:
+                    if (!(Object.keys(model.schema.paths).includes("deleted") &&
+                        model.schema.paths.deleted.instance === "Boolean")) return [3 /*break*/, 7];
+                    doc.deleted = true;
+                    return [4 /*yield*/, doc.save()];
+                case 6:
+                    _a.sent();
+                    return [3 /*break*/, 10];
+                case 7:
+                    _a.trys.push([7, 9, , 10]);
+                    return [4 /*yield*/, doc.deleteOne()];
+                case 8:
+                    _a.sent();
+                    return [3 /*break*/, 10];
+                case 9:
+                    error_15 = _a.sent();
+                    throw new errors_1.APIError({
+                        disableExternalErrorTracking: (0, errors_1.getDisableExternalErrorTracking)(error_15),
+                        error: error_15,
+                        status: 400,
+                        title: error_15.message,
+                    });
+                case 10:
+                    if (!options.postDelete) return [3 /*break*/, 14];
+                    _a.label = 11;
+                case 11:
+                    _a.trys.push([11, 13, , 14]);
+                    return [4 /*yield*/, options.postDelete(req, doc)];
+                case 12:
+                    _a.sent();
+                    return [3 /*break*/, 14];
+                case 13:
+                    error_16 = _a.sent();
+                    throw new errors_1.APIError({
+                        disableExternalErrorTracking: (0, errors_1.getDisableExternalErrorTracking)(error_16),
+                        error: error_16,
+                        status: 400,
+                        title: "postDelete hook error: ".concat(error_16.message),
+                    });
+                case 14: return [2 /*return*/, res.status(204).json({})];
+            }
+        });
+    }); }));
+    function arrayOperation(req, res, operation) {
+        return __awaiter(this, void 0, void 0, function () {
+            var model, doc, prevDoc, field, array, index, body, error_17, error_18, error_19;
+            var _a;
+            var _b, _c;
+            return __generator(this, function (_d) {
+                switch (_d.label) {
+                    case 0:
+                        model = getModel(baseModel, req.body, options);
+                        return [4 /*yield*/, (0, permissions_1.checkPermissions)("update", options.permissions.update, req.user)];
+                    case 1:
+                        if (!(_d.sent())) {
+                            throw new errors_1.APIError({
+                                status: 405,
+                                title: "Access to PATCH on ".concat(model.modelName, " denied for ").concat((_b = req.user) === null || _b === void 0 ? void 0 : _b.id),
+                            });
+                        }
+                        return [4 /*yield*/, model.findById(req.params.id)];
+                    case 2:
+                        doc = _d.sent();
+                        prevDoc = (0, cloneDeep_1.default)(doc);
+                        // We fail here because we might fetch the document without the __t but we'd be missing all the
+                        // hooks.
+                        if (!doc || (doc.__t && !req.body.__t)) {
+                            throw new errors_1.APIError({
+                                status: 404,
+                                title: "Could not find document to PATCH: ".concat(req.params.id),
+                            });
+                        }
+                        return [4 /*yield*/, (0, permissions_1.checkPermissions)("update", options.permissions.update, req.user, doc)];
+                    case 3:
+                        if (!(_d.sent())) {
+                            throw new errors_1.APIError({
+                                status: 403,
+                                title: "Patch not allowed for user ".concat((_c = req.user) === null || _c === void 0 ? void 0 : _c.id, " on doc ").concat(doc._id),
+                            });
+                        }
+                        // We apply the operation *before* the hooks. As far as the callers are concerned, this should
+                        // be like PATCHing the field and replacing the whole thing.
+                        if (operation !== "DELETE" && req.body[req.params.field] === undefined) {
+                            throw new errors_1.APIError({
+                                status: 400,
+                                title: "Malformed body, array operations should have a single, top level key, got: ".concat(Object.keys(req.body).join(",")),
+                            });
+                        }
+                        field = req.params.field;
+                        array = __spreadArray([], __read(doc[field]), false);
+                        if (operation === "POST") {
+                            array.push(req.body[field]);
+                        }
+                        else if (operation === "PATCH" || operation === "DELETE") {
+                            index = void 0;
+                            if ((0, utils_1.isValidObjectId)(req.params.itemId)) {
+                                index = array.findIndex(function (x) { return x.id === req.params.itemId; });
+                            }
+                            else {
+                                index = array.findIndex(function (x) { return x === req.params.itemId; });
+                            }
+                            if (index === -1) {
+                                throw new errors_1.APIError({
+                                    status: 404,
+                                    title: "Could not find ".concat(field, "/").concat(req.params.itemId),
+                                });
+                            }
+                            // For PATCHing an item by ID, we need to merge the objects so we don't override the _id or
+                            // other parts of the subdocument.
+                            if (operation === "PATCH" && (0, utils_1.isValidObjectId)(req.params.itemId)) {
+                                Object.assign(array[index], req.body[field]);
+                            }
+                            else if (operation === "PATCH") {
+                                // For PATCHing a string array, we can replace the whole object.
+                                array[index] = req.body[field];
+                            }
+                            else {
+                                array.splice(index, 1);
+                            }
+                        }
+                        else {
+                            throw new errors_1.APIError({
+                                status: 400,
+                                title: "Invalid array operation: ".concat(operation),
+                            });
+                        }
+                        body = (_a = {}, _a[field] = array, _a);
+                        try {
+                            body = (0, transformers_1.transform)(options, body, "update", req.user);
+                        }
+                        catch (error) {
+                            throw new errors_1.APIError({
+                                disableExternalErrorTracking: (0, errors_1.getDisableExternalErrorTracking)(error),
+                                error: error,
+                                status: 403,
+                                title: error.message,
+                            });
+                        }
+                        if (!options.preUpdate) return [3 /*break*/, 8];
+                        _d.label = 4;
+                    case 4:
+                        _d.trys.push([4, 6, , 7]);
+                        return [4 /*yield*/, options.preUpdate(body, req)];
+                    case 5:
+                        body = _d.sent();
+                        return [3 /*break*/, 7];
+                    case 6:
+                        error_17 = _d.sent();
+                        throw new errors_1.APIError({
+                            disableExternalErrorTracking: (0, errors_1.getDisableExternalErrorTracking)(error_17),
+                            error: error_17,
+                            status: 400,
+                            title: "preUpdate hook error on ".concat(req.params.id, ": ").concat(error_17.message),
+                        });
+                    case 7:
+                        if (body === undefined) {
+                            throw new errors_1.APIError({
+                                detail: "A body must be returned from preUpdate",
+                                status: 403,
+                                title: "Update not allowed",
+                            });
+                        }
+                        if (body === null) {
+                            throw new errors_1.APIError({
+                                detail: "preUpdate hook on ".concat(req.params.id, " returned null"),
+                                status: 403,
+                                title: "Update not allowed",
+                            });
+                        }
+                        _d.label = 8;
+                    case 8:
+                        _d.trys.push([8, 10, , 11]);
+                        Object.assign(doc, body);
+                        return [4 /*yield*/, doc.save()];
+                    case 9:
+                        _d.sent();
+                        return [3 /*break*/, 11];
+                    case 10:
+                        error_18 = _d.sent();
+                        throw new errors_1.APIError({
+                            disableExternalErrorTracking: (0, errors_1.getDisableExternalErrorTracking)(error_18),
+                            error: error_18,
+                            status: 400,
+                            title: "PATCH Pre Update error on ".concat(req.params.id, ": ").concat(error_18.message),
+                        });
+                    case 11:
+                        if (!options.postUpdate) return [3 /*break*/, 15];
+                        _d.label = 12;
+                    case 12:
+                        _d.trys.push([12, 14, , 15]);
+                        return [4 /*yield*/, options.postUpdate(doc, body, req, prevDoc)];
+                    case 13:
+                        _d.sent();
+                        return [3 /*break*/, 15];
+                    case 14:
+                        error_19 = _d.sent();
+                        throw new errors_1.APIError({
+                            disableExternalErrorTracking: (0, errors_1.getDisableExternalErrorTracking)(error_19),
+                            error: error_19,
+                            status: 400,
+                            title: "PATCH Post Update error on ".concat(req.params.id, ": ").concat(error_19.message),
+                        });
+                    case 15: return [2 /*return*/, res.json({ data: (0, transformers_1.serialize)(req, options, doc) })];
+                }
+            });
+        });
+    }
+    function arrayPost(req, res) {
+        return __awaiter(this, void 0, void 0, function () {
+            return __generator(this, function (_a) {
+                return [2 /*return*/, arrayOperation(req, res, "POST")];
+            });
+        });
+    }
+    function arrayPatch(req, res) {
+        return __awaiter(this, void 0, void 0, function () {
+            return __generator(this, function (_a) {
+                return [2 /*return*/, arrayOperation(req, res, "PATCH")];
+            });
+        });
+    }
+    function arrayDelete(req, res) {
+        return __awaiter(this, void 0, void 0, function () {
+            return __generator(this, function (_a) {
+                return [2 /*return*/, arrayOperation(req, res, "DELETE")];
+            });
+        });
+    }
+    // Set up routes for managing array fields. Check if there any array fields to add this for.
+    if (Object.values(baseModel.schema.paths).find(function (config) { return config.instance === "Array"; })) {
+        router.post("/:id/:field", (0, auth_1.authenticateMiddleware)(options.allowAnonymous), (0, exports.asyncHandler)(arrayPost));
+        router.patch("/:id/:field/:itemId", (0, auth_1.authenticateMiddleware)(options.allowAnonymous), (0, exports.asyncHandler)(arrayPatch));
+        router.delete("/:id/:field/:itemId", (0, auth_1.authenticateMiddleware)(options.allowAnonymous), (0, exports.asyncHandler)(arrayDelete));
+    }
+    router.use(errors_1.apiErrorMiddleware);
+    return router;
+}
+// Since express doesn't handle async routes well, wrap them with this function.
+var asyncHandler = function (fn) { return function (req, res, next) {
+    return Promise.resolve(fn(req, res, next)).catch(next);
+}; };
+exports.asyncHandler = asyncHandler;
+// For backwards compatibility with the old names.
+exports.gooseRestRouter = modelRouter;