@terreno/api 0.0.1

package/dist/api.test.js

@@ -0,0 +1,2143 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, generator) {
+    function adopt(value) { return value instanceof P ? value : new P(function (resolve) { resolve(value); }); }
+    return new (P || (P = Promise))(function (resolve, reject) {
+        function fulfilled(value) { try { step(generator.next(value)); } catch (e) { reject(e); } }
+        function rejected(value) { try { step(generator["throw"](value)); } catch (e) { reject(e); } }
+        function step(result) { result.done ? resolve(result.value) : adopt(result.value).then(fulfilled, rejected); }
+        step((generator = generator.apply(thisArg, _arguments || [])).next());
+    });
+};
+var __generator = (this && this.__generator) || function (thisArg, body) {
+    var _ = { label: 0, sent: function() { if (t[0] & 1) throw t[1]; return t[1]; }, trys: [], ops: [] }, f, y, t, g = Object.create((typeof Iterator === "function" ? Iterator : Object).prototype);
+    return g.next = verb(0), g["throw"] = verb(1), g["return"] = verb(2), typeof Symbol === "function" && (g[Symbol.iterator] = function() { return this; }), g;
+    function verb(n) { return function (v) { return step([n, v]); }; }
+    function step(op) {
+        if (f) throw new TypeError("Generator is already executing.");
+        while (g && (g = 0, op[0] && (_ = 0)), _) try {
+            if (f = 1, y && (t = op[0] & 2 ? y["return"] : op[0] ? y["throw"] || ((t = y["return"]) && t.call(y), 0) : y.next) && !(t = t.call(y, op[1])).done) return t;
+            if (y = 0, t) op = [op[0] & 2, t.value];
+            switch (op[0]) {
+                case 0: case 1: t = op; break;
+                case 4: _.label++; return { value: op[1], done: false };
+                case 5: _.label++; y = op[1]; op = [0]; continue;
+                case 7: op = _.ops.pop(); _.trys.pop(); continue;
+                default:
+                    if (!(t = _.trys, t = t.length > 0 && t[t.length - 1]) && (op[0] === 6 || op[0] === 2)) { _ = 0; continue; }
+                    if (op[0] === 3 && (!t || (op[1] > t[0] && op[1] < t[3]))) { _.label = op[1]; break; }
+                    if (op[0] === 6 && _.label < t[1]) { _.label = t[1]; t = op; break; }
+                    if (t && _.label < t[2]) { _.label = t[2]; _.ops.push(op); break; }
+                    if (t[2]) _.ops.pop();
+                    _.trys.pop(); continue;
+            }
+            op = body.call(thisArg, _);
+        } catch (e) { op = [6, e]; y = 0; } finally { f = t = 0; }
+        if (op[0] & 5) throw op[1]; return { value: op[0] ? op[1] : void 0, done: true };
+    }
+};
+var __read = (this && this.__read) || function (o, n) {
+    var m = typeof Symbol === "function" && o[Symbol.iterator];
+    if (!m) return o;
+    var i = m.call(o), r, ar = [], e;
+    try {
+        while ((n === void 0 || n-- > 0) && !(r = i.next()).done) ar.push(r.value);
+    }
+    catch (error) { e = { error: error }; }
+    finally {
+        try {
+            if (r && !r.done && (m = i["return"])) m.call(i);
+        }
+        finally { if (e) throw e.error; }
+    }
+    return ar;
+};
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+var bun_test_1 = require("bun:test");
+var Sentry = __importStar(require("@sentry/node"));
+var sortBy_1 = __importDefault(require("lodash/sortBy"));
+var qs_1 = __importDefault(require("qs"));
+var supertest_1 = __importDefault(require("supertest"));
+var api_1 = require("./api");
+var auth_1 = require("./auth");
+var errors_1 = require("./errors");
+var expressServer_1 = require("./expressServer");
+var permissions_1 = require("./permissions");
+var tests_1 = require("./tests");
+(0, bun_test_1.describe)("@terreno/api", function () {
+    var server;
+    var app;
+    (0, bun_test_1.describe)("pre and post hooks", function () {
+        var agent;
+        (0, bun_test_1.beforeEach)(function () { return __awaiter(void 0, void 0, void 0, function () {
+            return __generator(this, function (_a) {
+                switch (_a.label) {
+                    case 0: return [4 /*yield*/, (0, tests_1.setupDb)()];
+                    case 1:
+                        _a.sent();
+                        app = (0, tests_1.getBaseServer)();
+                        (0, auth_1.setupAuth)(app, tests_1.UserModel);
+                        (0, auth_1.addAuthRoutes)(app, tests_1.UserModel);
+                        return [4 /*yield*/, (0, tests_1.authAsUser)(app, "notAdmin")];
+                    case 2:
+                        agent = _a.sent();
+                        return [2 /*return*/];
+                }
+            });
+        }); });
+        (0, bun_test_1.it)("pre hooks change data", function () { return __awaiter(void 0, void 0, void 0, function () {
+            var deleteCalled, res, broccoli;
+            return __generator(this, function (_a) {
+                switch (_a.label) {
+                    case 0:
+                        deleteCalled = false;
+                        app.use("/food", (0, api_1.modelRouter)(tests_1.FoodModel, {
+                            allowAnonymous: true,
+                            permissions: {
+                                create: [permissions_1.Permissions.IsAny],
+                                delete: [permissions_1.Permissions.IsAny],
+                                list: [permissions_1.Permissions.IsAny],
+                                read: [permissions_1.Permissions.IsAny],
+                                update: [permissions_1.Permissions.IsAny],
+                            },
+                            preCreate: function (data) {
+                                data.calories = 14;
+                                return data;
+                            },
+                            preDelete: function (data) {
+                                deleteCalled = true;
+                                return data;
+                            },
+                            preUpdate: function (data) {
+                                data.calories = 15;
+                                return data;
+                            },
+                        }));
+                        server = (0, supertest_1.default)(app);
+                        return [4 /*yield*/, server
+                                .post("/food")
+                                .send({
+                                calories: 15,
+                                name: "Broccoli",
+                            })
+                                .expect(201)];
+                    case 1:
+                        res = _a.sent();
+                        return [4 /*yield*/, tests_1.FoodModel.findById(res.body.data._id)];
+                    case 2:
+                        broccoli = _a.sent();
+                        if (!broccoli) {
+                            throw new Error("Broccoli was not created");
+                        }
+                        (0, bun_test_1.expect)(broccoli.name).toBe("Broccoli");
+                        // Overwritten by the pre create hook
+                        (0, bun_test_1.expect)(broccoli.calories).toBe(14);
+                        return [4 /*yield*/, server
+                                .patch("/food/".concat(broccoli._id))
+                                .send({
+                                name: "Broccoli2",
+                            })
+                                .expect(200)];
+                    case 3:
+                        res = _a.sent();
+                        (0, bun_test_1.expect)(res.body.data.name).toBe("Broccoli2");
+                        // Updated by the pre update hook
+                        (0, bun_test_1.expect)(res.body.data.calories).toBe(15);
+                        return [4 /*yield*/, agent.delete("/food/".concat(broccoli._id)).expect(204)];
+                    case 4:
+                        _a.sent();
+                        (0, bun_test_1.expect)(deleteCalled).toBe(true);
+                        return [2 /*return*/];
+                }
+            });
+        }); });
+        (0, bun_test_1.it)("pre hooks return null", function () { return __awaiter(void 0, void 0, void 0, function () {
+            var notAdmin, spinach, res, broccoli;
+            return __generator(this, function (_a) {
+                switch (_a.label) {
+                    case 0: return [4 /*yield*/, tests_1.UserModel.findOne({
+                            email: "notAdmin@example.com",
+                        })];
+                    case 1:
+                        notAdmin = _a.sent();
+                        return [4 /*yield*/, tests_1.FoodModel.create({
+                                calories: 1,
+                                created: new Date("2021-12-03T00:00:20.000Z"),
+                                hidden: false,
+                                name: "Spinach",
+                                ownerId: notAdmin._id,
+                                source: {
+                                    name: "Brand",
+                                },
+                            })];
+                    case 2:
+                        spinach = _a.sent();
+                        app.use("/food", (0, api_1.modelRouter)(tests_1.FoodModel, {
+                            allowAnonymous: true,
+                            permissions: {
+                                create: [permissions_1.Permissions.IsAny],
+                                delete: [permissions_1.Permissions.IsAny],
+                                list: [permissions_1.Permissions.IsAny],
+                                read: [permissions_1.Permissions.IsAny],
+                                update: [permissions_1.Permissions.IsAny],
+                            },
+                            preCreate: function () { return null; },
+                            preDelete: function () { return null; },
+                            preUpdate: function () { return null; },
+                        }));
+                        server = (0, supertest_1.default)(app);
+                        return [4 /*yield*/, server
+                                .post("/food")
+                                .send({
+                                calories: 15,
+                                name: "Broccoli",
+                            })
+                                .expect(403)];
+                    case 3:
+                        res = _a.sent();
+                        return [4 /*yield*/, tests_1.FoodModel.findById(res.body._id)];
+                    case 4:
+                        broccoli = _a.sent();
+                        (0, bun_test_1.expect)(broccoli).toBeNull();
+                        return [4 /*yield*/, server
+                                .patch("/food/".concat(spinach._id))
+                                .send({
+                                name: "Broccoli",
+                            })
+                                .expect(403)];
+                    case 5:
+                        _a.sent();
+                        return [4 /*yield*/, server.delete("/food/".concat(spinach._id)).expect(403)];
+                    case 6:
+                        _a.sent();
+                        return [2 /*return*/];
+                }
+            });
+        }); });
+        (0, bun_test_1.it)("post hooks succeed", function () { return __awaiter(void 0, void 0, void 0, function () {
+            var deleteCalled, res, broccoli;
+            return __generator(this, function (_a) {
+                switch (_a.label) {
+                    case 0:
+                        deleteCalled = false;
+                        app.use("/food", (0, api_1.modelRouter)(tests_1.FoodModel, {
+                            allowAnonymous: true,
+                            permissions: {
+                                create: [permissions_1.Permissions.IsAny],
+                                delete: [permissions_1.Permissions.IsAny],
+                                list: [permissions_1.Permissions.IsAny],
+                                read: [permissions_1.Permissions.IsAny],
+                                update: [permissions_1.Permissions.IsAny],
+                            },
+                            postCreate: function (data) { return __awaiter(void 0, void 0, void 0, function () {
+                                return __generator(this, function (_a) {
+                                    switch (_a.label) {
+                                        case 0:
+                                            data.calories = 14;
+                                            return [4 /*yield*/, data.save()];
+                                        case 1:
+                                            _a.sent();
+                                            return [2 /*return*/, data];
+                                    }
+                                });
+                            }); },
+                            postDelete: function (data) {
+                                deleteCalled = true;
+                                return data;
+                            },
+                            postUpdate: function (data) { return __awaiter(void 0, void 0, void 0, function () {
+                                return __generator(this, function (_a) {
+                                    switch (_a.label) {
+                                        case 0:
+                                            data.calories = 15;
+                                            return [4 /*yield*/, data.save()];
+                                        case 1:
+                                            _a.sent();
+                                            return [2 /*return*/, data];
+                                    }
+                                });
+                            }); },
+                        }));
+                        server = (0, supertest_1.default)(app);
+                        return [4 /*yield*/, server
+                                .post("/food")
+                                .send({
+                                calories: 15,
+                                name: "Broccoli",
+                            })
+                                .expect(201)];
+                    case 1:
+                        res = _a.sent();
+                        return [4 /*yield*/, tests_1.FoodModel.findById(res.body.data._id)];
+                    case 2:
+                        broccoli = _a.sent();
+                        if (!broccoli) {
+                            throw new Error("Broccoli was not created");
+                        }
+                        (0, bun_test_1.expect)(broccoli.name).toBe("Broccoli");
+                        // Overwritten by the pre create hook
+                        (0, bun_test_1.expect)(broccoli.calories).toBe(14);
+                        return [4 /*yield*/, server
+                                .patch("/food/".concat(broccoli._id))
+                                .send({
+                                name: "Broccoli2",
+                            })
+                                .expect(200)];
+                    case 3:
+                        res = _a.sent();
+                        return [4 /*yield*/, tests_1.FoodModel.findById(res.body.data._id)];
+                    case 4:
+                        broccoli = _a.sent();
+                        if (!broccoli) {
+                            throw new Error("Broccoli was not update");
+                        }
+                        (0, bun_test_1.expect)(broccoli.name).toBe("Broccoli2");
+                        // Updated by the post update hook
+                        (0, bun_test_1.expect)(broccoli.calories).toBe(15);
+                        return [4 /*yield*/, agent.delete("/food/".concat(broccoli._id)).expect(204)];
+                    case 5:
+                        _a.sent();
+                        (0, bun_test_1.expect)(deleteCalled).toBe(true);
+                        return [2 /*return*/];
+                }
+            });
+        }); });
+        (0, bun_test_1.it)("preCreate hook preserves disableExternalErrorTracking on APIError", function () { return __awaiter(void 0, void 0, void 0, function () {
+            var res;
+            return __generator(this, function (_a) {
+                switch (_a.label) {
+                    case 0:
+                        app.use("/food", (0, api_1.modelRouter)(tests_1.FoodModel, {
+                            allowAnonymous: true,
+                            permissions: {
+                                create: [permissions_1.Permissions.IsAny],
+                                delete: [permissions_1.Permissions.IsAny],
+                                list: [permissions_1.Permissions.IsAny],
+                                read: [permissions_1.Permissions.IsAny],
+                                update: [permissions_1.Permissions.IsAny],
+                            },
+                            preCreate: function () {
+                                throw new errors_1.APIError({
+                                    disableExternalErrorTracking: true,
+                                    status: 400,
+                                    title: "Custom preCreate error",
+                                });
+                            },
+                        }));
+                        server = (0, supertest_1.default)(app);
+                        return [4 /*yield*/, server
+                                .post("/food")
+                                .send({
+                                calories: 15,
+                                name: "Broccoli",
+                            })
+                                .expect(400)];
+                    case 1:
+                        res = _a.sent();
+                        (0, bun_test_1.expect)(res.body.title).toBe("Custom preCreate error");
+                        (0, bun_test_1.expect)(res.body.disableExternalErrorTracking).toBe(true);
+                        return [2 /*return*/];
+                }
+            });
+        }); });
+        (0, bun_test_1.it)("preCreate hook preserves disableExternalErrorTracking on non-APIError", function () { return __awaiter(void 0, void 0, void 0, function () {
+            var res;
+            return __generator(this, function (_a) {
+                switch (_a.label) {
+                    case 0:
+                        app.use("/food", (0, api_1.modelRouter)(tests_1.FoodModel, {
+                            allowAnonymous: true,
+                            permissions: {
+                                create: [permissions_1.Permissions.IsAny],
+                                delete: [permissions_1.Permissions.IsAny],
+                                list: [permissions_1.Permissions.IsAny],
+                                read: [permissions_1.Permissions.IsAny],
+                                update: [permissions_1.Permissions.IsAny],
+                            },
+                            preCreate: function () {
+                                var error = new Error("Some custom error");
+                                error.disableExternalErrorTracking = true;
+                                throw error;
+                            },
+                        }));
+                        server = (0, supertest_1.default)(app);
+                        return [4 /*yield*/, server
+                                .post("/food")
+                                .send({
+                                calories: 15,
+                                name: "Broccoli",
+                            })
+                                .expect(400)];
+                    case 1:
+                        res = _a.sent();
+                        (0, bun_test_1.expect)(res.body.title).toContain("preCreate hook error");
+                        (0, bun_test_1.expect)(res.body.disableExternalErrorTracking).toBe(true);
+                        return [2 /*return*/];
+                }
+            });
+        }); });
+        (0, bun_test_1.it)("preUpdate hook preserves disableExternalErrorTracking on APIError", function () { return __awaiter(void 0, void 0, void 0, function () {
+            var notAdmin, spinach, res;
+            return __generator(this, function (_a) {
+                switch (_a.label) {
+                    case 0: return [4 /*yield*/, tests_1.UserModel.findOne({
+                            email: "notAdmin@example.com",
+                        })];
+                    case 1:
+                        notAdmin = _a.sent();
+                        return [4 /*yield*/, tests_1.FoodModel.create({
+                                calories: 1,
+                                created: new Date("2021-12-03T00:00:20.000Z"),
+                                hidden: false,
+                                name: "Spinach",
+                                ownerId: notAdmin._id,
+                                source: {
+                                    name: "Brand",
+                                },
+                            })];
+                    case 2:
+                        spinach = _a.sent();
+                        app.use("/food", (0, api_1.modelRouter)(tests_1.FoodModel, {
+                            allowAnonymous: true,
+                            permissions: {
+                                create: [permissions_1.Permissions.IsAny],
+                                delete: [permissions_1.Permissions.IsAny],
+                                list: [permissions_1.Permissions.IsAny],
+                                read: [permissions_1.Permissions.IsAny],
+                                update: [permissions_1.Permissions.IsAny],
+                            },
+                            preUpdate: function () {
+                                throw new errors_1.APIError({
+                                    disableExternalErrorTracking: true,
+                                    status: 400,
+                                    title: "Custom preUpdate error",
+                                });
+                            },
+                        }));
+                        server = (0, supertest_1.default)(app);
+                        return [4 /*yield*/, server
+                                .patch("/food/".concat(spinach._id))
+                                .send({
+                                name: "Broccoli",
+                            })
+                                .expect(400)];
+                    case 3:
+                        res = _a.sent();
+                        (0, bun_test_1.expect)(res.body.title).toBe("Custom preUpdate error");
+                        (0, bun_test_1.expect)(res.body.disableExternalErrorTracking).toBe(true);
+                        return [2 /*return*/];
+                }
+            });
+        }); });
+        (0, bun_test_1.it)("preUpdate hook preserves disableExternalErrorTracking on non-APIError", function () { return __awaiter(void 0, void 0, void 0, function () {
+            var notAdmin, spinach, res;
+            return __generator(this, function (_a) {
+                switch (_a.label) {
+                    case 0: return [4 /*yield*/, tests_1.UserModel.findOne({
+                            email: "notAdmin@example.com",
+                        })];
+                    case 1:
+                        notAdmin = _a.sent();
+                        return [4 /*yield*/, tests_1.FoodModel.create({
+                                calories: 1,
+                                created: new Date("2021-12-03T00:00:20.000Z"),
+                                hidden: false,
+                                name: "Spinach",
+                                ownerId: notAdmin._id,
+                                source: {
+                                    name: "Brand",
+                                },
+                            })];
+                    case 2:
+                        spinach = _a.sent();
+                        app.use("/food", (0, api_1.modelRouter)(tests_1.FoodModel, {
+                            allowAnonymous: true,
+                            permissions: {
+                                create: [permissions_1.Permissions.IsAny],
+                                delete: [permissions_1.Permissions.IsAny],
+                                list: [permissions_1.Permissions.IsAny],
+                                read: [permissions_1.Permissions.IsAny],
+                                update: [permissions_1.Permissions.IsAny],
+                            },
+                            preUpdate: function () {
+                                var error = new Error("Some custom error");
+                                error.disableExternalErrorTracking = true;
+                                throw error;
+                            },
+                        }));
+                        server = (0, supertest_1.default)(app);
+                        return [4 /*yield*/, server
+                                .patch("/food/".concat(spinach._id))
+                                .send({
+                                name: "Broccoli",
+                            })
+                                .expect(400)];
+                    case 3:
+                        res = _a.sent();
+                        (0, bun_test_1.expect)(res.body.title).toContain("preUpdate hook error");
+                        (0, bun_test_1.expect)(res.body.disableExternalErrorTracking).toBe(true);
+                        return [2 /*return*/];
+                }
+            });
+        }); });
+        (0, bun_test_1.it)("preDelete hook preserves disableExternalErrorTracking on non-APIError", function () { return __awaiter(void 0, void 0, void 0, function () {
+            var notAdmin, spinach, res;
+            return __generator(this, function (_a) {
+                switch (_a.label) {
+                    case 0: return [4 /*yield*/, tests_1.UserModel.findOne({
+                            email: "notAdmin@example.com",
+                        })];
+                    case 1:
+                        notAdmin = _a.sent();
+                        return [4 /*yield*/, tests_1.FoodModel.create({
+                                calories: 1,
+                                created: new Date("2021-12-03T00:00:20.000Z"),
+                                hidden: false,
+                                name: "Spinach",
+                                ownerId: notAdmin._id,
+                                source: {
+                                    name: "Brand",
+                                },
+                            })];
+                    case 2:
+                        spinach = _a.sent();
+                        app.use("/food", (0, api_1.modelRouter)(tests_1.FoodModel, {
+                            allowAnonymous: true,
+                            permissions: {
+                                create: [permissions_1.Permissions.IsAny],
+                                delete: [permissions_1.Permissions.IsAny],
+                                list: [permissions_1.Permissions.IsAny],
+                                read: [permissions_1.Permissions.IsAny],
+                                update: [permissions_1.Permissions.IsAny],
+                            },
+                            preDelete: function () {
+                                var error = new Error("Some custom error");
+                                error.disableExternalErrorTracking = true;
+                                throw error;
+                            },
+                        }));
+                        server = (0, supertest_1.default)(app);
+                        return [4 /*yield*/, agent.delete("/food/".concat(spinach._id)).expect(403)];
+                    case 3:
+                        res = _a.sent();
+                        (0, bun_test_1.expect)(res.body.title).toContain("preDelete hook error");
+                        (0, bun_test_1.expect)(res.body.disableExternalErrorTracking).toBe(true);
+                        return [2 /*return*/];
+                }
+            });
+        }); });
+    });
+    (0, bun_test_1.describe)("model array operations", function () {
+        var admin;
+        var spinach;
+        var apple;
+        var agent;
+        (0, bun_test_1.beforeEach)(function () { return __awaiter(void 0, void 0, void 0, function () {
+            var _a, _b;
+            return __generator(this, function (_c) {
+                switch (_c.label) {
+                    case 0:
+                        process.env.REFRESH_TOKEN_SECRET = "testsecret1234";
+                        return [4 /*yield*/, (0, tests_1.setupDb)()];
+                    case 1:
+                        _a = __read.apply(void 0, [_c.sent(), 1]), admin = _a[0];
+                        return [4 /*yield*/, Promise.all([
+                                tests_1.FoodModel.create({
+                                    calories: 1,
+                                    created: new Date("2021-12-03T00:00:20.000Z"),
+                                    hidden: false,
+                                    name: "Spinach",
+                                    ownerId: admin._id,
+                                    source: {
+                                        name: "Brand",
+                                    },
+                                }),
+                                tests_1.FoodModel.create({
+                                    calories: 100,
+                                    categories: [
+                                        {
+                                            name: "Fruit",
+                                            show: true,
+                                        },
+                                        {
+                                            name: "Popular",
+                                            show: false,
+                                        },
+                                    ],
+                                    created: new Date("2021-12-03T00:00:30.000Z"),
+                                    hidden: false,
+                                    name: "Apple",
+                                    ownerId: admin._id,
+                                    tags: ["healthy", "cheap"],
+                                }),
+                            ])];
+                    case 2:
+                        _b = __read.apply(void 0, [_c.sent(), 2]), spinach = _b[0], apple = _b[1];
+                        app = (0, tests_1.getBaseServer)();
+                        (0, auth_1.setupAuth)(app, tests_1.UserModel);
+                        (0, auth_1.addAuthRoutes)(app, tests_1.UserModel);
+                        app.use("/food", (0, api_1.modelRouter)(tests_1.FoodModel, {
+                            allowAnonymous: true,
+                            permissions: {
+                                create: [permissions_1.Permissions.IsAdmin],
+                                delete: [permissions_1.Permissions.IsAdmin],
+                                list: [permissions_1.Permissions.IsAdmin],
+                                read: [permissions_1.Permissions.IsAdmin],
+                                update: [permissions_1.Permissions.IsAdmin],
+                            },
+                            queryFields: ["hidden", "calories", "created", "source.name"],
+                            sort: { created: "descending" },
+                        }));
+                        server = (0, supertest_1.default)(app);
+                        return [4 /*yield*/, (0, tests_1.authAsUser)(app, "admin")];
+                    case 3:
+                        agent = _c.sent();
+                        return [2 /*return*/];
+                }
+            });
+        }); });
+        (0, bun_test_1.it)("add array sub-schema item", function () { return __awaiter(void 0, void 0, void 0, function () {
+            var res;
+            return __generator(this, function (_a) {
+                switch (_a.label) {
+                    case 0: return [4 /*yield*/, agent
+                            .post("/food/".concat(apple._id, "/categories"))
+                            .send({ name: "Good Seller", show: false })
+                            .expect(400)];
+                    case 1:
+                        res = _a.sent();
+                        (0, bun_test_1.expect)(res.body.title).toBe("Malformed body, array operations should have a single, top level key, got: name,show");
+                        return [4 /*yield*/, agent
+                                .post("/food/".concat(apple._id, "/categories"))
+                                .send({ categories: { name: "Good Seller", show: false } })
+                                .expect(200)];
+                    case 2:
+                        res = _a.sent();
+                        (0, bun_test_1.expect)(res.body.data.categories).toHaveLength(3);
+                        (0, bun_test_1.expect)(res.body.data.categories[2].name).toBe("Good Seller");
+                        return [4 /*yield*/, agent
+                                .post("/food/".concat(spinach._id, "/categories"))
+                                .send({ categories: { name: "Good Seller", show: false } })
+                                .expect(200)];
+                    case 3:
+                        res = _a.sent();
+                        (0, bun_test_1.expect)(res.body.data.categories).toHaveLength(1);
+                        return [2 /*return*/];
+                }
+            });
+        }); });
+        (0, bun_test_1.it)("update array sub-schema item", function () { return __awaiter(void 0, void 0, void 0, function () {
+            var res;
+            return __generator(this, function (_a) {
+                switch (_a.label) {
+                    case 0: return [4 /*yield*/, agent
+                            .patch("/food/".concat(apple._id, "/categories/xyz"))
+                            .send({ categories: { name: "Good Seller", show: false } })
+                            .expect(404)];
+                    case 1:
+                        res = _a.sent();
+                        (0, bun_test_1.expect)(res.body.title).toBe("Could not find categories/xyz");
+                        return [4 /*yield*/, agent
+                                .patch("/food/".concat(apple._id, "/categories/").concat(apple.categories[1]._id))
+                                .send({ categories: { name: "Good Seller", show: false } })
+                                .expect(200)];
+                    case 2:
+                        res = _a.sent();
+                        (0, bun_test_1.expect)(res.body.data.categories).toHaveLength(2);
+                        (0, bun_test_1.expect)(res.body.data.categories[1].name).toBe("Good Seller");
+                        return [2 /*return*/];
+                }
+            });
+        }); });
+        (0, bun_test_1.it)("delete array sub-schema item", function () { return __awaiter(void 0, void 0, void 0, function () {
+            var res;
+            return __generator(this, function (_a) {
+                switch (_a.label) {
+                    case 0: return [4 /*yield*/, agent.delete("/food/".concat(apple._id, "/categories/xyz")).expect(404)];
+                    case 1:
+                        res = _a.sent();
+                        (0, bun_test_1.expect)(res.body.title).toBe("Could not find categories/xyz");
+                        return [4 /*yield*/, agent
+                                .delete("/food/".concat(apple._id, "/categories/").concat(apple.categories[0]._id))
+                                .expect(200)];
+                    case 2:
+                        res = _a.sent();
+                        (0, bun_test_1.expect)(res.body.data.categories).toHaveLength(1);
+                        (0, bun_test_1.expect)(res.body.data.categories[0].name).toBe("Popular");
+                        return [2 /*return*/];
+                }
+            });
+        }); });
+        (0, bun_test_1.it)("add array item", function () { return __awaiter(void 0, void 0, void 0, function () {
+            var res;
+            return __generator(this, function (_a) {
+                switch (_a.label) {
+                    case 0: return [4 /*yield*/, agent.post("/food/".concat(apple._id, "/tags")).send({ tags: "popular" }).expect(200)];
+                    case 1:
+                        res = _a.sent();
+                        (0, bun_test_1.expect)(res.body.data.tags).toHaveLength(3);
+                        (0, bun_test_1.expect)(res.body.data.tags).toEqual(["healthy", "cheap", "popular"]);
+                        return [4 /*yield*/, agent.post("/food/".concat(spinach._id, "/tags")).send({ tags: "popular" }).expect(200)];
+                    case 2:
+                        res = _a.sent();
+                        (0, bun_test_1.expect)(res.body.data.tags).toEqual(["popular"]);
+                        return [2 /*return*/];
+                }
+            });
+        }); });
+        (0, bun_test_1.it)("update array item", function () { return __awaiter(void 0, void 0, void 0, function () {
+            var res;
+            return __generator(this, function (_a) {
+                switch (_a.label) {
+                    case 0: return [4 /*yield*/, agent
+                            .patch("/food/".concat(apple._id, "/tags/xyz"))
+                            .send({ tags: "unhealthy" })
+                            .expect(404)];
+                    case 1:
+                        res = _a.sent();
+                        (0, bun_test_1.expect)(res.body.title).toBe("Could not find tags/xyz");
+                        return [4 /*yield*/, agent
+                                .patch("/food/".concat(apple._id, "/tags/healthy"))
+                                .send({ tags: "unhealthy" })
+                                .expect(200)];
+                    case 2:
+                        res = _a.sent();
+                        (0, bun_test_1.expect)(res.body.data.tags).toEqual(["unhealthy", "cheap"]);
+                        return [2 /*return*/];
+                }
+            });
+        }); });
+        (0, bun_test_1.it)("delete array item", function () { return __awaiter(void 0, void 0, void 0, function () {
+            var res;
+            return __generator(this, function (_a) {
+                switch (_a.label) {
+                    case 0: return [4 /*yield*/, agent.delete("/food/".concat(apple._id, "/tags/xyz")).expect(404)];
+                    case 1:
+                        res = _a.sent();
+                        (0, bun_test_1.expect)(res.body.title).toBe("Could not find tags/xyz");
+                        return [4 /*yield*/, agent.delete("/food/".concat(apple._id, "/tags/healthy")).expect(200)];
+                    case 2:
+                        res = _a.sent();
+                        (0, bun_test_1.expect)(res.body.data.tags).toEqual(["cheap"]);
+                        return [2 /*return*/];
+                }
+            });
+        }); });
+        (0, bun_test_1.it)("updates timestamps on array subdocuments", function () { return __awaiter(void 0, void 0, void 0, function () {
+            var foodWithTimestamps, firstCategoryId, secondCategoryId, res, updatedCategory, unchangedCategory;
+            var _a, _b, _c, _d, _e, _f;
+            return __generator(this, function (_g) {
+                switch (_g.label) {
+                    case 0: return [4 /*yield*/, tests_1.FoodModel.create({
+                            calories: 100,
+                            categories: [
+                                {
+                                    name: "Category 1",
+                                    show: true,
+                                    updated: new Date("2024-01-01T00:00:00.000Z"),
+                                },
+                                {
+                                    name: "Category 2",
+                                    show: true,
+                                    updated: new Date("2024-01-01T00:00:00.000Z"),
+                                },
+                            ],
+                            created: new Date(),
+                            name: "Food with Timestamps",
+                            ownerId: admin._id,
+                        })];
+                    case 1:
+                        foodWithTimestamps = _g.sent();
+                        firstCategoryId = (_c = (_b = (_a = foodWithTimestamps.categories) === null || _a === void 0 ? void 0 : _a[0]) === null || _b === void 0 ? void 0 : _b._id) === null || _c === void 0 ? void 0 : _c.toString();
+                        secondCategoryId = (_f = (_e = (_d = foodWithTimestamps.categories) === null || _d === void 0 ? void 0 : _d[1]) === null || _e === void 0 ? void 0 : _e._id) === null || _f === void 0 ? void 0 : _f.toString();
+                        if (!firstCategoryId || !secondCategoryId) {
+                            throw new Error("Failed to create food with categories");
+                        }
+                        // Wait a moment to ensure timestamp difference
+                        return [4 /*yield*/, new Promise(function (resolve) { return setTimeout(resolve, 100); })];
+                    case 2:
+                        // Wait a moment to ensure timestamp difference
+                        _g.sent();
+                        return [4 /*yield*/, agent
+                                .patch("/food/".concat(foodWithTimestamps._id, "/categories/").concat(firstCategoryId))
+                                .send({ categories: { name: "Updated Category" } })
+                                .expect(200)];
+                    case 3:
+                        res = _g.sent();
+                        updatedCategory = res.body.data.categories.find(function (c) { return c._id === firstCategoryId; });
+                        unchangedCategory = res.body.data.categories.find(function (c) { return c._id === secondCategoryId; });
+                        if (!updatedCategory || !unchangedCategory) {
+                            throw new Error("Failed to find categories in response");
+                        }
+                        (0, bun_test_1.expect)(updatedCategory.updated).not.toBe(updatedCategory.created);
+                        (0, bun_test_1.expect)(unchangedCategory.updated).toBe(unchangedCategory.created);
+                        (0, bun_test_1.expect)(updatedCategory.name).toBe("Updated Category");
+                        // Unchanged.
+                        (0, bun_test_1.expect)(updatedCategory.show).toBe(true);
+                        (0, bun_test_1.expect)(unchangedCategory.show).toBe(true);
+                        return [2 /*return*/];
+                }
+            });
+        }); });
+        (0, bun_test_1.it)("array operations call postUpdate with different copy of document", function () { return __awaiter(void 0, void 0, void 0, function () {
+            var postUpdateDoc, postUpdatePrevDoc, postUpdateCalled, categoryId, updatedCategory, prevCategory, remainingCategories, prevCategories;
+            return __generator(this, function (_a) {
+                switch (_a.label) {
+                    case 0:
+                        postUpdateCalled = false;
+                        app = (0, tests_1.getBaseServer)();
+                        (0, auth_1.setupAuth)(app, tests_1.UserModel);
+                        (0, auth_1.addAuthRoutes)(app, tests_1.UserModel);
+                        app.use("/food", (0, api_1.modelRouter)(tests_1.FoodModel, {
+                            allowAnonymous: true,
+                            permissions: {
+                                create: [permissions_1.Permissions.IsAdmin],
+                                delete: [permissions_1.Permissions.IsAdmin],
+                                list: [permissions_1.Permissions.IsAdmin],
+                                read: [permissions_1.Permissions.IsAdmin],
+                                update: [permissions_1.Permissions.IsAdmin],
+                            },
+                            postUpdate: function (doc, _cleanedBody, _request, prevValue) { return __awaiter(void 0, void 0, void 0, function () {
+                                return __generator(this, function (_a) {
+                                    postUpdateDoc = doc;
+                                    postUpdatePrevDoc = prevValue;
+                                    postUpdateCalled = true;
+                                    return [2 /*return*/];
+                                });
+                            }); },
+                        }));
+                        server = (0, supertest_1.default)(app);
+                        return [4 /*yield*/, (0, tests_1.authAsUser)(app, "admin")];
+                    case 1:
+                        agent = _a.sent();
+                        // Test POST operation (add to array)
+                        return [4 /*yield*/, agent
+                                .post("/food/".concat(apple._id, "/categories"))
+                                .send({ categories: { name: "New Category", show: true } })
+                                .expect(200)];
+                    case 2:
+                        // Test POST operation (add to array)
+                        _a.sent();
+                        (0, bun_test_1.expect)(postUpdateCalled).toBe(true);
+                        (0, bun_test_1.expect)(postUpdateDoc).toBeDefined();
+                        (0, bun_test_1.expect)(postUpdatePrevDoc).toBeDefined();
+                        // Verify they are different object references
+                        (0, bun_test_1.expect)(postUpdateDoc).not.toBe(postUpdatePrevDoc);
+                        // Verify the content is different (new category added)
+                        (0, bun_test_1.expect)(postUpdateDoc.categories).toHaveLength(3);
+                        (0, bun_test_1.expect)(postUpdatePrevDoc.categories).toHaveLength(2);
+                        // Reset for next test
+                        postUpdateCalled = false;
+                        postUpdateDoc = undefined;
+                        postUpdatePrevDoc = undefined;
+                        categoryId = apple.categories[0]._id;
+                        if (!categoryId) {
+                            throw new Error("Category ID is undefined");
+                        }
+                        return [4 /*yield*/, agent
+                                .patch("/food/".concat(apple._id, "/categories/").concat(categoryId))
+                                .send({ categories: { name: "Updated Category", show: false } })
+                                .expect(200)];
+                    case 3:
+                        _a.sent();
+                        (0, bun_test_1.expect)(postUpdateCalled).toBe(true);
+                        (0, bun_test_1.expect)(postUpdateDoc).toBeDefined();
+                        (0, bun_test_1.expect)(postUpdatePrevDoc).toBeDefined();
+                        // Verify they are different object references
+                        (0, bun_test_1.expect)(postUpdateDoc).not.toBe(postUpdatePrevDoc);
+                        updatedCategory = postUpdateDoc.categories.find(function (c) { return c._id.toString() === categoryId.toString(); });
+                        prevCategory = postUpdatePrevDoc.categories.find(function (c) { return c._id.toString() === categoryId.toString(); });
+                        (0, bun_test_1.expect)(updatedCategory.name).toBe("Updated Category");
+                        (0, bun_test_1.expect)(prevCategory.name).toBe("Fruit");
+                        // Reset for next test
+                        postUpdateCalled = false;
+                        postUpdateDoc = undefined;
+                        postUpdatePrevDoc = undefined;
+                        // Test DELETE operation (remove from array)
+                        return [4 /*yield*/, agent.delete("/food/".concat(apple._id, "/categories/").concat(categoryId)).expect(200)];
+                    case 4:
+                        // Test DELETE operation (remove from array)
+                        _a.sent();
+                        (0, bun_test_1.expect)(postUpdateCalled).toBe(true);
+                        (0, bun_test_1.expect)(postUpdateDoc).toBeDefined();
+                        (0, bun_test_1.expect)(postUpdatePrevDoc).toBeDefined();
+                        // Verify they are different object references
+                        (0, bun_test_1.expect)(postUpdateDoc).not.toBe(postUpdatePrevDoc);
+                        remainingCategories = postUpdateDoc.categories.filter(function (c) { return c._id.toString() === categoryId.toString(); });
+                        prevCategories = postUpdatePrevDoc.categories.filter(function (c) { return c._id.toString() === categoryId.toString(); });
+                        (0, bun_test_1.expect)(remainingCategories).toHaveLength(0);
+                        (0, bun_test_1.expect)(prevCategories).toHaveLength(1);
+                        return [2 /*return*/];
+                }
+            });
+        }); });
+        (0, bun_test_1.it)("array operations with string arrays call postUpdate with different copy", function () { return __awaiter(void 0, void 0, void 0, function () {
+            var postUpdateDoc, postUpdatePrevDoc, postUpdateCalled;
+            return __generator(this, function (_a) {
+                switch (_a.label) {
+                    case 0:
+                        postUpdateCalled = false;
+                        app = (0, tests_1.getBaseServer)();
+                        (0, auth_1.setupAuth)(app, tests_1.UserModel);
+                        (0, auth_1.addAuthRoutes)(app, tests_1.UserModel);
+                        app.use("/food", (0, api_1.modelRouter)(tests_1.FoodModel, {
+                            allowAnonymous: true,
+                            permissions: {
+                                create: [permissions_1.Permissions.IsAdmin],
+                                delete: [permissions_1.Permissions.IsAdmin],
+                                list: [permissions_1.Permissions.IsAdmin],
+                                read: [permissions_1.Permissions.IsAdmin],
+                                update: [permissions_1.Permissions.IsAdmin],
+                            },
+                            postUpdate: function (doc, _cleanedBody, _request, prevValue) { return __awaiter(void 0, void 0, void 0, function () {
+                                return __generator(this, function (_a) {
+                                    postUpdateDoc = doc;
+                                    postUpdatePrevDoc = prevValue;
+                                    postUpdateCalled = true;
+                                    return [2 /*return*/];
+                                });
+                            }); },
+                        }));
+                        server = (0, supertest_1.default)(app);
+                        return [4 /*yield*/, (0, tests_1.authAsUser)(app, "admin")];
+                    case 1:
+                        agent = _a.sent();
+                        // Test POST operation with string array (add tag)
+                        return [4 /*yield*/, agent.post("/food/".concat(apple._id, "/tags")).send({ tags: "organic" }).expect(200)];
+                    case 2:
+                        // Test POST operation with string array (add tag)
+                        _a.sent();
+                        (0, bun_test_1.expect)(postUpdateCalled).toBe(true);
+                        (0, bun_test_1.expect)(postUpdateDoc).toBeDefined();
+                        (0, bun_test_1.expect)(postUpdatePrevDoc).toBeDefined();
+                        // Verify they are different object references
+                        (0, bun_test_1.expect)(postUpdateDoc).not.toBe(postUpdatePrevDoc);
+                        // Verify the content is different (new tag added)
+                        (0, bun_test_1.expect)(postUpdateDoc.tags).toHaveLength(3);
+                        (0, bun_test_1.expect)(postUpdatePrevDoc.tags).toHaveLength(2);
+                        (0, bun_test_1.expect)(postUpdateDoc.tags).toContain("organic");
+                        (0, bun_test_1.expect)(postUpdatePrevDoc.tags).not.toContain("organic");
+                        // Reset for next test
+                        postUpdateCalled = false;
+                        postUpdateDoc = undefined;
+                        postUpdatePrevDoc = undefined;
+                        // Test PATCH operation with string array (update tag)
+                        return [4 /*yield*/, agent
+                                .patch("/food/".concat(apple._id, "/tags/healthy"))
+                                .send({ tags: "super-healthy" })
+                                .expect(200)];
+                    case 3:
+                        // Test PATCH operation with string array (update tag)
+                        _a.sent();
+                        (0, bun_test_1.expect)(postUpdateCalled).toBe(true);
+                        (0, bun_test_1.expect)(postUpdateDoc).not.toBe(postUpdatePrevDoc);
+                        // Verify the content is different (tag updated)
+                        (0, bun_test_1.expect)(postUpdateDoc.tags).toContain("super-healthy");
+                        (0, bun_test_1.expect)(postUpdatePrevDoc.tags).toContain("healthy");
+                        (0, bun_test_1.expect)(postUpdateDoc.tags).not.toContain("healthy");
+                        (0, bun_test_1.expect)(postUpdatePrevDoc.tags).not.toContain("super-healthy");
+                        return [2 /*return*/];
+                }
+            });
+        }); });
+    });
+    (0, bun_test_1.describe)("standard methods", function () {
+        var notAdmin;
+        var admin;
+        var adminOther;
+        var agent;
+        var spinach;
+        var apple;
+        var carrots;
+        var pizza;
+        (0, bun_test_1.beforeEach)(function () { return __awaiter(void 0, void 0, void 0, function () {
+            var results;
+            var _a, _b;
+            return __generator(this, function (_c) {
+                switch (_c.label) {
+                    case 0: return [4 /*yield*/, (0, tests_1.setupDb)()];
+                    case 1:
+                        _a = __read.apply(void 0, [_c.sent(), 3]), admin = _a[0], notAdmin = _a[1], adminOther = _a[2];
+                        return [4 /*yield*/, Promise.all([
+                                tests_1.FoodModel.create({
+                                    calories: 1,
+                                    created: new Date("2021-12-03T00:00:20.000Z"),
+                                    eatenBy: [admin._id],
+                                    hidden: false,
+                                    lastEatenWith: {
+                                        dressing: new Date("2021-12-03T19:00:30.000Z"),
+                                    },
+                                    name: "Spinach",
+                                    ownerId: notAdmin._id,
+                                    source: {
+                                        dateAdded: "2023-12-13T12:30:00.000Z",
+                                        href: "https://www.google.com",
+                                        name: "Brand",
+                                    },
+                                }),
+                                tests_1.FoodModel.create({
+                                    calories: 100,
+                                    created: new Date("2021-12-03T00:00:30.000Z"),
+                                    hidden: true,
+                                    name: "Apple",
+                                    ownerId: admin._id,
+                                    tags: ["healthy"],
+                                }),
+                                tests_1.FoodModel.create({
+                                    calories: 100,
+                                    created: new Date("2021-12-03T00:00:00.000Z"),
+                                    eatenBy: [admin._id, notAdmin._id],
+                                    hidden: false,
+                                    name: "Carrots",
+                                    ownerId: admin._id,
+                                    source: {
+                                        name: "USDA",
+                                    },
+                                    tags: ["healthy", "cheap"],
+                                }),
+                                tests_1.FoodModel.create({
+                                    calories: 400,
+                                    created: new Date("2021-12-03T00:00:10.000Z"),
+                                    eatenBy: [adminOther._id],
+                                    hidden: false,
+                                    name: "Pizza",
+                                    ownerId: admin._id,
+                                    tags: ["cheap"],
+                                }),
+                            ])];
+                    case 2:
+                        results = (_c.sent());
+                        _b = __read(results, 4), spinach = _b[0], apple = _b[1], carrots = _b[2], pizza = _b[3];
+                        app = (0, tests_1.getBaseServer)();
+                        (0, auth_1.setupAuth)(app, tests_1.UserModel);
+                        (0, auth_1.addAuthRoutes)(app, tests_1.UserModel);
+                        app.use(expressServer_1.logRequests);
+                        app.use("/food", (0, api_1.modelRouter)(tests_1.FoodModel, {
+                            allowAnonymous: true,
+                            defaultLimit: 2,
+                            defaultQueryParams: { hidden: false },
+                            maxLimit: 3,
+                            permissions: {
+                                create: [permissions_1.Permissions.IsAuthenticated],
+                                delete: [permissions_1.Permissions.IsAdmin],
+                                list: [permissions_1.Permissions.IsAny],
+                                read: [permissions_1.Permissions.IsAny],
+                                update: [permissions_1.Permissions.IsOwner],
+                            },
+                            populatePaths: [{ path: "ownerId" }],
+                            queryFields: ["hidden", "name", "calories", "created", "source.name", "tags", "eatenBy"],
+                            sort: { created: "descending" },
+                        }));
+                        server = (0, supertest_1.default)(app);
+                        return [4 /*yield*/, (0, tests_1.authAsUser)(app, "notAdmin")];
+                    case 3:
+                        agent = _c.sent();
+                        return [2 /*return*/];
+                }
+            });
+        }); });
+        (0, bun_test_1.it)("read default", function () { return __awaiter(void 0, void 0, void 0, function () {
+            var res;
+            return __generator(this, function (_a) {
+                switch (_a.label) {
+                    case 0: return [4 /*yield*/, agent.get("/food/".concat(spinach._id)).expect(200)];
+                    case 1:
+                        res = _a.sent();
+                        (0, bun_test_1.expect)(res.body.data._id).toBe(spinach._id.toString());
+                        // Ensure populate works
+                        (0, bun_test_1.expect)(res.body.data.ownerId._id).toBe(notAdmin.id);
+                        // Ensure maps are properly transformed
+                        (0, bun_test_1.expect)(res.body.data.lastEatenWith).toEqual({
+                            dressing: "2021-12-03T19:00:30.000Z",
+                        });
+                        return [2 /*return*/];
+                }
+            });
+        }); });
+        (0, bun_test_1.it)("list default", function () { return __awaiter(void 0, void 0, void 0, function () {
+            var res;
+            return __generator(this, function (_a) {
+                switch (_a.label) {
+                    case 0: return [4 /*yield*/, agent.get("/food").expect(200)];
+                    case 1:
+                        res = _a.sent();
+                        (0, bun_test_1.expect)(res.body.data).toHaveLength(2);
+                        (0, bun_test_1.expect)(res.body.data[0].id).toBe(spinach.id);
+                        (0, bun_test_1.expect)(res.body.data[0].ownerId._id).toBe(notAdmin.id);
+                        (0, bun_test_1.expect)(res.body.data[1].id).toBe(pizza.id);
+                        (0, bun_test_1.expect)(res.body.data[1].ownerId._id).toBe(admin.id);
+                        // Check that mongoose Map is handled correctly.
+                        (0, bun_test_1.expect)(res.body.data[0].lastEatenWith).toEqual({
+                            dressing: "2021-12-03T19:00:30.000Z",
+                        });
+                        (0, bun_test_1.expect)(res.body.data[1].lastEatenWith).toEqual(undefined);
+                        (0, bun_test_1.expect)(res.body.more).toBe(true);
+                        (0, bun_test_1.expect)(res.body.total).toBe(3);
+                        return [2 /*return*/];
+                }
+            });
+        }); });
+        (0, bun_test_1.it)("list limit", function () { return __awaiter(void 0, void 0, void 0, function () {
+            var res;
+            return __generator(this, function (_a) {
+                switch (_a.label) {
+                    case 0: return [4 /*yield*/, agent.get("/food?limit=1").expect(200)];
+                    case 1:
+                        res = _a.sent();
+                        (0, bun_test_1.expect)(res.body.data).toHaveLength(1);
+                        (0, bun_test_1.expect)(res.body.data[0].id).toBe(spinach.id);
+                        (0, bun_test_1.expect)(res.body.data[0].ownerId._id).toBe(notAdmin.id);
+                        (0, bun_test_1.expect)(res.body.more).toBe(true);
+                        (0, bun_test_1.expect)(res.body.total).toBe(3);
+                        return [2 /*return*/];
+                }
+            });
+        }); });
+        (0, bun_test_1.it)("list limit over", function () { return __awaiter(void 0, void 0, void 0, function () {
+            var res;
+            return __generator(this, function (_a) {
+                switch (_a.label) {
+                    case 0: 
+                    // This shouldn't be seen, it's the end of the list.
+                    return [4 /*yield*/, tests_1.FoodModel.create({
+                            calories: 400,
+                            created: new Date("2021-12-02T00:00:10.000Z"),
+                            hidden: false,
+                            name: "Pizza",
+                            ownerId: admin._id,
+                        })];
+                    case 1:
+                        // This shouldn't be seen, it's the end of the list.
+                        _a.sent();
+                        return [4 /*yield*/, agent.get("/food?limit=4").expect(200)];
+                    case 2:
+                        res = _a.sent();
+                        (0, bun_test_1.expect)(res.body.data).toHaveLength(3);
+                        (0, bun_test_1.expect)(res.body.more).toBe(true);
+                        (0, bun_test_1.expect)(res.body.total).toBe(4);
+                        (0, bun_test_1.expect)(res.body.data[0].id).toBe(spinach.id);
+                        (0, bun_test_1.expect)(res.body.data[1].id).toBe(pizza.id);
+                        (0, bun_test_1.expect)(res.body.data[2].id).toBe(carrots.id);
+                        (0, bun_test_1.expect)(Sentry.captureMessage).toHaveBeenCalledWith('More than 3 results returned for foods without pagination, data may be silently truncated. req.query: {"limit":"4"}');
+                        return [2 /*return*/];
+                }
+            });
+        }); });
+        (0, bun_test_1.it)("list page", function () { return __awaiter(void 0, void 0, void 0, function () {
+            var res;
+            return __generator(this, function (_a) {
+                switch (_a.label) {
+                    case 0: return [4 /*yield*/, agent.get("/food?limit=1&page=2").expect(200)];
+                    case 1:
+                        res = _a.sent();
+                        (0, bun_test_1.expect)(res.body.data).toHaveLength(1);
+                        (0, bun_test_1.expect)(res.body.more).toBe(true);
+                        (0, bun_test_1.expect)(res.body.total).toBe(3);
+                        (0, bun_test_1.expect)(res.body.data[0].id).toBe(pizza.id);
+                        return [2 /*return*/];
+                }
+            });
+        }); });
+        (0, bun_test_1.it)("list page 0 ", function () { return __awaiter(void 0, void 0, void 0, function () {
+            var res;
+            return __generator(this, function (_a) {
+                switch (_a.label) {
+                    case 0: return [4 /*yield*/, agent.get("/food?limit=1&page=0").expect(400)];
+                    case 1:
+                        res = _a.sent();
+                        (0, bun_test_1.expect)(res.body.title).toBe("Invalid page: 0");
+                        return [2 /*return*/];
+                }
+            });
+        }); });
+        (0, bun_test_1.it)("list page with garbage ", function () { return __awaiter(void 0, void 0, void 0, function () {
+            var res;
+            return __generator(this, function (_a) {
+                switch (_a.label) {
+                    case 0: return [4 /*yield*/, agent.get("/food?limit=1&page=abc").expect(400)];
+                    case 1:
+                        res = _a.sent();
+                        (0, bun_test_1.expect)(res.body.title).toBe("Invalid page: abc");
+                        return [2 /*return*/];
+                }
+            });
+        }); });
+        (0, bun_test_1.it)("list page over", function () { return __awaiter(void 0, void 0, void 0, function () {
+            var res;
+            return __generator(this, function (_a) {
+                switch (_a.label) {
+                    case 0: return [4 /*yield*/, agent.get("/food?limit=1&page=5").expect(200)];
+                    case 1:
+                        res = _a.sent();
+                        (0, bun_test_1.expect)(res.body.data).toHaveLength(0);
+                        (0, bun_test_1.expect)(res.body.more).toBe(false);
+                        (0, bun_test_1.expect)(res.body.total).toBe(3);
+                        return [2 /*return*/];
+                }
+            });
+        }); });
+        (0, bun_test_1.it)("list query params", function () { return __awaiter(void 0, void 0, void 0, function () {
+            var res;
+            return __generator(this, function (_a) {
+                switch (_a.label) {
+                    case 0: return [4 /*yield*/, agent.get("/food?hidden=true").expect(200)];
+                    case 1:
+                        res = _a.sent();
+                        (0, bun_test_1.expect)(res.body.data).toHaveLength(1);
+                        (0, bun_test_1.expect)(res.body.more).toBe(false);
+                        (0, bun_test_1.expect)(res.body.total).toBe(1);
+                        (0, bun_test_1.expect)(res.body.data[0].id).toBe(apple.id);
+                        return [2 /*return*/];
+                }
+            });
+        }); });
+        (0, bun_test_1.it)("list query params not in list", function () { return __awaiter(void 0, void 0, void 0, function () {
+            var res;
+            return __generator(this, function (_a) {
+                switch (_a.label) {
+                    case 0: return [4 /*yield*/, agent.get("/food?ownerId=".concat(admin._id)).expect(400)];
+                    case 1:
+                        res = _a.sent();
+                        (0, bun_test_1.expect)(res.body.title).toBe("ownerId is not allowed as a query param.");
+                        return [2 /*return*/];
+                }
+            });
+        }); });
+        (0, bun_test_1.it)("list query by nested param", function () { return __awaiter(void 0, void 0, void 0, function () {
+            var res;
+            return __generator(this, function (_a) {
+                switch (_a.label) {
+                    case 0: return [4 /*yield*/, agent.get("/food?source.name=USDA").expect(200)];
+                    case 1:
+                        res = _a.sent();
+                        (0, bun_test_1.expect)(res.body.data).toHaveLength(1);
+                        (0, bun_test_1.expect)(res.body.total).toBe(1);
+                        (0, bun_test_1.expect)(res.body.data[0].id).toBe(carrots.id);
+                        return [2 /*return*/];
+                }
+            });
+        }); });
+        (0, bun_test_1.it)("query by date", function () { return __awaiter(void 0, void 0, void 0, function () {
+            var authRes, token, res, createdDates;
+            return __generator(this, function (_a) {
+                switch (_a.label) {
+                    case 0: return [4 /*yield*/, server
+                            .post("/auth/login")
+                            .send({ email: "admin@example.com", password: "securePassword" })
+                            .expect(200)];
+                    case 1:
+                        authRes = _a.sent();
+                        token = authRes.body.data.token;
+                        return [4 /*yield*/, server
+                                .get("/food?limit=3&".concat(qs_1.default.stringify({
+                                created: {
+                                    $gte: "2021-12-03T00:00:00.000Z",
+                                    $lte: "2021-12-03T00:00:20.000Z",
+                                },
+                            })))
+                                .set("authorization", "Bearer ".concat(token))
+                                .expect(200)];
+                    case 2:
+                        res = _a.sent();
+                        (0, bun_test_1.expect)(res.body.data.map(function (d) { return d.created; })).toEqual(bun_test_1.expect.arrayContaining([
+                            "2021-12-03T00:00:20.000Z",
+                            "2021-12-03T00:00:10.000Z",
+                            "2021-12-03T00:00:00.000Z",
+                        ]));
+                        (0, bun_test_1.expect)(res.body.data.map(function (d) { return d.created; })).toHaveLength(3);
+                        return [4 /*yield*/, server
+                                .get("/food?limit=3&".concat(qs_1.default.stringify({
+                                created: {
+                                    $gte: "2021-12-03T00:00:00.000Z",
+                                    $lt: "2021-12-03T00:00:20.000Z",
+                                },
+                            })))
+                                .set("authorization", "Bearer ".concat(token))
+                                .expect(200)];
+                    case 3:
+                        // Inclusive one side
+                        res = _a.sent();
+                        (0, bun_test_1.expect)(res.body.data.map(function (d) { return d.created; })).toEqual(bun_test_1.expect.arrayContaining(["2021-12-03T00:00:10.000Z", "2021-12-03T00:00:00.000Z"]));
+                        (0, bun_test_1.expect)(res.body.data.map(function (d) { return d.created; })).toHaveLength(2);
+                        return [4 /*yield*/, server
+                                .get("/food?limit=3&".concat(qs_1.default.stringify({
+                                created: {
+                                    $gt: "2021-12-03T00:00:00.000Z",
+                                    $lt: "2021-12-03T00:00:20.000Z",
+                                },
+                            })))
+                                .set("authorization", "Bearer ".concat(token))
+                                .expect(200)];
+                    case 4:
+                        // Inclusive both sides
+                        res = _a.sent();
+                        createdDates = res.body.data.map(function (d) { return d.created; });
+                        (0, bun_test_1.expect)(createdDates).toEqual(bun_test_1.expect.arrayContaining(["2021-12-03T00:00:10.000Z"]));
+                        (0, bun_test_1.expect)(createdDates).toHaveLength(1);
+                        return [2 /*return*/];
+                }
+            });
+        }); });
+        (0, bun_test_1.it)("query with a space", function () { return __awaiter(void 0, void 0, void 0, function () {
+            var greenBeans, res;
+            return __generator(this, function (_a) {
+                switch (_a.label) {
+                    case 0: return [4 /*yield*/, tests_1.FoodModel.create({
+                            calories: 102,
+                            created: Date.now() - 10,
+                            name: "Green Beans",
+                            ownerId: admin === null || admin === void 0 ? void 0 : admin._id,
+                        })];
+                    case 1:
+                        greenBeans = _a.sent();
+                        return [4 /*yield*/, agent.get("/food?".concat(qs_1.default.stringify({ name: "Green Beans" }))).expect(200)];
+                    case 2:
+                        res = _a.sent();
+                        (0, bun_test_1.expect)(res.body.data).toHaveLength(1);
+                        (0, bun_test_1.expect)(res.body.data[0].id).toBe(greenBeans === null || greenBeans === void 0 ? void 0 : greenBeans.id);
+                        (0, bun_test_1.expect)(res.body.data[0].name).toBe("Green Beans");
+                        return [2 /*return*/];
+                }
+            });
+        }); });
+        (0, bun_test_1.it)("query with a regex", function () { return __awaiter(void 0, void 0, void 0, function () {
+            var greenBeans, res;
+            return __generator(this, function (_a) {
+                switch (_a.label) {
+                    case 0: return [4 /*yield*/, tests_1.FoodModel.create({
+                            calories: 102,
+                            created: Date.now() - 10,
+                            name: "Green Beans",
+                            ownerId: admin === null || admin === void 0 ? void 0 : admin._id,
+                        })];
+                    case 1:
+                        greenBeans = _a.sent();
+                        return [4 /*yield*/, agent.get("/food?".concat(qs_1.default.stringify({ name: { $regex: "Green" } }))).expect(200)];
+                    case 2:
+                        res = _a.sent();
+                        (0, bun_test_1.expect)(res.body.data).toHaveLength(1);
+                        (0, bun_test_1.expect)(res.body.data[0].id).toBe(greenBeans === null || greenBeans === void 0 ? void 0 : greenBeans.id);
+                        (0, bun_test_1.expect)(res.body.data[0].name).toBe("Green Beans");
+                        return [4 /*yield*/, agent.get("/food?".concat(qs_1.default.stringify({ name: { $regex: "green" } }))).expect(200)];
+                    case 3:
+                        // Fails with different casing and sensitive
+                        res = _a.sent();
+                        (0, bun_test_1.expect)(res.body.data).toHaveLength(0);
+                        return [4 /*yield*/, agent
+                                .get("/food?".concat(qs_1.default.stringify({ name: { $options: "i", $regex: "green" } })))
+                                .expect(200)];
+                    case 4:
+                        // Case insensitive does match different casing
+                        res = _a.sent();
+                        (0, bun_test_1.expect)(res.body.data).toHaveLength(1);
+                        (0, bun_test_1.expect)(res.body.data[0].id).toBe(greenBeans === null || greenBeans === void 0 ? void 0 : greenBeans.id);
+                        return [2 /*return*/];
+                }
+            });
+        }); });
+        (0, bun_test_1.it)("query with an $in operator", function () { return __awaiter(void 0, void 0, void 0, function () {
+            var res, names1, names2;
+            return __generator(this, function (_a) {
+                switch (_a.label) {
+                    case 0: return [4 /*yield*/, server
+                            .get("/food?".concat(qs_1.default.stringify({
+                            name: {
+                                $in: ["Apple", "Spinach"],
+                            },
+                        })))
+                            .expect(200)];
+                    case 1:
+                        res = _a.sent();
+                        names1 = res.body.data.map(function (d) { return d.name; });
+                        (0, bun_test_1.expect)(names1).toEqual(bun_test_1.expect.arrayContaining(["Spinach"]));
+                        (0, bun_test_1.expect)(names1).toHaveLength(1);
+                        return [4 /*yield*/, server
+                                .get("/food?".concat(qs_1.default.stringify({
+                                name: {
+                                    $in: ["Carrots", "Spinach"],
+                                },
+                            })))
+                                .expect(200)];
+                    case 2:
+                        // Query without hidden food.
+                        res = _a.sent();
+                        names2 = res.body.data.map(function (d) { return d.name; });
+                        (0, bun_test_1.expect)(names2).toEqual(bun_test_1.expect.arrayContaining(["Spinach", "Carrots"]));
+                        (0, bun_test_1.expect)(names2).toHaveLength(2);
+                        return [2 /*return*/];
+                }
+            });
+        }); });
+        (0, bun_test_1.it)("query with an $in for _ids in nested object", function () { return __awaiter(void 0, void 0, void 0, function () {
+            var res, names3;
+            return __generator(this, function (_a) {
+                switch (_a.label) {
+                    case 0: return [4 /*yield*/, server
+                            .get("/food?".concat(qs_1.default.stringify({
+                            eatenBy: {
+                                $in: [notAdmin._id.toString(), adminOther._id.toString()],
+                            },
+                        })))
+                            .expect(200)];
+                    case 1:
+                        res = _a.sent();
+                        (0, bun_test_1.expect)(res.body.more).toBe(false);
+                        (0, bun_test_1.expect)(res.body.total).toBe(2);
+                        (0, bun_test_1.expect)(res.body.data).toHaveLength(2);
+                        names3 = res.body.data.map(function (d) { return d.name; });
+                        (0, bun_test_1.expect)(names3).toEqual(bun_test_1.expect.arrayContaining(["Carrots", "Pizza"]));
+                        (0, bun_test_1.expect)(names3).toHaveLength(2);
+                        return [2 /*return*/];
+                }
+            });
+        }); });
+        (0, bun_test_1.it)("query $and operator on same field", function () { return __awaiter(void 0, void 0, void 0, function () {
+            var res;
+            return __generator(this, function (_a) {
+                switch (_a.label) {
+                    case 0: return [4 /*yield*/, agent
+                            .get("/food?".concat(qs_1.default.stringify({ $and: [{ tags: "healthy" }, { tags: "cheap" }] })))
+                            .expect(200)];
+                    case 1:
+                        res = _a.sent();
+                        (0, bun_test_1.expect)(res.body.data).toHaveLength(1);
+                        (0, bun_test_1.expect)(res.body.data[0].id).toBe(carrots === null || carrots === void 0 ? void 0 : carrots._id.toString());
+                        return [2 /*return*/];
+                }
+            });
+        }); });
+        (0, bun_test_1.it)("query $and operator on same field, nested objects", function () { return __awaiter(void 0, void 0, void 0, function () {
+            var res;
+            return __generator(this, function (_a) {
+                switch (_a.label) {
+                    case 0: return [4 /*yield*/, agent
+                            .get("/food?".concat(qs_1.default.stringify({
+                            $and: [{ eatenBy: admin.id }, { eatenBy: notAdmin.id }],
+                        })))
+                            .expect(200)];
+                    case 1:
+                        res = _a.sent();
+                        (0, bun_test_1.expect)(res.body.data).toHaveLength(1);
+                        (0, bun_test_1.expect)(res.body.data[0].id).toBe(carrots === null || carrots === void 0 ? void 0 : carrots._id.toString());
+                        return [2 /*return*/];
+                }
+            });
+        }); });
+        (0, bun_test_1.it)("query $or operator on same field", function () { return __awaiter(void 0, void 0, void 0, function () {
+            var res, ids1;
+            return __generator(this, function (_a) {
+                switch (_a.label) {
+                    case 0: return [4 /*yield*/, agent
+                            .get("/food?".concat(qs_1.default.stringify({ $or: [{ name: "Carrots" }, { name: "Pizza" }] })))
+                            .expect(200)];
+                    case 1:
+                        res = _a.sent();
+                        (0, bun_test_1.expect)(res.body.data).toHaveLength(2);
+                        ids1 = res.body.data.map(function (d) { return d.id; });
+                        (0, bun_test_1.expect)(ids1).toEqual(bun_test_1.expect.arrayContaining([carrots === null || carrots === void 0 ? void 0 : carrots._id.toString(), pizza === null || pizza === void 0 ? void 0 : pizza._id.toString()]));
+                        (0, bun_test_1.expect)(ids1).toHaveLength(2);
+                        return [2 /*return*/];
+                }
+            });
+        }); });
+        (0, bun_test_1.it)("query $and operator on same field, nested objects", function () { return __awaiter(void 0, void 0, void 0, function () {
+            var res, ids2;
+            return __generator(this, function (_a) {
+                switch (_a.label) {
+                    case 0: return [4 /*yield*/, agent
+                            .get("/food?".concat(qs_1.default.stringify({
+                            $or: [{ eatenBy: admin.id }, { eatenBy: notAdmin.id }],
+                            limit: 3,
+                        })))
+                            .expect(200)];
+                    case 1:
+                        res = _a.sent();
+                        (0, bun_test_1.expect)(res.body.data).toHaveLength(2);
+                        ids2 = res.body.data.map(function (d) { return d.id; });
+                        (0, bun_test_1.expect)(ids2).toEqual(bun_test_1.expect.arrayContaining([carrots === null || carrots === void 0 ? void 0 : carrots._id.toString(), spinach === null || spinach === void 0 ? void 0 : spinach._id.toString()]));
+                        (0, bun_test_1.expect)(ids2).toHaveLength(2);
+                        return [2 /*return*/];
+                }
+            });
+        }); });
+        (0, bun_test_1.it)("query $and and $or are rejected if field is not in queryFields", function () { return __awaiter(void 0, void 0, void 0, function () {
+            var res;
+            return __generator(this, function (_a) {
+                switch (_a.label) {
+                    case 0: return [4 /*yield*/, agent
+                            .get("/food?".concat(qs_1.default.stringify({ $and: [{ ownerId: "healthy" }, { tags: "cheap" }] })))
+                            .expect(400)];
+                    case 1:
+                        res = _a.sent();
+                        (0, bun_test_1.expect)(res.body.title).toBe("ownerId is not allowed as a query param.");
+                        return [4 /*yield*/, agent
+                                .get("/food?".concat(qs_1.default.stringify({ $and: [{ tags: "cheap" }, { ownerId: "healthy" }] })))
+                                .expect(400)];
+                    case 2:
+                        // Check in the other order
+                        res = _a.sent();
+                        (0, bun_test_1.expect)(res.body.title).toBe("ownerId is not allowed as a query param.");
+                        return [4 /*yield*/, agent
+                                .get("/food?".concat(qs_1.default.stringify({ $or: [{ tags: "cheap" }, { ownerId: "healthy" }] })))
+                                .expect(400)];
+                    case 3:
+                        res = _a.sent();
+                        (0, bun_test_1.expect)(res.body.title).toBe("ownerId is not allowed as a query param.");
+                        return [2 /*return*/];
+                }
+            });
+        }); });
+        (0, bun_test_1.it)("query with a number", function () { return __awaiter(void 0, void 0, void 0, function () {
+            var res;
+            return __generator(this, function (_a) {
+                switch (_a.label) {
+                    case 0: return [4 /*yield*/, agent.get("/food?calories=100").expect(200)];
+                    case 1:
+                        res = _a.sent();
+                        (0, bun_test_1.expect)(res.body.data).toHaveLength(1);
+                        (0, bun_test_1.expect)(res.body.data[0].id).toBe(carrots === null || carrots === void 0 ? void 0 : carrots._id.toString());
+                        return [2 /*return*/];
+                }
+            });
+        }); });
+        (0, bun_test_1.it)("update", function () { return __awaiter(void 0, void 0, void 0, function () {
+            var res;
+            return __generator(this, function (_a) {
+                switch (_a.label) {
+                    case 0: return [4 /*yield*/, agent.patch("/food/".concat(spinach._id)).send({ name: "Kale" }).expect(200)];
+                    case 1:
+                        res = _a.sent();
+                        (0, bun_test_1.expect)(res.body.data.name).toBe("Kale");
+                        (0, bun_test_1.expect)(res.body.data.calories).toBe(1);
+                        (0, bun_test_1.expect)(res.body.data.hidden).toBe(false);
+                        return [4 /*yield*/, agent
+                                .patch("/food/".concat(spinach._id))
+                                .send({ lastEatenWith: { dressing: "2023-12-03T00:00:20.000Z" } })
+                                .expect(200)];
+                    case 2:
+                        // Update a Map field.
+                        res = _a.sent();
+                        (0, bun_test_1.expect)(res.body.data.name).toBe("Kale");
+                        (0, bun_test_1.expect)(res.body.data.calories).toBe(1);
+                        (0, bun_test_1.expect)(res.body.data.hidden).toBe(false);
+                        (0, bun_test_1.expect)(res.body.data.lastEatenWith).toEqual({
+                            dressing: "2023-12-03T00:00:20.000Z",
+                        });
+                        return [4 /*yield*/, agent
+                                .patch("/food/".concat(spinach._id))
+                                .send({
+                                lastEatenWith: {
+                                    cucumber: "2023-12-04T12:00:20.000Z",
+                                    dressing: "2023-12-03T00:00:20.000Z",
+                                },
+                            })
+                                .expect(200)];
+                    case 3:
+                        // Update a Map field.
+                        res = _a.sent();
+                        (0, bun_test_1.expect)(res.body.data.lastEatenWith).toEqual({
+                            cucumber: "2023-12-04T12:00:20.000Z",
+                            dressing: "2023-12-03T00:00:20.000Z",
+                        });
+                        return [2 /*return*/];
+                }
+            });
+        }); });
+        (0, bun_test_1.it)("update using dot notation", function () { return __awaiter(void 0, void 0, void 0, function () {
+            var res, dbSpinach;
+            return __generator(this, function (_a) {
+                switch (_a.label) {
+                    case 0: return [4 /*yield*/, agent
+                            .patch("/food/".concat(spinach._id))
+                            .send({ "source.href": "https://food.com" })
+                            .expect(200)];
+                    case 1:
+                        res = _a.sent();
+                        // Assert the field was updated with dot notation.
+                        (0, bun_test_1.expect)(res.body.data.source.href).toBe("https://food.com");
+                        // Assert these fields haven't changed.
+                        (0, bun_test_1.expect)(res.body.data.source.name).toBe("Brand");
+                        (0, bun_test_1.expect)(res.body.data.source.dateAdded).toBe("2023-12-13T12:30:00.000Z");
+                        return [4 /*yield*/, tests_1.FoodModel.findById(spinach._id)];
+                    case 2:
+                        dbSpinach = _a.sent();
+                        (0, bun_test_1.expect)(dbSpinach === null || dbSpinach === void 0 ? void 0 : dbSpinach.source.href).toBe("https://food.com");
+                        (0, bun_test_1.expect)(dbSpinach === null || dbSpinach === void 0 ? void 0 : dbSpinach.source.name).toBe("Brand");
+                        (0, bun_test_1.expect)(dbSpinach === null || dbSpinach === void 0 ? void 0 : dbSpinach.source.dateAdded).toBe("2023-12-13T12:30:00.000Z");
+                        return [2 /*return*/];
+                }
+            });
+        }); });
+    });
+    (0, bun_test_1.describe)("populate", function () {
+        var admin;
+        var notAdmin;
+        var agent;
+        var spinach;
+        (0, bun_test_1.beforeEach)(function () { return __awaiter(void 0, void 0, void 0, function () {
+            var _a, _b;
+            return __generator(this, function (_c) {
+                switch (_c.label) {
+                    case 0: return [4 /*yield*/, (0, tests_1.setupDb)()];
+                    case 1:
+                        _a = __read.apply(void 0, [_c.sent(), 2]), admin = _a[0], notAdmin = _a[1];
+                        return [4 /*yield*/, Promise.all([
+                                tests_1.FoodModel.create({
+                                    calories: 1,
+                                    created: new Date("2021-12-03T00:00:20.000Z"),
+                                    hidden: false,
+                                    name: "Spinach",
+                                    ownerId: admin._id,
+                                    source: {
+                                        name: "Brand",
+                                    },
+                                }),
+                                tests_1.FoodModel.create({
+                                    calories: 1,
+                                    created: new Date("2022-12-03T00:00:20.000Z"),
+                                    hidden: false,
+                                    name: "Carrots",
+                                    ownerId: notAdmin._id,
+                                    source: {
+                                        name: "User",
+                                    },
+                                }),
+                            ])];
+                    case 2:
+                        _b = __read.apply(void 0, [_c.sent(), 1]), spinach = _b[0];
+                        app = (0, tests_1.getBaseServer)();
+                        (0, auth_1.setupAuth)(app, tests_1.UserModel);
+                        (0, auth_1.addAuthRoutes)(app, tests_1.UserModel);
+                        app.use("/food", (0, api_1.modelRouter)(tests_1.FoodModel, {
+                            allowAnonymous: true,
+                            permissions: {
+                                create: [permissions_1.Permissions.IsAny],
+                                delete: [permissions_1.Permissions.IsAny],
+                                list: [permissions_1.Permissions.IsAny],
+                                read: [permissions_1.Permissions.IsAny],
+                                update: [permissions_1.Permissions.IsAny],
+                            },
+                            populatePaths: [{ fields: ["email"], path: "ownerId" }],
+                            sort: "-created",
+                        }));
+                        server = (0, supertest_1.default)(app);
+                        return [4 /*yield*/, (0, tests_1.authAsUser)(app, "notAdmin")];
+                    case 3:
+                        agent = _c.sent();
+                        return [2 /*return*/];
+                }
+            });
+        }); });
+        (0, bun_test_1.it)("lists with populate", function () { return __awaiter(void 0, void 0, void 0, function () {
+            var res, _a, carrots, spin;
+            return __generator(this, function (_b) {
+                switch (_b.label) {
+                    case 0: return [4 /*yield*/, agent.get("/food").expect(200)];
+                    case 1:
+                        res = _b.sent();
+                        (0, bun_test_1.expect)(res.body.data).toHaveLength(2);
+                        _a = __read(res.body.data, 2), carrots = _a[0], spin = _a[1];
+                        (0, bun_test_1.expect)(carrots.ownerId._id).toBe(notAdmin._id.toString());
+                        (0, bun_test_1.expect)(carrots.ownerId.email).toBe(notAdmin.email);
+                        (0, bun_test_1.expect)(carrots.ownerId.name).toBeUndefined();
+                        (0, bun_test_1.expect)(spin.ownerId._id).toBe(admin._id.toString());
+                        (0, bun_test_1.expect)(spin.ownerId.email).toBe(admin.email);
+                        (0, bun_test_1.expect)(spin.ownerId.name).toBeUndefined();
+                        return [2 /*return*/];
+                }
+            });
+        }); });
+        (0, bun_test_1.it)("reads with populate", function () { return __awaiter(void 0, void 0, void 0, function () {
+            var res;
+            return __generator(this, function (_a) {
+                switch (_a.label) {
+                    case 0: return [4 /*yield*/, agent.get("/food/".concat(spinach._id)).expect(200)];
+                    case 1:
+                        res = _a.sent();
+                        (0, bun_test_1.expect)(res.body.data.ownerId._id).toBe(admin._id.toString());
+                        (0, bun_test_1.expect)(res.body.data.ownerId.email).toBe(admin.email);
+                        (0, bun_test_1.expect)(res.body.data.ownerId.name).toBeUndefined();
+                        return [2 /*return*/];
+                }
+            });
+        }); });
+        (0, bun_test_1.it)("creates with populate", function () { return __awaiter(void 0, void 0, void 0, function () {
+            var res;
+            return __generator(this, function (_a) {
+                switch (_a.label) {
+                    case 0: return [4 /*yield*/, server
+                            .post("/food")
+                            .send({
+                            calories: 15,
+                            name: "Broccoli",
+                            ownerId: admin._id,
+                        })
+                            .expect(201)];
+                    case 1:
+                        res = _a.sent();
+                        (0, bun_test_1.expect)(res.body.data.ownerId._id).toBe(admin._id.toString());
+                        (0, bun_test_1.expect)(res.body.data.ownerId.email).toBe(admin.email);
+                        (0, bun_test_1.expect)(res.body.data.ownerId.name).toBeUndefined();
+                        return [2 /*return*/];
+                }
+            });
+        }); });
+        (0, bun_test_1.it)("updates with populate", function () { return __awaiter(void 0, void 0, void 0, function () {
+            var res;
+            return __generator(this, function (_a) {
+                switch (_a.label) {
+                    case 0: return [4 /*yield*/, server
+                            .patch("/food/".concat(spinach._id))
+                            .send({
+                            name: "NotSpinach",
+                        })
+                            .expect(200)];
+                    case 1:
+                        res = _a.sent();
+                        (0, bun_test_1.expect)(res.body.data.ownerId._id).toBe(admin._id.toString());
+                        (0, bun_test_1.expect)(res.body.data.ownerId.email).toBe(admin.email);
+                        (0, bun_test_1.expect)(res.body.data.ownerId.name).toBeUndefined();
+                        return [2 /*return*/];
+                }
+            });
+        }); });
+    });
+    (0, bun_test_1.describe)("responseHandler", function () {
+        var admin;
+        var agent;
+        var spinach;
+        (0, bun_test_1.beforeEach)(function () { return __awaiter(void 0, void 0, void 0, function () {
+            var _a, _b;
+            return __generator(this, function (_c) {
+                switch (_c.label) {
+                    case 0: return [4 /*yield*/, (0, tests_1.setupDb)()];
+                    case 1:
+                        _a = __read.apply(void 0, [_c.sent(), 1]), admin = _a[0];
+                        return [4 /*yield*/, Promise.all([
+                                tests_1.FoodModel.create({
+                                    calories: 1,
+                                    created: new Date("2021-12-03T00:00:20.000Z"),
+                                    hidden: false,
+                                    name: "Spinach",
+                                    ownerId: admin._id,
+                                    source: {
+                                        name: "Brand",
+                                    },
+                                }),
+                                tests_1.FoodModel.create({
+                                    calories: 100,
+                                    created: Date.now() - 10,
+                                    hidden: true,
+                                    name: "Apple",
+                                    ownerId: admin === null || admin === void 0 ? void 0 : admin._id,
+                                }),
+                            ])];
+                    case 2:
+                        _b = __read.apply(void 0, [_c.sent(), 1]), spinach = _b[0];
+                        app = (0, tests_1.getBaseServer)();
+                        (0, auth_1.setupAuth)(app, tests_1.UserModel);
+                        (0, auth_1.addAuthRoutes)(app, tests_1.UserModel);
+                        app.use("/food", (0, api_1.modelRouter)(tests_1.FoodModel, {
+                            allowAnonymous: true,
+                            permissions: {
+                                create: [permissions_1.Permissions.IsAny],
+                                delete: [permissions_1.Permissions.IsAny],
+                                list: [permissions_1.Permissions.IsAny],
+                                read: [permissions_1.Permissions.IsAny],
+                                update: [permissions_1.Permissions.IsAny],
+                            },
+                            responseHandler: function (data, method) {
+                                if (method === "list") {
+                                    return data.map(function (d) { return ({
+                                        foo: "bar",
+                                        id: d._id,
+                                    }); });
+                                }
+                                return {
+                                    foo: "bar",
+                                    id: data._id,
+                                };
+                            },
+                        }));
+                        server = (0, supertest_1.default)(app);
+                        return [4 /*yield*/, (0, tests_1.authAsUser)(app, "notAdmin")];
+                    case 3:
+                        agent = _c.sent();
+                        return [2 /*return*/];
+                }
+            });
+        }); });
+        (0, bun_test_1.it)("reads with serialize", function () { return __awaiter(void 0, void 0, void 0, function () {
+            var res;
+            return __generator(this, function (_a) {
+                switch (_a.label) {
+                    case 0: return [4 /*yield*/, agent.get("/food/".concat(spinach._id)).expect(200)];
+                    case 1:
+                        res = _a.sent();
+                        (0, bun_test_1.expect)(res.body.data.ownerId).toBeUndefined();
+                        (0, bun_test_1.expect)(res.body.data.id).toBe(spinach._id.toString());
+                        (0, bun_test_1.expect)(res.body.data.foo).toBe("bar");
+                        return [2 /*return*/];
+                }
+            });
+        }); });
+        (0, bun_test_1.it)("list with serialize", function () { return __awaiter(void 0, void 0, void 0, function () {
+            var res;
+            return __generator(this, function (_a) {
+                switch (_a.label) {
+                    case 0: return [4 /*yield*/, agent.get("/food").expect(200)];
+                    case 1:
+                        res = _a.sent();
+                        (0, bun_test_1.expect)(res.body.data[0].ownerId).toBeUndefined();
+                        (0, bun_test_1.expect)(res.body.data[1].ownerId).toBeUndefined();
+                        (0, bun_test_1.expect)(res.body.data[0].id).toBeDefined();
+                        (0, bun_test_1.expect)(res.body.data[0].foo).toBe("bar");
+                        (0, bun_test_1.expect)(res.body.data[1].id).toBeDefined();
+                        (0, bun_test_1.expect)(res.body.data[1].foo).toBe("bar");
+                        return [2 /*return*/];
+                }
+            });
+        }); });
+    });
+    (0, bun_test_1.describe)("plugins", function () {
+        var agent;
+        (0, bun_test_1.beforeEach)(function () { return __awaiter(void 0, void 0, void 0, function () {
+            return __generator(this, function (_a) {
+                switch (_a.label) {
+                    case 0: return [4 /*yield*/, (0, tests_1.setupDb)()];
+                    case 1:
+                        _a.sent();
+                        app = (0, tests_1.getBaseServer)();
+                        (0, auth_1.setupAuth)(app, tests_1.UserModel);
+                        (0, auth_1.addAuthRoutes)(app, tests_1.UserModel);
+                        app.use("/users", (0, api_1.modelRouter)(tests_1.UserModel, {
+                            allowAnonymous: true,
+                            permissions: {
+                                create: [permissions_1.Permissions.IsAny],
+                                delete: [permissions_1.Permissions.IsAny],
+                                list: [permissions_1.Permissions.IsAny],
+                                read: [permissions_1.Permissions.IsAny],
+                                update: [permissions_1.Permissions.IsAny],
+                            },
+                        }));
+                        server = (0, supertest_1.default)(app);
+                        return [4 /*yield*/, (0, tests_1.authAsUser)(app, "notAdmin")];
+                    case 2:
+                        agent = _a.sent();
+                        return [2 /*return*/];
+                }
+            });
+        }); });
+        (0, bun_test_1.it)("check that security fields are filtered", function () { return __awaiter(void 0, void 0, void 0, function () {
+            var res;
+            return __generator(this, function (_a) {
+                switch (_a.label) {
+                    case 0: return [4 /*yield*/, agent.get("/users").expect(200)];
+                    case 1:
+                        res = _a.sent();
+                        (0, bun_test_1.expect)(res.body.data[0].email).toBeDefined();
+                        (0, bun_test_1.expect)(res.body.data[0].token).toBeUndefined();
+                        (0, bun_test_1.expect)(res.body.data[0].hash).toBeUndefined();
+                        (0, bun_test_1.expect)(res.body.data[0].salt).toBeUndefined();
+                        return [2 /*return*/];
+                }
+            });
+        }); });
+    });
+    (0, bun_test_1.describe)("discriminator", function () {
+        var superUser;
+        var staffUser;
+        var notAdmin;
+        var agent;
+        (0, bun_test_1.beforeEach)(function () { return __awaiter(void 0, void 0, void 0, function () {
+            var _a, staffUserId, superUserId;
+            var _b;
+            return __generator(this, function (_c) {
+                switch (_c.label) {
+                    case 0: return [4 /*yield*/, (0, tests_1.setupDb)()];
+                    case 1:
+                        _b = __read.apply(void 0, [_c.sent(), 1]), notAdmin = _b[0];
+                        return [4 /*yield*/, Promise.all([
+                                tests_1.StaffUserModel.create({
+                                    department: "Accounting",
+                                    email: "staff@example.com",
+                                }),
+                                tests_1.SuperUserModel.create({
+                                    email: "superuser@example.com",
+                                    superTitle: "Super Man",
+                                }),
+                            ])];
+                    case 2:
+                        _a = __read.apply(void 0, [_c.sent(), 2]), staffUserId = _a[0], superUserId = _a[1];
+                        return [4 /*yield*/, tests_1.UserModel.findById(staffUserId)];
+                    case 3:
+                        staffUser = (_c.sent());
+                        return [4 /*yield*/, tests_1.UserModel.findById(superUserId)];
+                    case 4:
+                        superUser = (_c.sent());
+                        app = (0, tests_1.getBaseServer)();
+                        (0, auth_1.setupAuth)(app, tests_1.UserModel);
+                        (0, auth_1.addAuthRoutes)(app, tests_1.UserModel);
+                        app.use("/users", (0, api_1.modelRouter)(tests_1.UserModel, {
+                            allowAnonymous: true,
+                            discriminatorKey: "__t",
+                            permissions: {
+                                create: [permissions_1.Permissions.IsAuthenticated],
+                                delete: [permissions_1.Permissions.IsAuthenticated],
+                                list: [permissions_1.Permissions.IsAuthenticated],
+                                read: [permissions_1.Permissions.IsAuthenticated],
+                                update: [permissions_1.Permissions.IsAuthenticated],
+                            },
+                        }));
+                        server = (0, supertest_1.default)(app);
+                        return [4 /*yield*/, (0, tests_1.authAsUser)(app, "notAdmin")];
+                    case 5:
+                        agent = _c.sent();
+                        return [2 /*return*/];
+                }
+            });
+        }); });
+        (0, bun_test_1.it)("gets all users", function () { return __awaiter(void 0, void 0, void 0, function () {
+            var res, data;
+            return __generator(this, function (_a) {
+                switch (_a.label) {
+                    case 0: return [4 /*yield*/, agent.get("/users").expect(200)];
+                    case 1:
+                        res = _a.sent();
+                        (0, bun_test_1.expect)(res.body.data).toHaveLength(5);
+                        data = (0, sortBy_1.default)(res.body.data, ["email"]);
+                        (0, bun_test_1.expect)(data[0].email).toBe("admin+other@example.com");
+                        (0, bun_test_1.expect)(data[0].department).toBeUndefined();
+                        (0, bun_test_1.expect)(data[0].supertitle).toBeUndefined();
+                        (0, bun_test_1.expect)(data[0].__t).toBeUndefined();
+                        (0, bun_test_1.expect)(data[1].email).toBe("admin@example.com");
+                        (0, bun_test_1.expect)(data[1].department).toBeUndefined();
+                        (0, bun_test_1.expect)(data[1].supertitle).toBeUndefined();
+                        (0, bun_test_1.expect)(data[1].__t).toBeUndefined();
+                        (0, bun_test_1.expect)(data[2].email).toBe("notAdmin@example.com");
+                        (0, bun_test_1.expect)(data[2].department).toBeUndefined();
+                        (0, bun_test_1.expect)(data[2].supertitle).toBeUndefined();
+                        (0, bun_test_1.expect)(data[2].__t).toBeUndefined();
+                        (0, bun_test_1.expect)(data[3].email).toBe("staff@example.com");
+                        (0, bun_test_1.expect)(data[3].department).toBe("Accounting");
+                        (0, bun_test_1.expect)(data[3].supertitle).toBeUndefined();
+                        (0, bun_test_1.expect)(data[3].__t).toBe("Staff");
+                        (0, bun_test_1.expect)(data[4].email).toBe("superuser@example.com");
+                        (0, bun_test_1.expect)(data[4].department).toBeUndefined();
+                        (0, bun_test_1.expect)(data[4].superTitle).toBe("Super Man");
+                        (0, bun_test_1.expect)(data[4].__t).toBe("SuperUser");
+                        return [2 /*return*/];
+                }
+            });
+        }); });
+        (0, bun_test_1.it)("gets a discriminated user", function () { return __awaiter(void 0, void 0, void 0, function () {
+            var res;
+            return __generator(this, function (_a) {
+                switch (_a.label) {
+                    case 0: return [4 /*yield*/, agent.get("/users/".concat(superUser._id)).expect(200)];
+                    case 1:
+                        res = _a.sent();
+                        (0, bun_test_1.expect)(res.body.data.email).toBe("superuser@example.com");
+                        (0, bun_test_1.expect)(res.body.data.department).toBeUndefined();
+                        (0, bun_test_1.expect)(res.body.data.superTitle).toBe("Super Man");
+                        return [2 /*return*/];
+                }
+            });
+        }); });
+        (0, bun_test_1.it)("updates a discriminated user", function () { return __awaiter(void 0, void 0, void 0, function () {
+            var res, user;
+            return __generator(this, function (_a) {
+                switch (_a.label) {
+                    case 0: 
+                    // Fails without __t.
+                    return [4 /*yield*/, agent.patch("/users/".concat(superUser._id)).send({ superTitle: "Batman" }).expect(404)];
+                    case 1:
+                        // Fails without __t.
+                        _a.sent();
+                        return [4 /*yield*/, agent
+                                .patch("/users/".concat(superUser._id))
+                                .send({ __t: "SuperUser", superTitle: "Batman" })
+                                .expect(200)];
+                    case 2:
+                        res = _a.sent();
+                        (0, bun_test_1.expect)(res.body.data.email).toBe("superuser@example.com");
+                        (0, bun_test_1.expect)(res.body.data.department).toBeUndefined();
+                        (0, bun_test_1.expect)(res.body.data.superTitle).toBe("Batman");
+                        return [4 /*yield*/, tests_1.SuperUserModel.findById(superUser._id)];
+                    case 3:
+                        user = _a.sent();
+                        (0, bun_test_1.expect)(user === null || user === void 0 ? void 0 : user.superTitle).toBe("Batman");
+                        return [2 /*return*/];
+                }
+            });
+        }); });
+        (0, bun_test_1.it)("updates a base user", function () { return __awaiter(void 0, void 0, void 0, function () {
+            var res, user;
+            return __generator(this, function (_a) {
+                switch (_a.label) {
+                    case 0: return [4 /*yield*/, agent
+                            .patch("/users/".concat(notAdmin._id))
+                            .send({ email: "newemail@example.com", superTitle: "The Boss" })
+                            .expect(200)];
+                    case 1:
+                        res = _a.sent();
+                        (0, bun_test_1.expect)(res.body.data.email).toBe("newemail@example.com");
+                        (0, bun_test_1.expect)(res.body.data.superTitle).toBeUndefined();
+                        return [4 /*yield*/, tests_1.SuperUserModel.findById(notAdmin._id)];
+                    case 2:
+                        user = _a.sent();
+                        (0, bun_test_1.expect)(user === null || user === void 0 ? void 0 : user.superTitle).toBeUndefined();
+                        return [2 /*return*/];
+                }
+            });
+        }); });
+        (0, bun_test_1.it)("cannot update discriminator key", function () { return __awaiter(void 0, void 0, void 0, function () {
+            return __generator(this, function (_a) {
+                switch (_a.label) {
+                    case 0: return [4 /*yield*/, agent
+                            .patch("/users/".concat(notAdmin._id))
+                            .send({ __t: "Staff", superTitle: "Batman" })
+                            .expect(404)];
+                    case 1:
+                        _a.sent();
+                        return [4 /*yield*/, agent
+                                .patch("/users/".concat(staffUser._id))
+                                .send({ __t: "SuperUser", superTitle: "Batman" })
+                                .expect(404)];
+                    case 2:
+                        _a.sent();
+                        return [2 /*return*/];
+                }
+            });
+        }); });
+        (0, bun_test_1.it)("updating a field on another discriminated model does nothing", function () { return __awaiter(void 0, void 0, void 0, function () {
+            var res, user;
+            return __generator(this, function (_a) {
+                switch (_a.label) {
+                    case 0: return [4 /*yield*/, agent
+                            .patch("/users/".concat(superUser._id))
+                            .send({ __t: "SuperUser", department: "Journalism" })
+                            .expect(200)];
+                    case 1:
+                        res = _a.sent();
+                        (0, bun_test_1.expect)(res.body.data.department).toBeUndefined();
+                        return [4 /*yield*/, tests_1.SuperUserModel.findById(superUser._id)];
+                    case 2:
+                        user = _a.sent();
+                        (0, bun_test_1.expect)(user === null || user === void 0 ? void 0 : user.department).toBeUndefined();
+                        return [2 /*return*/];
+                }
+            });
+        }); });
+        (0, bun_test_1.it)("creates a discriminated user", function () { return __awaiter(void 0, void 0, void 0, function () {
+            var res, user;
+            return __generator(this, function (_a) {
+                switch (_a.label) {
+                    case 0: return [4 /*yield*/, agent
+                            .post("/users")
+                            .send({
+                            __t: "SuperUser",
+                            department: "R&D",
+                            email: "brucewayne@example.com",
+                            superTitle: "Batman",
+                        })
+                            .expect(201)];
+                    case 1:
+                        res = _a.sent();
+                        (0, bun_test_1.expect)(res.body.data.email).toBe("brucewayne@example.com");
+                        // Because we pass __t, this should create a SuperUser which has no department, so this is
+                        // dropped.
+                        (0, bun_test_1.expect)(res.body.data.department).toBeUndefined();
+                        (0, bun_test_1.expect)(res.body.data.superTitle).toBe("Batman");
+                        return [4 /*yield*/, tests_1.SuperUserModel.findById(res.body.data._id)];
+                    case 2:
+                        user = _a.sent();
+                        (0, bun_test_1.expect)(user === null || user === void 0 ? void 0 : user.superTitle).toBe("Batman");
+                        return [2 /*return*/];
+                }
+            });
+        }); });
+        (0, bun_test_1.it)("deletes a discriminated user", function () { return __awaiter(void 0, void 0, void 0, function () {
+            var user;
+            return __generator(this, function (_a) {
+                switch (_a.label) {
+                    case 0: 
+                    // Fails without __t.
+                    return [4 /*yield*/, agent.delete("/users/".concat(superUser._id)).expect(404)];
+                    case 1:
+                        // Fails without __t.
+                        _a.sent();
+                        return [4 /*yield*/, agent
+                                .delete("/users/".concat(superUser._id))
+                                .send({
+                                __t: "SuperUser",
+                            })
+                                .expect(204)];
+                    case 2:
+                        _a.sent();
+                        return [4 /*yield*/, tests_1.SuperUserModel.findById(superUser._id)];
+                    case 3:
+                        user = _a.sent();
+                        (0, bun_test_1.expect)(user).toBeNull();
+                        return [2 /*return*/];
+                }
+            });
+        }); });
+        (0, bun_test_1.it)("deletes a base user", function () { return __awaiter(void 0, void 0, void 0, function () {
+            var user;
+            return __generator(this, function (_a) {
+                switch (_a.label) {
+                    case 0: 
+                    // Fails for base user with __t
+                    return [4 /*yield*/, agent.delete("/users/".concat(notAdmin._id)).send({ __t: "SuperUser" }).expect(404)];
+                    case 1:
+                        // Fails for base user with __t
+                        _a.sent();
+                        return [4 /*yield*/, agent.delete("/users/".concat(notAdmin._id)).expect(204)];
+                    case 2:
+                        _a.sent();
+                        return [4 /*yield*/, tests_1.SuperUserModel.findById(notAdmin._id)];
+                    case 3:
+                        user = _a.sent();
+                        (0, bun_test_1.expect)(user).toBeNull();
+                        return [2 /*return*/];
+                }
+            });
+        }); });
+    });
+});