@terreno/api 0.0.11-beta.1 → 0.0.11

package/dist/permissions.d.ts

@@ -23,4 +23,4 @@ export declare const Permissions: {
     IsOwnerOrReadOnly: (method: RESTMethod, user?: User, obj?: any) => boolean;
 };
 export declare function checkPermissions<T>(method: RESTMethod, permissions: PermissionMethod<T>[], user?: User, obj?: T): Promise<boolean>;
-export declare function permissionMiddleware<T>(model: Model<T>, options: Pick<ModelRouterOptions<T>, "permissions" | "populatePaths">): (req: express.Request, _res: express.Response, next: NextFunction) => Promise<void>;
+export declare function permissionMiddleware<T>(baseModel: Model<T>, options: Pick<ModelRouterOptions<T>, "permissions" | "populatePaths" | "discriminatorKey">): (req: express.Request, _res: express.Response, next: NextFunction) => Promise<void>;

package/dist/permissions.js

@@ -194,20 +194,20 @@ function checkPermissions(method, permissions, user, obj) {
 // Check the permissions for a given model and method. If the method is a read, update, or delete,
 // finds the relevant object, checks the permissions, and attaches the object to the request as
 // req.obj.
-function permissionMiddleware(model, options) {
+function permissionMiddleware(baseModel, options) {
     var _this = this;
     return function (req, _res, next) { return __awaiter(_this, void 0, void 0, function () {
-        var method, reqMethod, builtQuery, populatedQuery, data, error_1, hiddenDoc, error, reason, error, error_2;
-        var _a, _b;
-        return __generator(this, function (_c) {
-            switch (_c.label) {
+        var method, reqMethod, model, builtQuery, populatedQuery, data, error_1, hiddenDoc, error, reason, error, error_2;
+        var _a, _b, _c, _d;
+        return __generator(this, function (_e) {
+            switch (_e.label) {
                 case 0:
                     if (req.method === "OPTIONS") {
                         return [2 /*return*/, next()];
                     }
-                    _c.label = 1;
+                    _e.label = 1;
                 case 1:
-                    _c.trys.push([1, 10, , 11]);
+                    _e.trys.push([1, 10, , 11]);
                     method = void 0;
                     reqMethod = req.method.toLowerCase();
                     if (reqMethod === "post") {
@@ -233,10 +233,11 @@ function permissionMiddleware(model, options) {
                             title: "Method ".concat(req.method, " not allowed"),
                         });
                     }
+                    model = (0, api_1.getModel)(baseModel, req.body, options);
                     return [4 /*yield*/, checkPermissions(method, options.permissions[method], req.user)];
                 case 2:
                     // All methods check for permissions.
-                    if (!(_c.sent())) {
+                    if (!(_e.sent())) {
                         throw new errors_1.APIError({
                             status: 405,
                             title: "Access to ".concat(method.toUpperCase(), " on ").concat(model.modelName, " ") +
@@ -249,27 +250,34 @@ function permissionMiddleware(model, options) {
                     builtQuery = model.findById(req.params.id);
                     populatedQuery = (0, api_1.addPopulateToQuery)(builtQuery, options.populatePaths);
                     data = void 0;
-                    _c.label = 3;
+                    _e.label = 3;
                 case 3:
-                    _c.trys.push([3, 5, , 6]);
+                    _e.trys.push([3, 5, , 6]);
                     return [4 /*yield*/, populatedQuery.exec()];
                 case 4:
-                    data = _c.sent();
+                    data = _e.sent();
                     return [3 /*break*/, 6];
                 case 5:
-                    error_1 = _c.sent();
+                    error_1 = _e.sent();
                     throw new errors_1.APIError({
                         error: error_1,
                         status: 500,
                         title: "GET failed on ".concat(req.params.id),
                     });
                 case 6:
-                    if (!!data) return [3 /*break*/, 8];
+                    if (!(!data || (["update", "delete"].includes(method) && (data === null || data === void 0 ? void 0 : data.__t) && !((_b = req.body) === null || _b === void 0 ? void 0 : _b.__t)))) return [3 /*break*/, 8];
+                    // For discriminated models, return 404 without checking hidden state
+                    if (["update", "delete"].includes(method) && (data === null || data === void 0 ? void 0 : data.__t) && !((_c = req.body) === null || _c === void 0 ? void 0 : _c.__t)) {
+                        throw new errors_1.APIError({
+                            status: 404,
+                            title: "Document ".concat(req.params.id, " not found for model ").concat(model.modelName),
+                        });
+                    }
                     return [4 /*yield*/, model.collection.findOne({
                             _id: new mongoose_1.default.Types.ObjectId(req.params.id),
                         })];
                 case 7:
-                    hiddenDoc = _c.sent();
+                    hiddenDoc = _e.sent();
                     if (!hiddenDoc) {
                         Sentry.captureMessage("Document ".concat(req.params.id, " not found for model ").concat(model.modelName));
                         error = new errors_1.APIError({
@@ -304,16 +312,16 @@ function permissionMiddleware(model, options) {
                     });
                 case 8: return [4 /*yield*/, checkPermissions(method, options.permissions[method], req.user, data)];
                 case 9:
-                    if (!(_c.sent())) {
+                    if (!(_e.sent())) {
                         throw new errors_1.APIError({
                             status: 403,
-                            title: "Access to GET on ".concat(model.modelName, ":").concat(req.params.id, " denied for ").concat((_b = req.user) === null || _b === void 0 ? void 0 : _b.id),
+                            title: "Access to GET on ".concat(model.modelName, ":").concat(req.params.id, " denied for ").concat((_d = req.user) === null || _d === void 0 ? void 0 : _d.id),
                         });
                     }
                     req.obj = data;
                     return [2 /*return*/, next()];
                 case 10:
-                    error_2 = _c.sent();
+                    error_2 = _e.sent();
                     logger_1.logger.error("Permissions error: ".concat(error_2 instanceof Error ? error_2.message : error_2));
                     return [2 /*return*/, next(error_2)];
                 case 11: return [2 /*return*/];

package/dist/utils.test.js

@@ -1,176 +1,14 @@
 "use strict";
-var __importDefault = (this && this.__importDefault) || function (mod) {
-    return (mod && mod.__esModule) ? mod : { "default": mod };
-};
 Object.defineProperty(exports, "__esModule", { value: true });
 var bun_test_1 = require("bun:test");
-var mongoose_1 = __importDefault(require("mongoose"));
 var utils_1 = require("./utils");
 (0, bun_test_1.describe)("utils", function () {
-    (0, bun_test_1.describe)("isValidObjectId", function () {
-        (0, bun_test_1.it)("checks valid ObjectIds", function () {
-            (0, bun_test_1.expect)((0, utils_1.isValidObjectId)("62c44da0003d9f8ee8cc925c")).toBe(true);
-            (0, bun_test_1.expect)((0, utils_1.isValidObjectId)("620000000000000000000000")).toBe(true);
-            // Mongoose's builtin "ObjectId.isValid" will falsely say this is an ObjectId.
-            (0, bun_test_1.expect)((0, utils_1.isValidObjectId)("1234567890ab")).toBe(false);
-            (0, bun_test_1.expect)((0, utils_1.isValidObjectId)("microsoft123")).toBe(false);
-            (0, bun_test_1.expect)((0, utils_1.isValidObjectId)("62c44da0003d9f8ee8cc925x")).toBe(false);
-        });
-    });
-    (0, bun_test_1.describe)("checkModelsStrict", function () {
-        (0, bun_test_1.it)("throws error when toObject.virtuals is not true", function () {
-            // Create a schema without toObject.virtuals
-            var testSchema = new mongoose_1.default.Schema({ name: String });
-            testSchema.set("strict", "throw");
-            // Not setting toObject.virtuals
-            if (mongoose_1.default.models.ToObjectTestModel) {
-                delete mongoose_1.default.models.ToObjectTestModel;
-            }
-            mongoose_1.default.model("ToObjectTestModel", testSchema);
-            try {
-                // This should throw because ToObjectTestModel doesn't have toObject.virtuals
-                (0, bun_test_1.expect)(function () { return (0, utils_1.checkModelsStrict)(); }).toThrow("toObject.virtuals not set to true");
-            }
-            finally {
-                delete mongoose_1.default.models.ToObjectTestModel;
-            }
-        });
-        (0, bun_test_1.it)("throws error when toJSON.virtuals is not true", function () {
-            // Create a schema with toObject.virtuals but without toJSON.virtuals
-            var testSchema = new mongoose_1.default.Schema({ name: String });
-            testSchema.set("toObject", { virtuals: true });
-            testSchema.set("strict", "throw");
-            // Not setting toJSON.virtuals
-            if (mongoose_1.default.models.ToJsonTestModel) {
-                delete mongoose_1.default.models.ToJsonTestModel;
-            }
-            mongoose_1.default.model("ToJsonTestModel", testSchema);
-            // Use spyOn to intercept modelNames and return only our test model
-            var spy = (0, bun_test_1.spyOn)(mongoose_1.default, "modelNames").mockReturnValue(["ToJsonTestModel"]);
-            try {
-                (0, bun_test_1.expect)(function () { return (0, utils_1.checkModelsStrict)(); }).toThrow("toJSON.virtuals not set to true");
-            }
-            finally {
-                spy.mockRestore();
-                delete mongoose_1.default.models.ToJsonTestModel;
-            }
-        });
-        (0, bun_test_1.it)("throws error when strict mode is not set to throw", function () {
-            // Create a schema with virtuals but without strict mode
-            var testSchema = new mongoose_1.default.Schema({ name: String });
-            testSchema.set("toObject", { virtuals: true });
-            testSchema.set("toJSON", { virtuals: true });
-            // Not setting strict to "throw"
-            if (mongoose_1.default.models.StrictTestModel) {
-                delete mongoose_1.default.models.StrictTestModel;
-            }
-            mongoose_1.default.model("StrictTestModel", testSchema);
-            var spy = (0, bun_test_1.spyOn)(mongoose_1.default, "modelNames").mockReturnValue(["StrictTestModel"]);
-            try {
-                (0, bun_test_1.expect)(function () { return (0, utils_1.checkModelsStrict)(); }).toThrow("is not set to strict mode");
-            }
-            finally {
-                spy.mockRestore();
-                delete mongoose_1.default.models.StrictTestModel;
-            }
-        });
-        (0, bun_test_1.it)("passes when all checks pass", function () {
-            // Create a properly configured schema
-            var testSchema = new mongoose_1.default.Schema({ name: String });
-            testSchema.set("toObject", { virtuals: true });
-            testSchema.set("toJSON", { virtuals: true });
-            testSchema.set("strict", "throw");
-            if (mongoose_1.default.models.GoodTestModel) {
-                delete mongoose_1.default.models.GoodTestModel;
-            }
-            mongoose_1.default.model("GoodTestModel", testSchema);
-            var spy = (0, bun_test_1.spyOn)(mongoose_1.default, "modelNames").mockReturnValue(["GoodTestModel"]);
-            try {
-                (0, bun_test_1.expect)(function () { return (0, utils_1.checkModelsStrict)(); }).not.toThrow();
-            }
-            finally {
-                spy.mockRestore();
-                delete mongoose_1.default.models.GoodTestModel;
-            }
-        });
-        (0, bun_test_1.it)("skips strict mode check for ignored models", function () {
-            // Create a properly configured model
-            var goodSchema = new mongoose_1.default.Schema({ name: String });
-            goodSchema.set("toObject", { virtuals: true });
-            goodSchema.set("toJSON", { virtuals: true });
-            goodSchema.set("strict", "throw");
-            if (mongoose_1.default.models.GoodModel) {
-                delete mongoose_1.default.models.GoodModel;
-            }
-            mongoose_1.default.model("GoodModel", goodSchema);
-            // Create a model without strict mode that we'll ignore
-            var badSchema = new mongoose_1.default.Schema({ name: String });
-            badSchema.set("toObject", { virtuals: true });
-            badSchema.set("toJSON", { virtuals: true });
-            // Not setting strict - should fail unless ignored
-            if (mongoose_1.default.models.IgnoredModel) {
-                delete mongoose_1.default.models.IgnoredModel;
-            }
-            mongoose_1.default.model("IgnoredModel", badSchema);
-            var spy = (0, bun_test_1.spyOn)(mongoose_1.default, "modelNames").mockReturnValue(["GoodModel", "IgnoredModel"]);
-            try {
-                // Without ignoring, should throw for IgnoredModel
-                (0, bun_test_1.expect)(function () { return (0, utils_1.checkModelsStrict)(); }).toThrow("is not set to strict mode");
-                // With ignoring IgnoredModel, should pass
-                (0, bun_test_1.expect)(function () { return (0, utils_1.checkModelsStrict)(["IgnoredModel"]); }).not.toThrow();
-            }
-            finally {
-                spy.mockRestore();
-                delete mongoose_1.default.models.GoodModel;
-                delete mongoose_1.default.models.IgnoredModel;
-            }
-        });
-        (0, bun_test_1.it)("handles multiple models and validates all", function () {
-            // Create three properly configured models
-            var schema1 = new mongoose_1.default.Schema({ name: String });
-            schema1.set("toObject", { virtuals: true });
-            schema1.set("toJSON", { virtuals: true });
-            schema1.set("strict", "throw");
-            var schema2 = new mongoose_1.default.Schema({ value: Number });
-            schema2.set("toObject", { virtuals: true });
-            schema2.set("toJSON", { virtuals: true });
-            schema2.set("strict", "throw");
-            var schema3 = new mongoose_1.default.Schema({ active: Boolean });
-            schema3.set("toObject", { virtuals: true });
-            schema3.set("toJSON", { virtuals: true });
-            schema3.set("strict", "throw");
-            if (mongoose_1.default.models.MultiModel1)
-                delete mongoose_1.default.models.MultiModel1;
-            if (mongoose_1.default.models.MultiModel2)
-                delete mongoose_1.default.models.MultiModel2;
-            if (mongoose_1.default.models.MultiModel3)
-                delete mongoose_1.default.models.MultiModel3;
-            mongoose_1.default.model("MultiModel1", schema1);
-            mongoose_1.default.model("MultiModel2", schema2);
-            mongoose_1.default.model("MultiModel3", schema3);
-            var spy = (0, bun_test_1.spyOn)(mongoose_1.default, "modelNames").mockReturnValue([
-                "MultiModel1",
-                "MultiModel2",
-                "MultiModel3",
-            ]);
-            try {
-                (0, bun_test_1.expect)(function () { return (0, utils_1.checkModelsStrict)(); }).not.toThrow();
-            }
-            finally {
-                spy.mockRestore();
-                delete mongoose_1.default.models.MultiModel1;
-                delete mongoose_1.default.models.MultiModel2;
-                delete mongoose_1.default.models.MultiModel3;
-            }
-        });
-        (0, bun_test_1.it)("handles empty model list", function () {
-            var spy = (0, bun_test_1.spyOn)(mongoose_1.default, "modelNames").mockReturnValue([]);
-            try {
-                (0, bun_test_1.expect)(function () { return (0, utils_1.checkModelsStrict)(); }).not.toThrow();
-            }
-            finally {
-                spy.mockRestore();
-            }
-        });
+    (0, bun_test_1.it)("checks valid ObjectIds", function () {
+        (0, bun_test_1.expect)((0, utils_1.isValidObjectId)("62c44da0003d9f8ee8cc925c")).toBe(true);
+        (0, bun_test_1.expect)((0, utils_1.isValidObjectId)("620000000000000000000000")).toBe(true);
+        // Mongoose's builtin "ObjectId.isValid" will falsely say this is an ObjectId.
+        (0, bun_test_1.expect)((0, utils_1.isValidObjectId)("1234567890ab")).toBe(false);
+        (0, bun_test_1.expect)((0, utils_1.isValidObjectId)("microsoft123")).toBe(false);
+        (0, bun_test_1.expect)((0, utils_1.isValidObjectId)("62c44da0003d9f8ee8cc925x")).toBe(false);
     });
 });

package/package.json

@@ -81,9 +81,8 @@
     "lint:fix": "biome check --write ./src",
     "lint:unsafefix": "biome check --fix --unsafe ./src",
     "test": "bun test --preload ./src/tests/bunSetup.ts",
-    "test:ci": "bun test --preload ./src/tests/bunSetup.ts",
     "updateSnapshot": "bun test --update-snapshots"
   },
   "types": "dist/index.d.ts",
-  "version": "0.0.11-beta.1"
+  "version": "0.0.11"
 }