@terreno/api 0.0.11-beta.1 → 0.0.11

package/src/api.test.ts

@@ -1,17 +1,29 @@
 import {beforeEach, describe, expect, it} from "bun:test";
 import * as Sentry from "@sentry/node";
 import type express from "express";
+import sortBy from "lodash/sortBy";
+import type mongoose from "mongoose";
 import qs from "qs";
 import supertest from "supertest";
 import type TestAgent from "supertest/lib/agent";
 
-import {addPopulateToQuery, modelRouter} from "./api";
+import {modelRouter} from "./api";
 import {addAuthRoutes, setupAuth} from "./auth";
 import {APIError} from "./errors";
 import {logRequests} from "./expressServer";
 import {Permissions} from "./permissions";
-import {authAsUser, type Food, FoodModel, getBaseServer, setupDb, UserModel} from "./tests";
-import {AdminOwnerTransformer} from "./transformers";
+import {
+  authAsUser,
+  type Food,
+  FoodModel,
+  getBaseServer,
+  type StaffUser,
+  StaffUserModel,
+  type SuperUser,
+  SuperUserModel,
+  setupDb,
+  UserModel,
+} from "./tests";
 
 describe("@terreno/api", () => {
   let server: TestAgent;
@@ -1462,1794 +1474,188 @@ describe("@terreno/api", () => {
     });
   });
 
-  describe("error handling", () => {
-    let admin: any;
-    let agent: TestAgent;
-    let spinach: Food;
-
-    beforeEach(async () => {
-      [admin] = await setupDb();
-
-      spinach = await FoodModel.create({
-        calories: 1,
-        created: new Date("2021-12-03T00:00:20.000Z"),
-        hidden: false,
-        name: "Spinach",
-        ownerId: admin._id,
-        source: {
-          name: "Brand",
-        },
-      });
-
-      app = getBaseServer();
-      setupAuth(app, UserModel as any);
-      addAuthRoutes(app, UserModel as any);
-    });
-
-    it("PUT returns 500 not supported", async () => {
-      app.use(
-        "/food",
-        modelRouter(FoodModel, {
-          allowAnonymous: true,
-          permissions: {
-            create: [Permissions.IsAny],
-            delete: [Permissions.IsAny],
-            list: [Permissions.IsAny],
-            read: [Permissions.IsAny],
-            update: [Permissions.IsAny],
-          },
-        })
-      );
-      server = supertest(app);
-
-      const res = await server.put(`/food/${spinach._id}`).send({name: "Kale"}).expect(500);
-      expect(res.body.title).toBe("PUT is not supported.");
-    });
-
-    it("preCreate returning undefined throws error", async () => {
-      app.use(
-        "/food",
-        modelRouter(FoodModel, {
-          allowAnonymous: true,
-          permissions: {
-            create: [Permissions.IsAny],
-            delete: [Permissions.IsAny],
-            list: [Permissions.IsAny],
-            read: [Permissions.IsAny],
-            update: [Permissions.IsAny],
-          },
-          preCreate: () => undefined as any,
-        })
-      );
-      server = supertest(app);
-
-      const res = await server.post("/food").send({calories: 15, name: "Broccoli"}).expect(403);
-      expect(res.body.title).toBe("Create not allowed");
-      expect(res.body.detail).toBe("A body must be returned from preCreate");
-    });
-
-    it("preUpdate returning undefined throws error", async () => {
-      app.use(
-        "/food",
-        modelRouter(FoodModel, {
-          allowAnonymous: true,
-          permissions: {
-            create: [Permissions.IsAny],
-            delete: [Permissions.IsAny],
-            list: [Permissions.IsAny],
-            read: [Permissions.IsAny],
-            update: [Permissions.IsAny],
-          },
-          preUpdate: () => undefined as any,
-        })
-      );
-      server = supertest(app);
-
-      const res = await server.patch(`/food/${spinach._id}`).send({name: "Kale"}).expect(403);
-      expect(res.body.title).toBe("Update not allowed");
-      expect(res.body.detail).toBe("A body must be returned from preUpdate");
-    });
-
-    it("preDelete returning undefined throws error", async () => {
-      app.use(
-        "/food",
-        modelRouter(FoodModel, {
-          allowAnonymous: true,
-          permissions: {
-            create: [Permissions.IsAny],
-            delete: [Permissions.IsAny],
-            list: [Permissions.IsAny],
-            read: [Permissions.IsAny],
-            update: [Permissions.IsAny],
-          },
-          preDelete: () => undefined as any,
-        })
-      );
-      server = supertest(app);
-      agent = await authAsUser(app, "notAdmin");
-
-      const res = await agent.delete(`/food/${spinach._id}`).expect(403);
-      expect(res.body.title).toBe("Delete not allowed");
-      expect(res.body.detail).toBe("A body must be returned from preDelete");
-    });
-
-    it("postCreate hook error is handled", async () => {
-      app.use(
-        "/food",
-        modelRouter(FoodModel, {
-          allowAnonymous: true,
-          permissions: {
-            create: [Permissions.IsAny],
-            delete: [Permissions.IsAny],
-            list: [Permissions.IsAny],
-            read: [Permissions.IsAny],
-            update: [Permissions.IsAny],
-          },
-          postCreate: () => {
-            throw new Error("postCreate failed");
-          },
-        })
-      );
-      server = supertest(app);
-
-      const res = await server.post("/food").send({calories: 15, name: "Broccoli"}).expect(400);
-      expect(res.body.title).toContain("postCreate hook error");
-    });
-
-    it("postUpdate hook error is handled", async () => {
-      app.use(
-        "/food",
-        modelRouter(FoodModel, {
-          allowAnonymous: true,
-          permissions: {
-            create: [Permissions.IsAny],
-            delete: [Permissions.IsAny],
-            list: [Permissions.IsAny],
-            read: [Permissions.IsAny],
-            update: [Permissions.IsAny],
-          },
-          postUpdate: () => {
-            throw new Error("postUpdate failed");
-          },
-        })
-      );
-      server = supertest(app);
-
-      const res = await server.patch(`/food/${spinach._id}`).send({name: "Kale"}).expect(400);
-      expect(res.body.title).toContain("postUpdate hook error");
-    });
-
-    it("postDelete hook error is handled", async () => {
-      app.use(
-        "/food",
-        modelRouter(FoodModel, {
-          allowAnonymous: true,
-          permissions: {
-            create: [Permissions.IsAny],
-            delete: [Permissions.IsAny],
-            list: [Permissions.IsAny],
-            read: [Permissions.IsAny],
-            update: [Permissions.IsAny],
-          },
-          postDelete: () => {
-            throw new Error("postDelete failed");
-          },
-        })
-      );
-      server = supertest(app);
-      agent = await authAsUser(app, "notAdmin");
-
-      const res = await agent.delete(`/food/${spinach._id}`).expect(400);
-      expect(res.body.title).toContain("postDelete hook error");
-    });
-
-    it("responseHandler error in read is handled", async () => {
-      app.use(
-        "/food",
-        modelRouter(FoodModel, {
-          allowAnonymous: true,
-          permissions: {
-            create: [Permissions.IsAny],
-            delete: [Permissions.IsAny],
-            list: [Permissions.IsAny],
-            read: [Permissions.IsAny],
-            update: [Permissions.IsAny],
-          },
-          responseHandler: (_data, method) => {
-            if (method === "read") {
-              throw new Error("responseHandler read failed");
-            }
-            return {} as any;
-          },
-        })
-      );
-      server = supertest(app);
-
-      const res = await server.get(`/food/${spinach._id}`).expect(500);
-      expect(res.body.title).toContain("responseHandler error");
-    });
-
-    it("responseHandler error in create is handled", async () => {
-      app.use(
-        "/food",
-        modelRouter(FoodModel, {
-          allowAnonymous: true,
-          permissions: {
-            create: [Permissions.IsAny],
-            delete: [Permissions.IsAny],
-            list: [Permissions.IsAny],
-            read: [Permissions.IsAny],
-            update: [Permissions.IsAny],
-          },
-          responseHandler: (_data, method) => {
-            if (method === "create") {
-              throw new Error("responseHandler create failed");
-            }
-            return {} as any;
-          },
-        })
-      );
-      server = supertest(app);
-
-      const res = await server.post("/food").send({calories: 15, name: "Broccoli"}).expect(500);
-      expect(res.body.title).toContain("responseHandler error");
-    });
-
-    it("responseHandler error in update is handled", async () => {
-      app.use(
-        "/food",
-        modelRouter(FoodModel, {
-          allowAnonymous: true,
-          permissions: {
-            create: [Permissions.IsAny],
-            delete: [Permissions.IsAny],
-            list: [Permissions.IsAny],
-            read: [Permissions.IsAny],
-            update: [Permissions.IsAny],
-          },
-          responseHandler: (_data, method) => {
-            if (method === "update") {
-              throw new Error("responseHandler update failed");
-            }
-            return {} as any;
-          },
-        })
-      );
-      server = supertest(app);
-
-      const res = await server.patch(`/food/${spinach._id}`).send({name: "Kale"}).expect(500);
-      expect(res.body.title).toContain("responseHandler error");
-    });
-
-    it("responseHandler error in list is handled", async () => {
-      app.use(
-        "/food",
-        modelRouter(FoodModel, {
-          allowAnonymous: true,
-          permissions: {
-            create: [Permissions.IsAny],
-            delete: [Permissions.IsAny],
-            list: [Permissions.IsAny],
-            read: [Permissions.IsAny],
-            update: [Permissions.IsAny],
-          },
-          responseHandler: (_data, method) => {
-            if (method === "list") {
-              throw new Error("responseHandler list failed");
-            }
-            return {} as any;
-          },
-        })
-      );
-      server = supertest(app);
-
-      const res = await server.get("/food").expect(500);
-      expect(res.body.title).toContain("responseHandler error");
-    });
-
-    it("list with non-array responseHandler returns data directly", async () => {
-      app.use(
-        "/food",
-        modelRouter(FoodModel, {
-          allowAnonymous: true,
-          permissions: {
-            create: [Permissions.IsAny],
-            delete: [Permissions.IsAny],
-            list: [Permissions.IsAny],
-            read: [Permissions.IsAny],
-            update: [Permissions.IsAny],
-          },
-          responseHandler: (_data, method) => {
-            if (method === "list") {
-              return {custom: "response"} as any;
-            }
-            return {} as any;
-          },
-        })
-      );
-      server = supertest(app);
-
-      const res = await server.get("/food").expect(200);
-      expect(res.body.data).toEqual({custom: "response"});
-      expect(res.body.more).toBeUndefined();
-      expect(res.body.total).toBeUndefined();
-    });
-
-    it("list with query sort param", async () => {
-      await FoodModel.create({
-        calories: 200,
-        created: new Date("2021-12-04T00:00:20.000Z"),
-        hidden: false,
-        name: "Apple",
-        ownerId: admin._id,
-      });
-
-      app.use(
-        "/food",
-        modelRouter(FoodModel, {
-          allowAnonymous: true,
-          permissions: {
-            create: [Permissions.IsAny],
-            delete: [Permissions.IsAny],
-            list: [Permissions.IsAny],
-            read: [Permissions.IsAny],
-            update: [Permissions.IsAny],
-          },
-          queryFields: ["name"],
-        })
-      );
-      server = supertest(app);
-
-      // Sort by name ascending
-      let res = await server.get("/food?sort=name").expect(200);
-      expect(res.body.data[0].name).toBe("Apple");
-      expect(res.body.data[1].name).toBe("Spinach");
-
-      // Sort by name descending
-      res = await server.get("/food?sort=-name").expect(200);
-      expect(res.body.data[0].name).toBe("Spinach");
-      expect(res.body.data[1].name).toBe("Apple");
-    });
-
-    it("queryFilter error is handled", async () => {
-      app.use(
-        "/food",
-        modelRouter(FoodModel, {
-          allowAnonymous: true,
-          permissions: {
-            create: [Permissions.IsAny],
-            delete: [Permissions.IsAny],
-            list: [Permissions.IsAny],
-            read: [Permissions.IsAny],
-            update: [Permissions.IsAny],
-          },
-          queryFilter: () => {
-            throw new Error("queryFilter failed");
-          },
-        })
-      );
-      server = supertest(app);
-
-      const res = await server.get("/food").expect(400);
-      expect(res.body.title).toContain("Query filter error");
-    });
-
-    it("custom endpoints take priority", async () => {
-      app.use(
-        "/food",
-        modelRouter(FoodModel, {
-          allowAnonymous: true,
-          endpoints: (router: any) => {
-            router.get("/custom", (_req: any, res: any) => {
-              res.json({custom: true});
-            });
-          },
-          permissions: {
-            create: [Permissions.IsAny],
-            delete: [Permissions.IsAny],
-            list: [Permissions.IsAny],
-            read: [Permissions.IsAny],
-            update: [Permissions.IsAny],
-          },
-        })
-      );
-      server = supertest(app);
-
-      const res = await server.get("/food/custom").expect(200);
-      expect(res.body.custom).toBe(true);
-    });
-
-    it("disallowed query param returns 400", async () => {
-      app.use(
-        "/food",
-        modelRouter(FoodModel, {
-          allowAnonymous: true,
-          permissions: {
-            create: [Permissions.IsAny],
-            delete: [Permissions.IsAny],
-            list: [Permissions.IsAny],
-            read: [Permissions.IsAny],
-            update: [Permissions.IsAny],
-          },
-          queryFields: ["name"],
-        })
-      );
-      server = supertest(app);
-
-      const res = await server.get("/food?calories=100").expect(400);
-      expect(res.body.title).toContain("calories is not allowed as a query param");
-    });
-
-    it("queryFilter returning null returns empty array", async () => {
-      app.use(
-        "/food",
-        modelRouter(FoodModel, {
-          allowAnonymous: true,
-          permissions: {
-            create: [Permissions.IsAny],
-            delete: [Permissions.IsAny],
-            list: [Permissions.IsAny],
-            read: [Permissions.IsAny],
-            update: [Permissions.IsAny],
-          },
-          queryFilter: () => null,
-        })
-      );
-      server = supertest(app);
-
-      const res = await server.get("/food").expect(200);
-      expect(res.body.data).toEqual([]);
-    });
-
-    it("preUpdate returning null throws error", async () => {
-      app.use(
-        "/food",
-        modelRouter(FoodModel, {
-          allowAnonymous: true,
-          permissions: {
-            create: [Permissions.IsAny],
-            delete: [Permissions.IsAny],
-            list: [Permissions.IsAny],
-            read: [Permissions.IsAny],
-            update: [Permissions.IsAny],
-          },
-          preUpdate: () => null,
-        })
-      );
-      server = supertest(app);
-
-      const res = await server.patch(`/food/${spinach._id}`).send({name: "Kale"}).expect(403);
-      expect(res.body.title).toBe("Update not allowed");
-    });
-
-    it("preDelete returning null throws error", async () => {
-      app.use(
-        "/food",
-        modelRouter(FoodModel, {
-          allowAnonymous: true,
-          permissions: {
-            create: [Permissions.IsAny],
-            delete: [Permissions.IsAny],
-            list: [Permissions.IsAny],
-            read: [Permissions.IsAny],
-            update: [Permissions.IsAny],
-          },
-          preDelete: () => null,
-        })
-      );
-      server = supertest(app);
-      agent = await authAsUser(app, "notAdmin");
-
-      const res = await agent.delete(`/food/${spinach._id}`).expect(403);
-      expect(res.body.title).toBe("Delete not allowed");
-    });
-
-    it("preCreate returning null throws error", async () => {
-      app.use(
-        "/food",
-        modelRouter(FoodModel, {
-          allowAnonymous: true,
-          permissions: {
-            create: [Permissions.IsAny],
-            delete: [Permissions.IsAny],
-            list: [Permissions.IsAny],
-            read: [Permissions.IsAny],
-            update: [Permissions.IsAny],
-          },
-          preCreate: () => null,
-        })
-      );
-      server = supertest(app);
-
-      const res = await server.post("/food").send({calories: 15, name: "Broccoli"}).expect(403);
-      expect(res.body.title).toBe("Create not allowed");
-    });
-
-    it("preCreate error is handled", async () => {
-      app.use(
-        "/food",
-        modelRouter(FoodModel, {
-          allowAnonymous: true,
-          permissions: {
-            create: [Permissions.IsAny],
-            delete: [Permissions.IsAny],
-            list: [Permissions.IsAny],
-            read: [Permissions.IsAny],
-            update: [Permissions.IsAny],
-          },
-          preCreate: () => {
-            throw new Error("preCreate failed");
-          },
-        })
-      );
-      server = supertest(app);
-
-      const res = await server.post("/food").send({calories: 15, name: "Broccoli"}).expect(400);
-      expect(res.body.title).toContain("preCreate hook error");
-    });
-
-    it("preUpdate error is handled", async () => {
-      app.use(
-        "/food",
-        modelRouter(FoodModel, {
-          allowAnonymous: true,
-          permissions: {
-            create: [Permissions.IsAny],
-            delete: [Permissions.IsAny],
-            list: [Permissions.IsAny],
-            read: [Permissions.IsAny],
-            update: [Permissions.IsAny],
-          },
-          preUpdate: () => {
-            throw new Error("preUpdate failed");
-          },
-        })
-      );
-      server = supertest(app);
-
-      const res = await server.patch(`/food/${spinach._id}`).send({name: "Kale"}).expect(400);
-      expect(res.body.title).toContain("preUpdate hook error");
-    });
-
-    it("invalid array operation type returns 400", async () => {
-      // This tests the else branch for invalid array operations
-      // We need to manually call the endpoint with an invalid HTTP method
-      // The array operations use POST (add), PATCH (update), DELETE (remove)
-      // We can't easily test this without modifying the router, so skip for now
-    });
-  });
-
-  describe("array operation errors", () => {
-    let admin: any;
-    let apple: Food;
-    let agent: TestAgent;
-
-    beforeEach(async () => {
-      [admin] = await setupDb();
-
-      apple = await FoodModel.create({
-        calories: 100,
-        categories: [
-          {name: "Fruit", show: true},
-          {name: "Popular", show: false},
-        ],
-        created: new Date("2021-12-03T00:00:30.000Z"),
-        hidden: false,
-        name: "Apple",
-        ownerId: admin._id,
-        tags: ["healthy", "cheap"],
-      });
-
-      app = getBaseServer();
-      setupAuth(app, UserModel as any);
-      addAuthRoutes(app, UserModel as any);
-    });
-
-    it("array operation preUpdate returning undefined throws error", async () => {
-      app.use(
-        "/food",
-        modelRouter(FoodModel, {
-          allowAnonymous: true,
-          permissions: {
-            create: [Permissions.IsAdmin],
-            delete: [Permissions.IsAdmin],
-            list: [Permissions.IsAdmin],
-            read: [Permissions.IsAdmin],
-            update: [Permissions.IsAdmin],
-          },
-          preUpdate: () => undefined as any,
-        })
-      );
-      server = supertest(app);
-      agent = await authAsUser(app, "admin");
-
-      const res = await agent.post(`/food/${apple._id}/tags`).send({tags: "organic"}).expect(403);
-      expect(res.body.title).toBe("Update not allowed");
-      expect(res.body.detail).toBe("A body must be returned from preUpdate");
-    });
-
-    it("array operation preUpdate returning null throws error", async () => {
-      app.use(
-        "/food",
-        modelRouter(FoodModel, {
-          allowAnonymous: true,
-          permissions: {
-            create: [Permissions.IsAdmin],
-            delete: [Permissions.IsAdmin],
-            list: [Permissions.IsAdmin],
-            read: [Permissions.IsAdmin],
-            update: [Permissions.IsAdmin],
-          },
-          preUpdate: () => null,
-        })
-      );
-      server = supertest(app);
-      agent = await authAsUser(app, "admin");
-
-      const res = await agent.post(`/food/${apple._id}/tags`).send({tags: "organic"}).expect(403);
-      expect(res.body.title).toBe("Update not allowed");
-    });
-
-    it("array operation preUpdate error is handled", async () => {
-      app.use(
-        "/food",
-        modelRouter(FoodModel, {
-          allowAnonymous: true,
-          permissions: {
-            create: [Permissions.IsAdmin],
-            delete: [Permissions.IsAdmin],
-            list: [Permissions.IsAdmin],
-            read: [Permissions.IsAdmin],
-            update: [Permissions.IsAdmin],
-          },
-          preUpdate: () => {
-            throw new Error("preUpdate array failed");
-          },
-        })
-      );
-      server = supertest(app);
-      agent = await authAsUser(app, "admin");
-
-      const res = await agent.post(`/food/${apple._id}/tags`).send({tags: "organic"}).expect(400);
-      expect(res.body.title).toContain("preUpdate hook error");
-    });
-
-    it("array operation postUpdate error is handled", async () => {
-      app.use(
-        "/food",
-        modelRouter(FoodModel, {
-          allowAnonymous: true,
-          permissions: {
-            create: [Permissions.IsAdmin],
-            delete: [Permissions.IsAdmin],
-            list: [Permissions.IsAdmin],
-            read: [Permissions.IsAdmin],
-            update: [Permissions.IsAdmin],
-          },
-          postUpdate: () => {
-            throw new Error("postUpdate array failed");
-          },
-        })
-      );
-      server = supertest(app);
-      agent = await authAsUser(app, "admin");
-
-      const res = await agent.post(`/food/${apple._id}/tags`).send({tags: "organic"}).expect(400);
-      expect(res.body.title).toContain("PATCH Post Update error");
-    });
-
-    it("array operation denied without update permission", async () => {
-      app.use(
-        "/food",
-        modelRouter(FoodModel, {
-          allowAnonymous: true,
-          permissions: {
-            create: [Permissions.IsAdmin],
-            delete: [Permissions.IsAdmin],
-            list: [Permissions.IsAny],
-            read: [Permissions.IsAny],
-            update: [Permissions.IsAdmin],
-          },
-        })
-      );
-      server = supertest(app);
-      agent = await authAsUser(app, "notAdmin");
-
-      const res = await agent.post(`/food/${apple._id}/tags`).send({tags: "organic"}).expect(405);
-      expect(res.body.title).toContain("Access to PATCH");
-    });
-
-    it("array operation on non-existent document returns 404", async () => {
-      app.use(
-        "/food",
-        modelRouter(FoodModel, {
-          allowAnonymous: true,
-          permissions: {
-            create: [Permissions.IsAdmin],
-            delete: [Permissions.IsAdmin],
-            list: [Permissions.IsAdmin],
-            read: [Permissions.IsAdmin],
-            update: [Permissions.IsAdmin],
-          },
-        })
-      );
-      server = supertest(app);
-      agent = await authAsUser(app, "admin");
-
-      const fakeId = "000000000000000000000000";
-      const res = await agent.post(`/food/${fakeId}/tags`).send({tags: "organic"}).expect(404);
-      expect(res.body.title).toContain("Could not find document to PATCH");
-    });
-
-    it("array operation denied when user cannot update specific doc", async () => {
-      // Create food owned by admin, then try to update as notAdmin
-      app.use(
-        "/food",
-        modelRouter(FoodModel, {
-          allowAnonymous: true,
-          permissions: {
-            create: [Permissions.IsAuthenticated],
-            delete: [Permissions.IsAuthenticated],
-            list: [Permissions.IsAuthenticated],
-            read: [Permissions.IsAuthenticated],
-            update: [Permissions.IsOwner],
-          },
-        })
-      );
-      server = supertest(app);
-      // Login as notAdmin and try to update admin's food (apple)
-      agent = await authAsUser(app, "notAdmin");
-
-      const res = await agent.post(`/food/${apple._id}/tags`).send({tags: "organic"}).expect(403);
-      expect(res.body.title).toContain("Patch not allowed");
-    });
-
-    it("array operation transform error is handled", async () => {
-      app.use(
-        "/food",
-        modelRouter(FoodModel, {
-          allowAnonymous: true,
-          permissions: {
-            create: [Permissions.IsAdmin],
-            delete: [Permissions.IsAdmin],
-            list: [Permissions.IsAdmin],
-            read: [Permissions.IsAdmin],
-            update: [Permissions.IsAdmin],
-          },
-          transformer: AdminOwnerTransformer({
-            adminWriteFields: ["name"],
-          }),
-        })
-      );
-      server = supertest(app);
-      agent = await authAsUser(app, "admin");
-
-      // Try to update tags field, which is not in the allowed write fields
-      const res = await agent.post(`/food/${apple._id}/tags`).send({tags: "organic"}).expect(403);
-      expect(res.body.title).toContain("cannot write fields");
-    });
-  });
-
-  describe("transformer errors", () => {
-    let admin: any;
-    let spinach: Food;
-    let agent: TestAgent;
-
-    beforeEach(async () => {
-      [admin] = await setupDb();
-
-      spinach = await FoodModel.create({
-        calories: 1,
-        created: new Date("2021-12-03T00:00:20.000Z"),
-        hidden: false,
-        name: "Spinach",
-        ownerId: admin._id,
-        source: {
-          name: "Brand",
-        },
-      });
-
-      app = getBaseServer();
-      setupAuth(app, UserModel as any);
-      addAuthRoutes(app, UserModel as any);
-    });
-
-    it("transform error in create is handled", async () => {
-      app.use(
-        "/food",
-        modelRouter(FoodModel, {
-          allowAnonymous: true,
-          permissions: {
-            create: [Permissions.IsAny],
-            delete: [Permissions.IsAny],
-            list: [Permissions.IsAny],
-            read: [Permissions.IsAny],
-            update: [Permissions.IsAny],
-          },
-          transformer: AdminOwnerTransformer({
-            // Only allow 'name' to be written, so 'calories' will throw
-            anonWriteFields: ["name"],
-          }),
-        })
-      );
-      server = supertest(app);
-
-      const res = await server.post("/food").send({calories: 15, name: "Broccoli"}).expect(400);
-      expect(res.body.title).toContain("cannot write fields");
-    });
-
-    it("transform error in patch is handled", async () => {
-      app.use(
-        "/food",
-        modelRouter(FoodModel, {
-          allowAnonymous: true,
-          permissions: {
-            create: [Permissions.IsAny],
-            delete: [Permissions.IsAny],
-            list: [Permissions.IsAny],
-            read: [Permissions.IsAny],
-            update: [Permissions.IsAny],
-          },
-          transformer: AdminOwnerTransformer({
-            // Only allow 'name' to be written, so 'calories' will throw
-            anonWriteFields: ["name"],
-          }),
-        })
-      );
-      server = supertest(app);
-
-      const res = await server.patch(`/food/${spinach._id}`).send({calories: 100}).expect(403);
-      expect(res.body.title).toContain("cannot write fields");
-    });
-
-    it("model.create validation error is handled", async () => {
-      // Use a model that has required fields
-      const {RequiredModel} = await import("./tests");
-
-      app.use(
-        "/required",
-        modelRouter(RequiredModel, {
-          allowAnonymous: true,
-          permissions: {
-            create: [Permissions.IsAny],
-            delete: [Permissions.IsAny],
-            list: [Permissions.IsAny],
-            read: [Permissions.IsAny],
-            update: [Permissions.IsAny],
-          },
-        })
-      );
-      server = supertest(app);
-
-      // Send without required 'name' field
-      const res = await server.post("/required").send({about: "test"}).expect(400);
-      expect(res.body.title).toContain("Required");
-    });
-
-    it("preDelete hook throwing APIError is re-thrown", async () => {
-      app.use(
-        "/food",
-        modelRouter(FoodModel, {
-          allowAnonymous: true,
-          permissions: {
-            create: [Permissions.IsAny],
-            delete: [Permissions.IsAny],
-            list: [Permissions.IsAny],
-            read: [Permissions.IsAny],
-            update: [Permissions.IsAny],
-          },
-          preDelete: () => {
-            throw new APIError({
-              disableExternalErrorTracking: true,
-              status: 400,
-              title: "Custom preDelete APIError",
-            });
-          },
-        })
-      );
-      server = supertest(app);
-      agent = await authAsUser(app, "notAdmin");
-
-      const res = await agent.delete(`/food/${spinach._id}`).expect(400);
-      expect(res.body.title).toBe("Custom preDelete APIError");
-      expect(res.body.disableExternalErrorTracking).toBe(true);
-    });
-  });
-
-  describe("special query params", () => {
-    let admin: any;
-
-    beforeEach(async () => {
-      [admin] = await setupDb();
-
-      await FoodModel.create({
-        calories: 1,
-        created: new Date("2021-12-03T00:00:20.000Z"),
-        hidden: false,
-        name: "Spinach",
-        ownerId: admin._id,
-      });
-
-      app = getBaseServer();
-      setupAuth(app, UserModel as any);
-      addAuthRoutes(app, UserModel as any);
-    });
-
-    it("period query param is stripped from query", async () => {
-      app.use(
-        "/food",
-        modelRouter(FoodModel, {
-          allowAnonymous: true,
-          permissions: {
-            create: [Permissions.IsAny],
-            delete: [Permissions.IsAny],
-            list: [Permissions.IsAny],
-            read: [Permissions.IsAny],
-            update: [Permissions.IsAny],
-          },
-          queryFields: ["name", "period"],
-          queryFilter: (_user, query) => {
-            // Simulate a queryFilter that accepts and processes period
-            if (query?.period) {
-              // Period is processed but shouldn't be passed to mongo
-              return query;
-            }
-            return query ?? {};
-          },
-        })
-      );
-      server = supertest(app);
-
-      // period should be accepted and processed without error
-      const res = await server.get("/food?period=weekly").expect(200);
-      expect(res.body.data).toBeDefined();
-    });
-
-    it("query with false value", async () => {
-      // Create a food that is hidden
-      await FoodModel.create({
-        calories: 50,
-        created: new Date("2021-12-04T00:00:20.000Z"),
-        hidden: true,
-        name: "HiddenFood",
-        ownerId: admin._id,
-      });
-
-      app.use(
-        "/food",
-        modelRouter(FoodModel, {
-          allowAnonymous: true,
-          permissions: {
-            create: [Permissions.IsAny],
-            delete: [Permissions.IsAny],
-            list: [Permissions.IsAny],
-            read: [Permissions.IsAny],
-            update: [Permissions.IsAny],
-          },
-          queryFields: ["name", "hidden"],
-        })
-      );
-      server = supertest(app);
-
-      // Query for non-hidden foods using ?hidden=false
-      const res = await server.get("/food?hidden=false").expect(200);
-      expect(res.body.data.every((f: any) => f.hidden === false)).toBe(true);
-    });
-
-    it("$search query triggers special handling code path", async () => {
-      // The $search code path just accesses the collection but doesn't do anything with it
-      // This test verifies the code path is exercised
-      app.use(
-        "/food",
-        modelRouter(FoodModel, {
-          allowAnonymous: true,
-          permissions: {
-            create: [Permissions.IsAny],
-            delete: [Permissions.IsAny],
-            list: [Permissions.IsAny],
-            read: [Permissions.IsAny],
-            update: [Permissions.IsAny],
-          },
-          // Need to include $search in queryFields for it to pass validation
-          queryFields: ["name", "$search"],
-        })
-      );
-      server = supertest(app);
-
-      // The $search will be added to the query params, triggering the special handling
-      // Even though the code doesn't actually do anything useful with it (stub for Atlas)
-      const res = await server.get("/food?$search=test");
-      // May return 500 because $search is passed to Mongo which doesn't support it without Atlas
-      // The important thing is we've exercised the code path
-      expect(res.status === 200 || res.status === 500).toBe(true);
-    });
-
-    it("$autocomplete query triggers special handling code path", async () => {
-      app.use(
-        "/food",
-        modelRouter(FoodModel, {
-          allowAnonymous: true,
-          permissions: {
-            create: [Permissions.IsAny],
-            delete: [Permissions.IsAny],
-            list: [Permissions.IsAny],
-            read: [Permissions.IsAny],
-            update: [Permissions.IsAny],
-          },
-          queryFields: ["name", "$autocomplete"],
-        })
-      );
-      server = supertest(app);
-
-      const res = await server.get("/food?$autocomplete=test");
-      expect(res.status === 200 || res.status === 500).toBe(true);
-    });
-  });
-
-  describe("addPopulateToQuery", () => {
-    it("returns query unchanged with no populate paths", async () => {
-      await setupDb();
-      const query = FoodModel.find({});
-      const result = addPopulateToQuery(query, undefined);
-      expect(result).toBe(query);
-    });
-
-    it("returns query unchanged with empty populate paths", async () => {
-      await setupDb();
-      const query = FoodModel.find({});
-      const result = addPopulateToQuery(query, []);
-      expect(result).toBe(query);
-    });
-
-    it("applies multiple populate paths", async () => {
-      await setupDb();
-      const query = FoodModel.find({});
-      const result = addPopulateToQuery(query, [
-        {fields: ["email"], path: "ownerId"},
-        {fields: ["name"], path: "eatenBy"},
-      ]);
-      // The result should be a query with populate applied
-      expect(result).toBeDefined();
-    });
-  });
-
-  describe("soft delete with isDeleted plugin", () => {
-    let admin: any;
-    let agent: TestAgent;
-
-    beforeEach(async () => {
-      [admin] = await setupDb();
-
-      app = getBaseServer();
-      setupAuth(app, UserModel as any);
-      addAuthRoutes(app, UserModel as any);
-    });
-
-    it("soft deletes user with deleted field", async () => {
-      // UserModel has the isDisabledPlugin which adds a 'disabled' field,
-      // but we need to test the 'deleted' field check.
-      // Let's use a model that has the deleted field.
-      app.use(
-        "/users",
-        modelRouter(UserModel, {
-          allowAnonymous: true,
-          permissions: {
-            create: [Permissions.IsAny],
-            delete: [Permissions.IsAny],
-            list: [Permissions.IsAny],
-            read: [Permissions.IsAny],
-            update: [Permissions.IsAny],
-          },
-        })
-      );
-      server = supertest(app);
-      agent = await authAsUser(app, "notAdmin");
-
-      // Delete a user - this should use deleteOne since User doesn't have deleted field
-      const res = await agent.delete(`/users/${admin._id}`).expect(204);
-      expect(res.body).toEqual({});
-
-      // Verify user was deleted
-      const deletedUser = await UserModel.findById(admin._id);
-      expect(deletedUser).toBeNull();
-    });
-  });
-
-  describe("populate in create", () => {
-    let admin: any;
-
-    beforeEach(async () => {
-      [admin] = await setupDb();
-
-      await FoodModel.create({
-        calories: 1,
-        created: new Date("2021-12-03T00:00:20.000Z"),
-        hidden: false,
-        name: "Spinach",
-        ownerId: admin._id,
-      });
-
-      app = getBaseServer();
-      setupAuth(app, UserModel as any);
-      addAuthRoutes(app, UserModel as any);
-    });
-
-    it("handles populate with valid path in create", async () => {
-      // Test that valid populate works in create flow
-      app.use(
-        "/food",
-        modelRouter(FoodModel, {
-          allowAnonymous: true,
-          permissions: {
-            create: [Permissions.IsAny],
-            delete: [Permissions.IsAny],
-            list: [Permissions.IsAny],
-            read: [Permissions.IsAny],
-            update: [Permissions.IsAny],
-          },
-          populatePaths: [{fields: ["email"], path: "ownerId"}],
-        })
-      );
-      server = supertest(app);
-
-      const res = await server
-        .post("/food")
-        .send({calories: 15, name: "Broccoli", ownerId: admin._id})
-        .expect(201);
-      expect(res.body.data.name).toBe("Broccoli");
-      // Verify populate worked - ownerId should be an object with email
-      expect(res.body.data.ownerId.email).toBe(admin.email);
-    });
-  });
-
-  describe("save error handling", () => {
-    let admin: any;
-    let spinach: Food;
-
-    beforeEach(async () => {
-      [admin] = await setupDb();
-
-      spinach = await FoodModel.create({
-        calories: 1,
-        created: new Date("2021-12-03T00:00:20.000Z"),
-        hidden: false,
-        name: "Spinach",
-        ownerId: admin._id,
-        source: {
-          name: "Brand",
-        },
-      });
-
-      app = getBaseServer();
-      setupAuth(app, UserModel as any);
-      addAuthRoutes(app, UserModel as any);
-    });
-
-    it("handles patch save error with validation failure", async () => {
-      // The FoodModel has strict: "throw" which will cause validation errors for unknown fields
-      app.use(
-        "/food",
-        modelRouter(FoodModel, {
-          allowAnonymous: true,
-          permissions: {
-            create: [Permissions.IsAny],
-            delete: [Permissions.IsAny],
-            list: [Permissions.IsAny],
-            read: [Permissions.IsAny],
-            update: [Permissions.IsAny],
-          },
-        })
-      );
-      server = supertest(app);
-
-      // Try to patch with an invalid field (will be caught by strict: "throw")
-      const res = await server
-        .patch(`/food/${spinach._id}`)
-        .send({invalidField: "value"})
-        .expect(400);
-      expect(res.body.title).toContain("preUpdate hook save error");
-    });
-  });
-
-  describe("body undefined after transform without preCreate", () => {
-    beforeEach(async () => {
-      await setupDb();
-
-      app = getBaseServer();
-      setupAuth(app, UserModel as any);
-      addAuthRoutes(app, UserModel as any);
-    });
-
-    it("handles undefined body after transform when no preCreate", async () => {
-      // Create a transformer that returns undefined
-      app.use(
-        "/food",
-        modelRouter(FoodModel, {
-          allowAnonymous: true,
-          permissions: {
-            create: [Permissions.IsAny],
-            delete: [Permissions.IsAny],
-            list: [Permissions.IsAny],
-            read: [Permissions.IsAny],
-            update: [Permissions.IsAny],
-          },
-          transformer: {
-            transform: () => undefined,
-          },
-        })
-      );
-      server = supertest(app);
-
-      const res = await server.post("/food").send({calories: 15, name: "Broccoli"}).expect(400);
-      expect(res.body.title).toBe("Invalid request body");
-      expect(res.body.detail).toBe("Body is undefined");
-    });
-  });
-
-  describe("soft delete with deleted field", () => {
-    let _admin: any;
-    let agent: TestAgent;
-
-    beforeEach(async () => {
-      [_admin] = await setupDb();
-
-      app = getBaseServer();
-      setupAuth(app, UserModel as any);
-      addAuthRoutes(app, UserModel as any);
-    });
-
-    it("soft deletes document with deleted field using isDeletedPlugin", async () => {
-      // Create a test schema with the isDeletedPlugin
-      const mongoose = await import("mongoose");
-
-      // Create a temporary model with the deleted field
-      const softDeleteSchema = new mongoose.Schema({
-        deleted: {default: false, type: Boolean},
-        name: String,
-      });
-      // Manually add the deleted field (simulating what isDeletedPlugin does)
-      // The schema already has the deleted field, so it should use soft delete
-
-      // Check if the model already exists to avoid OverwriteModelError
-      let SoftDeleteModel;
-      try {
-        SoftDeleteModel = mongoose.model("SoftDeleteTest");
-      } catch {
-        SoftDeleteModel = mongoose.model("SoftDeleteTest", softDeleteSchema);
-      }
-
-      // Clean up any existing documents
-      await SoftDeleteModel.deleteMany({});
-
-      // Create a test document
-      const testDoc = await SoftDeleteModel.create({name: "TestItem"});
-
-      app.use(
-        "/softdelete",
-        modelRouter(SoftDeleteModel, {
-          allowAnonymous: true,
-          permissions: {
-            create: [Permissions.IsAny],
-            delete: [Permissions.IsAny],
-            list: [Permissions.IsAny],
-            read: [Permissions.IsAny],
-            update: [Permissions.IsAny],
-          },
-        })
-      );
-      server = supertest(app);
-      agent = await authAsUser(app, "notAdmin");
-
-      // Delete should soft delete (set deleted: true) instead of hard delete
-      await agent.delete(`/softdelete/${testDoc._id}`).expect(204);
-
-      // Verify document was soft deleted (not hard deleted)
-      const softDeleted = await SoftDeleteModel.findById(testDoc._id);
-      expect(softDeleted).not.toBeNull();
-      expect(softDeleted?.deleted).toBe(true);
-
-      // Clean up
-      await SoftDeleteModel.deleteMany({});
-    });
-  });
-
-  describe("array operation with undefined preUpdate return", () => {
-    let admin: any;
-    let apple: Food;
+  describe("discriminator", () => {
+    let superUser: mongoose.Document<SuperUser>;
+    let staffUser: mongoose.Document<StaffUser>;
+    let notAdmin: mongoose.Document;
     let agent: TestAgent;
 
     beforeEach(async () => {
-      [admin] = await setupDb();
-
-      apple = await FoodModel.create({
-        calories: 100,
-        categories: [
-          {name: "Fruit", show: true},
-          {name: "Popular", show: false},
-        ],
-        created: new Date("2021-12-03T00:00:30.000Z"),
-        hidden: false,
-        name: "Apple",
-        ownerId: admin._id,
-        tags: ["healthy", "cheap"],
-      });
+      [notAdmin] = await setupDb();
+      const [staffUserId, superUserId] = await Promise.all([
+        StaffUserModel.create({
+          department: "Accounting",
+          email: "staff@example.com",
+        }),
+        SuperUserModel.create({
+          email: "superuser@example.com",
+          superTitle: "Super Man",
+        }),
+      ]);
+      staffUser = (await UserModel.findById(staffUserId)) as any;
+      superUser = (await UserModel.findById(superUserId)) as any;
 
       app = getBaseServer();
       setupAuth(app, UserModel as any);
       addAuthRoutes(app, UserModel as any);
-    });
-
-    it("array operation preUpdate returning undefined for array POST throws error", async () => {
-      app.use(
-        "/food",
-        modelRouter(FoodModel, {
-          allowAnonymous: true,
-          permissions: {
-            create: [Permissions.IsAdmin],
-            delete: [Permissions.IsAdmin],
-            list: [Permissions.IsAdmin],
-            read: [Permissions.IsAdmin],
-            update: [Permissions.IsAdmin],
-          },
-          preUpdate: () => undefined as any,
-        })
-      );
-      server = supertest(app);
-      agent = await authAsUser(app, "admin");
-
-      const res = await agent.post(`/food/${apple._id}/tags`).send({tags: "organic"}).expect(403);
-      expect(res.body.title).toBe("Update not allowed");
-      expect(res.body.detail).toBe("A body must be returned from preUpdate");
-    });
-
-    it("array operation preUpdate returning null for array PATCH throws error", async () => {
       app.use(
-        "/food",
-        modelRouter(FoodModel, {
+        "/users",
+        modelRouter(UserModel, {
           allowAnonymous: true,
+          discriminatorKey: "__t",
           permissions: {
-            create: [Permissions.IsAdmin],
-            delete: [Permissions.IsAdmin],
-            list: [Permissions.IsAdmin],
-            read: [Permissions.IsAdmin],
-            update: [Permissions.IsAdmin],
+            create: [Permissions.IsAuthenticated],
+            delete: [Permissions.IsAuthenticated],
+            list: [Permissions.IsAuthenticated],
+            read: [Permissions.IsAuthenticated],
+            update: [Permissions.IsAuthenticated],
           },
-          preUpdate: () => null,
         })
       );
-      server = supertest(app);
-      agent = await authAsUser(app, "admin");
 
-      const res = await agent
-        .patch(`/food/${apple._id}/tags/healthy`)
-        .send({tags: "unhealthy"})
-        .expect(403);
-      expect(res.body.title).toBe("Update not allowed");
-    });
-
-    it("array operation preUpdate error for array DELETE is handled", async () => {
-      app.use(
-        "/food",
-        modelRouter(FoodModel, {
-          allowAnonymous: true,
-          permissions: {
-            create: [Permissions.IsAdmin],
-            delete: [Permissions.IsAdmin],
-            list: [Permissions.IsAdmin],
-            read: [Permissions.IsAdmin],
-            update: [Permissions.IsAdmin],
-          },
-          preUpdate: () => {
-            throw new Error("preUpdate error during delete");
-          },
-        })
-      );
       server = supertest(app);
-      agent = await authAsUser(app, "admin");
-
-      const res = await agent.delete(`/food/${apple._id}/tags/healthy`).expect(400);
-      expect(res.body.title).toContain("preUpdate hook error");
-    });
-  });
-});
-
-describe("errors module", () => {
-  describe("APIError", () => {
-    it("sets default status to 500 when not provided", () => {
-      const error = new APIError({title: "Test error"});
-      expect(error.status).toBe(500);
-    });
-
-    it("sets status to 500 for invalid status codes below 400", () => {
-      const error = new APIError({status: 200, title: "Test error"});
-      expect(error.status).toBe(500);
-    });
-
-    it("sets status to 500 for invalid status codes above 599", () => {
-      const error = new APIError({status: 600, title: "Test error"});
-      expect(error.status).toBe(500);
-    });
-
-    it("includes error stack in message when error is provided", () => {
-      const originalError = new Error("Original error");
-      const apiError = new APIError({
-        error: originalError,
-        title: "Wrapped error",
-      });
-      expect(apiError.message).toContain("Wrapped error");
-      expect(originalError.stack).toBeDefined();
-      expect(apiError.message).toContain(originalError.stack as string);
-    });
-
-    it("includes detail in message when provided", () => {
-      const error = new APIError({
-        detail: "More details here",
-        title: "Test error",
-      });
-      expect(error.message).toContain("Test error");
-      expect(error.message).toContain("More details here");
-    });
-
-    it("sets fields in meta when provided", () => {
-      const error = new APIError({
-        fields: {email: "Invalid email format"},
-        title: "Validation error",
-      });
-      expect(error.meta?.fields).toEqual({email: "Invalid email format"});
-    });
-  });
-
-  describe("errorsPlugin", () => {
-    it("adds apiErrors field to schema", async () => {
-      const mongoose = await import("mongoose");
-      const {errorsPlugin} = await import("./errors");
-
-      const testSchema = new mongoose.Schema({name: String});
-      errorsPlugin(testSchema);
-
-      expect(testSchema.path("apiErrors")).toBeDefined();
-    });
-  });
-
-  describe("isAPIError", () => {
-    it("returns true for APIError instances", () => {
-      const {isAPIError} = require("./errors");
-      const error = new APIError({title: "Test"});
-      expect(isAPIError(error)).toBe(true);
-    });
-
-    it("returns false for regular Error instances", () => {
-      const {isAPIError} = require("./errors");
-      const error = new Error("Test");
-      expect(isAPIError(error)).toBe(false);
-    });
-  });
-
-  describe("getDisableExternalErrorTracking", () => {
-    it("returns undefined for non-objects", () => {
-      const {getDisableExternalErrorTracking} = require("./errors");
-      expect(getDisableExternalErrorTracking(null)).toBeUndefined();
-      expect(getDisableExternalErrorTracking("string")).toBeUndefined();
-    });
-
-    it("returns value from APIError", () => {
-      const {getDisableExternalErrorTracking} = require("./errors");
-      const error = new APIError({disableExternalErrorTracking: true, title: "Test"});
-      expect(getDisableExternalErrorTracking(error)).toBe(true);
-    });
-
-    it("returns value from plain object with property", () => {
-      const {getDisableExternalErrorTracking} = require("./errors");
-      const obj = {disableExternalErrorTracking: true};
-      expect(getDisableExternalErrorTracking(obj)).toBe(true);
-    });
-  });
-
-  describe("getAPIErrorBody", () => {
-    it("includes all non-undefined fields", () => {
-      const {getAPIErrorBody} = require("./errors");
-      const error = new APIError({
-        code: "TEST_CODE",
-        detail: "Test detail",
-        id: "error-123",
-        links: {about: "http://example.com"},
-        meta: {extra: "data"},
-        source: {parameter: "id"},
-        status: 400,
-        title: "Test error",
-      });
-      const body = getAPIErrorBody(error);
-
-      expect(body.title).toBe("Test error");
-      expect(body.status).toBe(400);
-      expect(body.code).toBe("TEST_CODE");
-      expect(body.detail).toBe("Test detail");
-      expect(body.id).toBe("error-123");
-      expect(body.links).toEqual({about: "http://example.com"});
-      expect(body.source).toEqual({parameter: "id"});
-      expect(body.meta).toEqual({extra: "data"});
-    });
-  });
-
-  describe("apiUnauthorizedMiddleware", () => {
-    it("returns 401 for Unauthorized errors", () => {
-      const {apiUnauthorizedMiddleware} = require("./errors");
-      const err = new Error("Unauthorized");
-      const res = {
-        json: function (data: any) {
-          (this as any).body = data;
-          return this;
-        },
-        send: function () {
-          return this;
-        },
-        status: function (code: number) {
-          (this as any).statusCode = code;
-          return this;
-        },
-      };
-      const next = () => {};
 
-      apiUnauthorizedMiddleware(err, {}, res, next);
-      expect((res as any).statusCode).toBe(401);
-      expect((res as any).body.title).toBe("Unauthorized");
+      agent = await authAsUser(app, "notAdmin");
     });
 
-    it("calls next for non-Unauthorized errors", () => {
-      const {apiUnauthorizedMiddleware} = require("./errors");
-      const err = new Error("Some other error");
-      let nextCalled = false;
-      const next = () => {
-        nextCalled = true;
-      };
+    it("gets all users", async () => {
+      const res = await agent.get("/users").expect(200);
+      expect(res.body.data).toHaveLength(5);
 
-      apiUnauthorizedMiddleware(err, {}, {}, next);
-      expect(nextCalled).toBe(true);
-    });
-  });
-});
+      const data = sortBy(res.body.data, ["email"]);
 
-describe("permissions module", () => {
-  describe("OwnerQueryFilter", () => {
-    it("returns ownerId filter when user is provided", () => {
-      const {OwnerQueryFilter} = require("./permissions");
-      const user = {id: "user-123"};
-      const filter = OwnerQueryFilter(user);
-      expect(filter).toEqual({ownerId: "user-123"});
-    });
+      expect(data[0].email).toBe("admin+other@example.com");
+      expect(data[0].department).toBeUndefined();
+      expect(data[0].supertitle).toBeUndefined();
+      expect(data[0].__t).toBeUndefined();
 
-    it("returns null when user is undefined", () => {
-      const {OwnerQueryFilter} = require("./permissions");
-      const filter = OwnerQueryFilter(undefined);
-      expect(filter).toBeNull();
-    });
-  });
+      expect(data[1].email).toBe("admin@example.com");
+      expect(data[1].department).toBeUndefined();
+      expect(data[1].supertitle).toBeUndefined();
+      expect(data[1].__t).toBeUndefined();
 
-  describe("Permissions.IsAuthenticatedOrReadOnly", () => {
-    it("returns true for authenticated non-anonymous users", () => {
-      const {Permissions} = require("./permissions");
-      const user = {id: "user-123", isAnonymous: false};
-      expect(Permissions.IsAuthenticatedOrReadOnly("create", user)).toBe(true);
-    });
+      expect(data[2].email).toBe("notAdmin@example.com");
+      expect(data[2].department).toBeUndefined();
+      expect(data[2].supertitle).toBeUndefined();
+      expect(data[2].__t).toBeUndefined();
 
-    it("returns true for read methods when user is anonymous", () => {
-      const {Permissions} = require("./permissions");
-      const user = {id: "user-123", isAnonymous: true};
-      expect(Permissions.IsAuthenticatedOrReadOnly("list", user)).toBe(true);
-      expect(Permissions.IsAuthenticatedOrReadOnly("read", user)).toBe(true);
-    });
+      expect(data[3].email).toBe("staff@example.com");
+      expect(data[3].department).toBe("Accounting");
+      expect(data[3].supertitle).toBeUndefined();
+      expect(data[3].__t).toBe("Staff");
 
-    it("returns false for write methods when user is anonymous", () => {
-      const {Permissions} = require("./permissions");
-      const user = {id: "user-123", isAnonymous: true};
-      expect(Permissions.IsAuthenticatedOrReadOnly("create", user)).toBe(false);
-      expect(Permissions.IsAuthenticatedOrReadOnly("update", user)).toBe(false);
-      expect(Permissions.IsAuthenticatedOrReadOnly("delete", user)).toBe(false);
+      expect(data[4].email).toBe("superuser@example.com");
+      expect(data[4].department).toBeUndefined();
+      expect(data[4].superTitle).toBe("Super Man");
+      expect(data[4].__t).toBe("SuperUser");
     });
-  });
 
-  describe("Permissions.IsOwnerOrReadOnly", () => {
-    it("returns true when no object is provided", () => {
-      const {Permissions} = require("./permissions");
-      expect(Permissions.IsOwnerOrReadOnly("update", {id: "user-123"}, undefined)).toBe(true);
-    });
+    it("gets a discriminated user", async () => {
+      const res = await agent.get(`/users/${superUser._id}`).expect(200);
 
-    it("returns true for admin users", () => {
-      const {Permissions} = require("./permissions");
-      const user = {admin: true, id: "admin-123"};
-      const obj = {ownerId: "other-user"};
-      expect(Permissions.IsOwnerOrReadOnly("update", user, obj)).toBe(true);
+      expect(res.body.data.email).toBe("superuser@example.com");
+      expect(res.body.data.department).toBeUndefined();
+      expect(res.body.data.superTitle).toBe("Super Man");
     });
 
-    it("returns true when user is owner", () => {
-      const {Permissions} = require("./permissions");
-      const user = {id: "user-123"};
-      const obj = {ownerId: "user-123"};
-      expect(Permissions.IsOwnerOrReadOnly("update", user, obj)).toBe(true);
-    });
+    it("updates a discriminated user", async () => {
+      // Fails without __t.
+      await agent.patch(`/users/${superUser._id}`).send({superTitle: "Batman"}).expect(404);
 
-    it("returns true for read methods when not owner", () => {
-      const {Permissions} = require("./permissions");
-      const user = {id: "user-123"};
-      const obj = {ownerId: "other-user"};
-      expect(Permissions.IsOwnerOrReadOnly("list", user, obj)).toBe(true);
-      expect(Permissions.IsOwnerOrReadOnly("read", user, obj)).toBe(true);
-    });
+      const res = await agent
+        .patch(`/users/${superUser._id}`)
+        .send({__t: "SuperUser", superTitle: "Batman"})
+        .expect(200);
 
-    it("returns false for write methods when not owner", () => {
-      const {Permissions} = require("./permissions");
-      const user = {id: "user-123"};
-      const obj = {ownerId: "other-user"};
-      expect(Permissions.IsOwnerOrReadOnly("update", user, obj)).toBe(false);
-      expect(Permissions.IsOwnerOrReadOnly("delete", user, obj)).toBe(false);
-    });
-  });
-});
+      expect(res.body.data.email).toBe("superuser@example.com");
+      expect(res.body.data.department).toBeUndefined();
+      expect(res.body.data.superTitle).toBe("Batman");
 
-describe("utils module", () => {
-  describe("isValidObjectId", () => {
-    it("returns true for valid ObjectId strings", () => {
-      const {isValidObjectId} = require("./utils");
-      expect(isValidObjectId("507f1f77bcf86cd799439011")).toBe(true);
+      const user = await SuperUserModel.findById(superUser._id);
+      expect(user?.superTitle).toBe("Batman");
     });
 
-    it("returns false for invalid ObjectId strings", () => {
-      const {isValidObjectId} = require("./utils");
-      expect(isValidObjectId("invalid-id")).toBe(false);
-      expect(isValidObjectId("12345")).toBe(false);
-      expect(isValidObjectId("")).toBe(false);
-    });
+    it("updates a base user", async () => {
+      const res = await agent
+        .patch(`/users/${notAdmin._id}`)
+        .send({email: "newemail@example.com", superTitle: "The Boss"})
+        .expect(200);
 
-    it("returns false for 12-character strings that are not valid ObjectIds", () => {
-      const {isValidObjectId} = require("./utils");
-      // mongoose's native isValid returns true for any 12-char string
-      // but our implementation should return false since toString won't match
-      expect(isValidObjectId("123456789012")).toBe(false);
-    });
-  });
+      expect(res.body.data.email).toBe("newemail@example.com");
+      expect(res.body.data.superTitle).toBeUndefined();
 
-  describe("timeout", () => {
-    it("resolves after specified time", async () => {
-      const {timeout} = require("./utils");
-      const start = Date.now();
-      await timeout(50);
-      const elapsed = Date.now() - start;
-      expect(elapsed).toBeGreaterThanOrEqual(40);
+      const user = await SuperUserModel.findById(notAdmin._id);
+      expect(user?.superTitle).toBeUndefined();
     });
-  });
-
-  // Note: Comprehensive checkModelsStrict tests are in utils.test.ts with mocked mongoose
-});
 
-describe("populate module", () => {
-  describe("unpopulate", () => {
-    it("throws error when path is empty", async () => {
-      const {unpopulate} = await import("./populate");
-      const doc = {name: "test"};
-      expect(() => unpopulate(doc as any, "")).toThrow("path is required");
-    });
-
-    it("unpopulates single populated field", async () => {
-      const {unpopulate} = await import("./populate");
-      const doc = {
-        name: "test",
-        ownerId: {_id: "owner-123", email: "owner@test.com"},
-      };
-      const result = unpopulate(doc as any, "ownerId") as any;
-      expect(result.ownerId).toBe("owner-123");
-    });
-
-    it("unpopulates array of populated fields", async () => {
-      const {unpopulate} = await import("./populate");
-      const doc = {
-        items: [{_id: "item-1", name: "Item 1"}, {_id: "item-2", name: "Item 2"}, "item-3"],
-        name: "test",
-      };
-      const result = unpopulate(doc as any, "items") as any;
-      expect(result.items).toEqual(["item-1", "item-2", "item-3"]);
-    });
-
-    it("handles nested paths", async () => {
-      const {unpopulate} = await import("./populate");
-      const doc = {
-        name: "test",
-        nested: {
-          items: [
-            {_id: "item-1", name: "Item 1"},
-            {_id: "item-2", name: "Item 2"},
-          ],
-        },
-      };
-      const result = unpopulate(doc as any, "nested.items") as any;
-      expect(result.nested.items).toEqual(["item-1", "item-2"]);
-    });
+    it("cannot update discriminator key", async () => {
+      await agent
+        .patch(`/users/${notAdmin._id}`)
+        .send({__t: "Staff", superTitle: "Batman"})
+        .expect(404);
 
-    it("returns original doc when path does not exist", async () => {
-      const {unpopulate} = await import("./populate");
-      const doc = {name: "test"};
-      const result = unpopulate(doc as any, "nonexistent") as any;
-      expect(result).toEqual(doc);
+      await agent
+        .patch(`/users/${staffUser._id}`)
+        .send({__t: "SuperUser", superTitle: "Batman"})
+        .expect(404);
     });
 
-    it("handles nested array paths", async () => {
-      const {unpopulate} = await import("./populate");
-      const doc = {
-        containers: [
-          {items: [{_id: "item-1"}, {_id: "item-2"}]},
-          {items: [{_id: "item-3"}, {_id: "item-4"}]},
-        ],
-        name: "test",
-      };
-      const result = unpopulate(doc as any, "containers.items") as any;
-      expect(result.containers[0].items).toEqual(["item-1", "item-2"]);
-      expect(result.containers[1].items).toEqual(["item-3", "item-4"]);
-    });
-  });
-});
+    it("updating a field on another discriminated model does nothing", async () => {
+      const res = await agent
+        .patch(`/users/${superUser._id}`)
+        .send({__t: "SuperUser", department: "Journalism"})
+        .expect(200);
 
-describe("auth module edge cases", () => {
-  describe("generateTokens", () => {
-    it("returns null tokens when user is missing", async () => {
-      const {generateTokens} = await import("./auth");
-      const result = await generateTokens(null);
-      expect(result.token).toBeNull();
-      expect(result.refreshToken).toBeNull();
-    });
+      expect(res.body.data.department).toBeUndefined();
 
-    it("returns null tokens when user has no _id", async () => {
-      const {generateTokens} = await import("./auth");
-      const result = await generateTokens({email: "test@test.com"});
-      expect(result.token).toBeNull();
-      expect(result.refreshToken).toBeNull();
+      const user = await SuperUserModel.findById(superUser._id);
+      expect((user as any)?.department).toBeUndefined();
     });
 
-    it("includes custom payload from generateJWTPayload option", async () => {
-      const {generateTokens} = await import("./auth");
-      const jwt = await import("jsonwebtoken");
+    it("creates a discriminated user", async () => {
+      const res = await agent
+        .post("/users")
+        .send({
+          __t: "SuperUser",
+          department: "R&D",
+          email: "brucewayne@example.com",
+          superTitle: "Batman",
+        })
+        .expect(201);
 
-      const user = {_id: "user-123"};
-      const result = await generateTokens(user, {
-        generateJWTPayload: (u) => ({customField: "customValue", userId: u._id}),
-      });
+      expect(res.body.data.email).toBe("brucewayne@example.com");
+      // Because we pass __t, this should create a SuperUser which has no department, so this is
+      // dropped.
+      expect(res.body.data.department).toBeUndefined();
+      expect(res.body.data.superTitle).toBe("Batman");
 
-      expect(result.token).toBeDefined();
-      const decoded = jwt.decode(result.token as string) as any;
-      expect(decoded.customField).toBe("customValue");
-      expect(decoded.id).toBe("user-123");
+      const user = await SuperUserModel.findById(res.body.data._id);
+      expect(user?.superTitle).toBe("Batman");
     });
 
-    it("uses custom token expiration from generateTokenExpiration option", async () => {
-      const {generateTokens} = await import("./auth");
-      const jwt = await import("jsonwebtoken");
+    it("deletes a discriminated user", async () => {
+      // Fails without __t.
+      await agent.delete(`/users/${superUser._id}`).expect(404);
 
-      const user = {_id: "user-123"};
-      const result = await generateTokens(user, {
-        generateTokenExpiration: () => "1h",
-      });
+      await agent
+        .delete(`/users/${superUser._id}`)
+        .send({
+          __t: "SuperUser",
+        })
+        .expect(204);
 
-      expect(result.token).toBeDefined();
-      const decoded = jwt.decode(result.token as string) as any;
-      // Check that exp is roughly 1 hour from now (within 5 seconds tolerance)
-      const expectedExp = Math.floor(Date.now() / 1000) + 3600;
-      expect(decoded.exp).toBeGreaterThan(expectedExp - 5);
-      expect(decoded.exp).toBeLessThan(expectedExp + 5);
+      const user = await SuperUserModel.findById(superUser._id);
+      expect(user).toBeNull();
     });
 
-    it("uses custom refresh token expiration from generateRefreshTokenExpiration option", async () => {
-      const {generateTokens} = await import("./auth");
-      const jwt = await import("jsonwebtoken");
+    it("deletes a base user", async () => {
+      // Fails for base user with __t
+      await agent.delete(`/users/${notAdmin._id}`).send({__t: "SuperUser"}).expect(404);
 
-      const user = {_id: "user-123"};
-      const result = await generateTokens(user, {
-        generateRefreshTokenExpiration: () => "7d",
-      });
+      await agent.delete(`/users/${notAdmin._id}`).expect(204);
 
-      expect(result.refreshToken).toBeDefined();
-      const decoded = jwt.decode(result.refreshToken as string) as any;
-      // Check that exp is roughly 7 days from now
-      const expectedExp = Math.floor(Date.now() / 1000) + 7 * 24 * 3600;
-      expect(decoded.exp).toBeGreaterThan(expectedExp - 10);
-      expect(decoded.exp).toBeLessThan(expectedExp + 10);
+      const user = await SuperUserModel.findById(notAdmin._id);
+      expect(user).toBeNull();
     });
   });
 });