@terreno/api 0.0.11-beta.1 → 0.0.12

package/src/api.test.ts

@@ -1,106 +1,60 @@
 import {beforeEach, describe, expect, it} from "bun:test";
-import * as Sentry from "@sentry/node";
 import type express from "express";
-import qs from "qs";
 import supertest from "supertest";
 import type TestAgent from "supertest/lib/agent";
 
 import {addPopulateToQuery, modelRouter} from "./api";
 import {addAuthRoutes, setupAuth} from "./auth";
-import {APIError} from "./errors";
-import {logRequests} from "./expressServer";
 import {Permissions} from "./permissions";
-import {authAsUser, type Food, FoodModel, getBaseServer, setupDb, UserModel} from "./tests";
+import {
+  authAsUser,
+  type Food,
+  FoodModel,
+  getBaseServer,
+  RequiredModel,
+  setupDb,
+  UserModel,
+} from "./tests";
 import {AdminOwnerTransformer} from "./transformers";
 
 describe("@terreno/api", () => {
   let server: TestAgent;
   let app: express.Application;
 
-  describe("pre and post hooks", () => {
+  describe("populate", () => {
+    let admin: any;
+    let notAdmin: any;
     let agent: TestAgent;
+    let spinach: Food;
 
     beforeEach(async () => {
-      await setupDb();
-      app = getBaseServer();
-      setupAuth(app, UserModel as any);
-      addAuthRoutes(app, UserModel as any);
-      agent = await authAsUser(app, "notAdmin");
-    });
+      [admin, notAdmin] = await setupDb();
 
-    it("pre hooks change data", async () => {
-      let deleteCalled = false;
-      app.use(
-        "/food",
-        modelRouter(FoodModel, {
-          allowAnonymous: true,
-          permissions: {
-            create: [Permissions.IsAny],
-            delete: [Permissions.IsAny],
-            list: [Permissions.IsAny],
-            read: [Permissions.IsAny],
-            update: [Permissions.IsAny],
-          },
-          preCreate: (data: any) => {
-            data.calories = 14;
-            return data;
-          },
-          preDelete: (data: any) => {
-            deleteCalled = true;
-            return data;
+      [spinach] = await Promise.all([
+        FoodModel.create({
+          calories: 1,
+          created: new Date("2021-12-03T00:00:20.000Z"),
+          hidden: false,
+          name: "Spinach",
+          ownerId: admin._id,
+          source: {
+            name: "Brand",
           },
-          preUpdate: (data: any) => {
-            data.calories = 15;
-            return data;
+        }),
+        FoodModel.create({
+          calories: 1,
+          created: new Date("2022-12-03T00:00:20.000Z"),
+          hidden: false,
+          name: "Carrots",
+          ownerId: notAdmin._id,
+          source: {
+            name: "User",
           },
-        })
-      );
-      server = supertest(app);
-
-      let res = await server
-        .post("/food")
-        .send({
-          calories: 15,
-          name: "Broccoli",
-        })
-        .expect(201);
-      const broccoli = await FoodModel.findById(res.body.data._id);
-      if (!broccoli) {
-        throw new Error("Broccoli was not created");
-      }
-      expect(broccoli.name).toBe("Broccoli");
-      // Overwritten by the pre create hook
-      expect(broccoli.calories).toBe(14);
-
-      res = await server
-        .patch(`/food/${broccoli._id}`)
-        .send({
-          name: "Broccoli2",
-        })
-        .expect(200);
-      expect(res.body.data.name).toBe("Broccoli2");
-      // Updated by the pre update hook
-      expect(res.body.data.calories).toBe(15);
-
-      await agent.delete(`/food/${broccoli._id}`).expect(204);
-      expect(deleteCalled).toBe(true);
-    });
-
-    it("pre hooks return null", async () => {
-      const notAdmin = await UserModel.findOne({
-        email: "notAdmin@example.com",
-      });
-      const spinach = await FoodModel.create({
-        calories: 1,
-        created: new Date("2021-12-03T00:00:20.000Z"),
-        hidden: false,
-        name: "Spinach",
-        ownerId: (notAdmin as any)._id,
-        source: {
-          name: "Brand",
-        },
-      });
-
+        }),
+      ]);
+      app = getBaseServer();
+      setupAuth(app, UserModel as any);
+      addAuthRoutes(app, UserModel as any);
       app.use(
         "/food",
         modelRouter(FoodModel, {
@@ -112,312 +66,69 @@ describe("@terreno/api", () => {
             read: [Permissions.IsAny],
             update: [Permissions.IsAny],
           },
-          preCreate: () => null,
-          preDelete: () => null,
-          preUpdate: () => null,
+          populatePaths: [{fields: ["email"], path: "ownerId"}],
+          sort: "-created",
         })
       );
       server = supertest(app);
-
-      const res = await server
-        .post("/food")
-        .send({
-          calories: 15,
-          name: "Broccoli",
-        })
-        .expect(403);
-      const broccoli = await FoodModel.findById(res.body._id);
-      expect(broccoli).toBeNull();
-
-      await server
-        .patch(`/food/${spinach._id}`)
-        .send({
-          name: "Broccoli",
-        })
-        .expect(403);
-      await server.delete(`/food/${spinach._id}`).expect(403);
+      agent = await authAsUser(app, "notAdmin");
     });
 
-    it("post hooks succeed", async () => {
-      let deleteCalled = false;
-      app.use(
-        "/food",
-        modelRouter(FoodModel as any, {
-          allowAnonymous: true,
-          permissions: {
-            create: [Permissions.IsAny],
-            delete: [Permissions.IsAny],
-            list: [Permissions.IsAny],
-            read: [Permissions.IsAny],
-            update: [Permissions.IsAny],
-          },
-          postCreate: async (data: any) => {
-            data.calories = 14;
-            await data.save();
-            return data;
-          },
-          postDelete: (data: any) => {
-            deleteCalled = true;
-            return data;
-          },
-          postUpdate: async (data: any) => {
-            data.calories = 15;
-            await data.save();
-            return data;
-          },
-        })
-      );
-      server = supertest(app);
-
-      let res = await server
-        .post("/food")
-        .send({
-          calories: 15,
-          name: "Broccoli",
-        })
-        .expect(201);
-      let broccoli = await FoodModel.findById(res.body.data._id);
-      if (!broccoli) {
-        throw new Error("Broccoli was not created");
-      }
-      expect(broccoli.name).toBe("Broccoli");
-      // Overwritten by the pre create hook
-      expect(broccoli.calories).toBe(14);
-
-      res = await server
-        .patch(`/food/${broccoli._id}`)
-        .send({
-          name: "Broccoli2",
-        })
-        .expect(200);
-      broccoli = await FoodModel.findById(res.body.data._id);
-      if (!broccoli) {
-        throw new Error("Broccoli was not update");
-      }
-      expect(broccoli.name).toBe("Broccoli2");
-      // Updated by the post update hook
-      expect(broccoli.calories).toBe(15);
-
-      await agent.delete(`/food/${broccoli._id}`).expect(204);
-      expect(deleteCalled).toBe(true);
+    it("lists with populate", async () => {
+      const res = await agent.get("/food").expect(200);
+      expect(res.body.data).toHaveLength(2);
+      const [carrots, spin] = res.body.data;
+      expect(carrots.ownerId._id).toBe(notAdmin._id.toString());
+      expect(carrots.ownerId.email).toBe(notAdmin.email);
+      expect(carrots.ownerId.name).toBeUndefined();
+      expect(spin.ownerId._id).toBe(admin._id.toString());
+      expect(spin.ownerId.email).toBe(admin.email);
+      expect(spin.ownerId.name).toBeUndefined();
     });
 
-    it("preCreate hook preserves disableExternalErrorTracking on APIError", async () => {
-      app.use(
-        "/food",
-        modelRouter(FoodModel, {
-          allowAnonymous: true,
-          permissions: {
-            create: [Permissions.IsAny],
-            delete: [Permissions.IsAny],
-            list: [Permissions.IsAny],
-            read: [Permissions.IsAny],
-            update: [Permissions.IsAny],
-          },
-          preCreate: () => {
-            throw new APIError({
-              disableExternalErrorTracking: true,
-              status: 400,
-              title: "Custom preCreate error",
-            });
-          },
-        })
-      );
-      server = supertest(app);
-
-      const res = await server
-        .post("/food")
-        .send({
-          calories: 15,
-          name: "Broccoli",
-        })
-        .expect(400);
-
-      expect(res.body.title).toBe("Custom preCreate error");
-      expect(res.body.disableExternalErrorTracking).toBe(true);
+    it("reads with populate", async () => {
+      const res = await agent.get(`/food/${spinach._id}`).expect(200);
+      expect(res.body.data.ownerId._id).toBe(admin._id.toString());
+      expect(res.body.data.ownerId.email).toBe(admin.email);
+      expect(res.body.data.ownerId.name).toBeUndefined();
     });
 
-    it("preCreate hook preserves disableExternalErrorTracking on non-APIError", async () => {
-      app.use(
-        "/food",
-        modelRouter(FoodModel, {
-          allowAnonymous: true,
-          permissions: {
-            create: [Permissions.IsAny],
-            delete: [Permissions.IsAny],
-            list: [Permissions.IsAny],
-            read: [Permissions.IsAny],
-            update: [Permissions.IsAny],
-          },
-          preCreate: () => {
-            const error: any = new Error("Some custom error");
-            error.disableExternalErrorTracking = true;
-            throw error;
-          },
-        })
-      );
-      server = supertest(app);
-
+    it("creates with populate", async () => {
       const res = await server
         .post("/food")
         .send({
           calories: 15,
           name: "Broccoli",
+          ownerId: admin._id,
         })
-        .expect(400);
-
-      expect(res.body.title).toContain("preCreate hook error");
-      expect(res.body.disableExternalErrorTracking).toBe(true);
+        .expect(201);
+      expect(res.body.data.ownerId._id).toBe(admin._id.toString());
+      expect(res.body.data.ownerId.email).toBe(admin.email);
+      expect(res.body.data.ownerId.name).toBeUndefined();
     });
 
-    it("preUpdate hook preserves disableExternalErrorTracking on APIError", async () => {
-      const notAdmin = await UserModel.findOne({
-        email: "notAdmin@example.com",
-      });
-      const spinach = await FoodModel.create({
-        calories: 1,
-        created: new Date("2021-12-03T00:00:20.000Z"),
-        hidden: false,
-        name: "Spinach",
-        ownerId: (notAdmin as any)._id,
-        source: {
-          name: "Brand",
-        },
-      });
-
-      app.use(
-        "/food",
-        modelRouter(FoodModel, {
-          allowAnonymous: true,
-          permissions: {
-            create: [Permissions.IsAny],
-            delete: [Permissions.IsAny],
-            list: [Permissions.IsAny],
-            read: [Permissions.IsAny],
-            update: [Permissions.IsAny],
-          },
-          preUpdate: () => {
-            throw new APIError({
-              disableExternalErrorTracking: true,
-              status: 400,
-              title: "Custom preUpdate error",
-            });
-          },
-        })
-      );
-      server = supertest(app);
-
+    it("updates with populate", async () => {
       const res = await server
         .patch(`/food/${spinach._id}`)
         .send({
-          name: "Broccoli",
+          name: "NotSpinach",
         })
-        .expect(400);
-
-      expect(res.body.title).toBe("Custom preUpdate error");
-      expect(res.body.disableExternalErrorTracking).toBe(true);
+        .expect(200);
+      expect(res.body.data.ownerId._id).toBe(admin._id.toString());
+      expect(res.body.data.ownerId.email).toBe(admin.email);
+      expect(res.body.data.ownerId.name).toBeUndefined();
     });
+  });
 
-    it("preUpdate hook preserves disableExternalErrorTracking on non-APIError", async () => {
-      const notAdmin = await UserModel.findOne({
-        email: "notAdmin@example.com",
-      });
-      const spinach = await FoodModel.create({
-        calories: 1,
-        created: new Date("2021-12-03T00:00:20.000Z"),
-        hidden: false,
-        name: "Spinach",
-        ownerId: (notAdmin as any)._id,
-        source: {
-          name: "Brand",
-        },
-      });
+  describe("responseHandler", () => {
+    let admin: any;
+    let agent: TestAgent;
+    let spinach: Food;
 
-      app.use(
-        "/food",
-        modelRouter(FoodModel, {
-          allowAnonymous: true,
-          permissions: {
-            create: [Permissions.IsAny],
-            delete: [Permissions.IsAny],
-            list: [Permissions.IsAny],
-            read: [Permissions.IsAny],
-            update: [Permissions.IsAny],
-          },
-          preUpdate: () => {
-            const error: any = new Error("Some custom error");
-            error.disableExternalErrorTracking = true;
-            throw error;
-          },
-        })
-      );
-      server = supertest(app);
+    beforeEach(async () => {
+      [admin] = await setupDb();
 
-      const res = await server
-        .patch(`/food/${spinach._id}`)
-        .send({
-          name: "Broccoli",
-        })
-        .expect(400);
-
-      expect(res.body.title).toContain("preUpdate hook error");
-      expect(res.body.disableExternalErrorTracking).toBe(true);
-    });
-
-    it("preDelete hook preserves disableExternalErrorTracking on non-APIError", async () => {
-      const notAdmin = await UserModel.findOne({
-        email: "notAdmin@example.com",
-      });
-      const spinach = await FoodModel.create({
-        calories: 1,
-        created: new Date("2021-12-03T00:00:20.000Z"),
-        hidden: false,
-        name: "Spinach",
-        ownerId: (notAdmin as any)._id,
-        source: {
-          name: "Brand",
-        },
-      });
-
-      app.use(
-        "/food",
-        modelRouter(FoodModel, {
-          allowAnonymous: true,
-          permissions: {
-            create: [Permissions.IsAny],
-            delete: [Permissions.IsAny],
-            list: [Permissions.IsAny],
-            read: [Permissions.IsAny],
-            update: [Permissions.IsAny],
-          },
-          preDelete: () => {
-            const error: any = new Error("Some custom error");
-            error.disableExternalErrorTracking = true;
-            throw error;
-          },
-        })
-      );
-      server = supertest(app);
-
-      const res = await agent.delete(`/food/${spinach._id}`).expect(403);
-
-      expect(res.body.title).toContain("preDelete hook error");
-      expect(res.body.disableExternalErrorTracking).toBe(true);
-    });
-  });
-
-  describe("model array operations", () => {
-    let admin: any;
-    let spinach: Food;
-    let apple: Food;
-    let agent: TestAgent;
-
-    beforeEach(async () => {
-      process.env.REFRESH_TOKEN_SECRET = "testsecret1234";
-
-      [admin] = await setupDb();
-
-      [spinach, apple] = await Promise.all([
+      [spinach] = await Promise.all([
         FoodModel.create({
           calories: 1,
           created: new Date("2021-12-03T00:00:20.000Z"),
@@ -430,1478 +141,15 @@ describe("@terreno/api", () => {
         }),
         FoodModel.create({
           calories: 100,
-          categories: [
-            {
-              name: "Fruit",
-              show: true,
-            },
-            {
-              name: "Popular",
-              show: false,
-            },
-          ],
-          created: new Date("2021-12-03T00:00:30.000Z"),
-          hidden: false,
-          name: "Apple",
-          ownerId: admin._id,
-          tags: ["healthy", "cheap"],
-        }),
-      ]);
-
-      app = getBaseServer();
-      setupAuth(app, UserModel as any);
-      addAuthRoutes(app, UserModel as any);
-      app.use(
-        "/food",
-        modelRouter(FoodModel, {
-          allowAnonymous: true,
-          permissions: {
-            create: [Permissions.IsAdmin],
-            delete: [Permissions.IsAdmin],
-            list: [Permissions.IsAdmin],
-            read: [Permissions.IsAdmin],
-            update: [Permissions.IsAdmin],
-          },
-          queryFields: ["hidden", "calories", "created", "source.name"],
-          sort: {created: "descending"},
-        })
-      );
-      server = supertest(app);
-      agent = await authAsUser(app, "admin");
-    });
-
-    it("add array sub-schema item", async () => {
-      // Incorrect way, should have "categories" as a top level key.
-      let res = await agent
-        .post(`/food/${apple._id}/categories`)
-        .send({name: "Good Seller", show: false})
-        .expect(400);
-      expect(res.body.title).toBe(
-        "Malformed body, array operations should have a single, top level key, got: name,show"
-      );
-
-      res = await agent
-        .post(`/food/${apple._id}/categories`)
-        .send({categories: {name: "Good Seller", show: false}})
-        .expect(200);
-      expect(res.body.data.categories).toHaveLength(3);
-      expect(res.body.data.categories[2].name).toBe("Good Seller");
-
-      res = await agent
-        .post(`/food/${spinach._id}/categories`)
-        .send({categories: {name: "Good Seller", show: false}})
-        .expect(200);
-      expect(res.body.data.categories).toHaveLength(1);
-    });
-
-    it("update array sub-schema item", async () => {
-      let res = await agent
-        .patch(`/food/${apple._id}/categories/xyz`)
-        .send({categories: {name: "Good Seller", show: false}})
-        .expect(404);
-      expect(res.body.title).toBe("Could not find categories/xyz");
-      res = await agent
-        .patch(`/food/${apple._id}/categories/${apple.categories[1]._id}`)
-        .send({categories: {name: "Good Seller", show: false}})
-        .expect(200);
-      expect(res.body.data.categories).toHaveLength(2);
-      expect(res.body.data.categories[1].name).toBe("Good Seller");
-    });
-
-    it("delete array sub-schema item", async () => {
-      let res = await agent.delete(`/food/${apple._id}/categories/xyz`).expect(404);
-      expect(res.body.title).toBe("Could not find categories/xyz");
-      res = await agent
-        .delete(`/food/${apple._id}/categories/${apple.categories[0]._id}`)
-        .expect(200);
-      expect(res.body.data.categories).toHaveLength(1);
-      expect(res.body.data.categories[0].name).toBe("Popular");
-    });
-
-    it("add array item", async () => {
-      let res = await agent.post(`/food/${apple._id}/tags`).send({tags: "popular"}).expect(200);
-      expect(res.body.data.tags).toHaveLength(3);
-      expect(res.body.data.tags).toEqual(["healthy", "cheap", "popular"]);
-
-      res = await agent.post(`/food/${spinach._id}/tags`).send({tags: "popular"}).expect(200);
-      expect(res.body.data.tags).toEqual(["popular"]);
-    });
-
-    it("update array item", async () => {
-      let res = await agent
-        .patch(`/food/${apple._id}/tags/xyz`)
-        .send({tags: "unhealthy"})
-        .expect(404);
-      expect(res.body.title).toBe("Could not find tags/xyz");
-      res = await agent
-        .patch(`/food/${apple._id}/tags/healthy`)
-        .send({tags: "unhealthy"})
-        .expect(200);
-      expect(res.body.data.tags).toEqual(["unhealthy", "cheap"]);
-    });
-
-    it("delete array item", async () => {
-      let res = await agent.delete(`/food/${apple._id}/tags/xyz`).expect(404);
-      expect(res.body.title).toBe("Could not find tags/xyz");
-      res = await agent.delete(`/food/${apple._id}/tags/healthy`).expect(200);
-      expect(res.body.data.tags).toEqual(["cheap"]);
-    });
-
-    it("updates timestamps on array subdocuments", async () => {
-      // Create a food with categories that have timestamps
-      const foodWithTimestamps = await FoodModel.create({
-        calories: 100,
-        categories: [
-          {
-            name: "Category 1",
-            show: true,
-            updated: new Date("2024-01-01T00:00:00.000Z"),
-          },
-          {
-            name: "Category 2",
-            show: true,
-            updated: new Date("2024-01-01T00:00:00.000Z"),
-          },
-        ],
-        created: new Date(),
-        name: "Food with Timestamps",
-        ownerId: admin._id,
-      });
-
-      const firstCategoryId = foodWithTimestamps.categories?.[0]?._id?.toString();
-      const secondCategoryId = foodWithTimestamps.categories?.[1]?._id?.toString();
-
-      if (!firstCategoryId || !secondCategoryId) {
-        throw new Error("Failed to create food with categories");
-      }
-
-      // Wait a moment to ensure timestamp difference
-      await new Promise((resolve) => setTimeout(resolve, 100));
-
-      // Update one of the categories
-      const res = await agent
-        .patch(`/food/${foodWithTimestamps._id}/categories/${firstCategoryId}`)
-        .send({categories: {name: "Updated Category"}})
-        .expect(200);
-
-      // Verify the updated category has a newer timestamp
-      const updatedCategory = res.body.data.categories.find((c: any) => c._id === firstCategoryId);
-      const unchangedCategory = res.body.data.categories.find(
-        (c: any) => c._id === secondCategoryId
-      );
-
-      if (!updatedCategory || !unchangedCategory) {
-        throw new Error("Failed to find categories in response");
-      }
-
-      expect(updatedCategory.updated).not.toBe(updatedCategory.created);
-      expect(unchangedCategory.updated).toBe(unchangedCategory.created);
-      expect(updatedCategory.name).toBe("Updated Category");
-      // Unchanged.
-      expect(updatedCategory.show).toBe(true);
-      expect(unchangedCategory.show).toBe(true);
-    });
-
-    it("array operations call postUpdate with different copy of document", async () => {
-      let postUpdateDoc: any;
-      let postUpdatePrevDoc: any;
-      let postUpdateCalled = false;
-
-      app = getBaseServer();
-      setupAuth(app, UserModel as any);
-      addAuthRoutes(app, UserModel as any);
-      app.use(
-        "/food",
-        modelRouter(FoodModel, {
-          allowAnonymous: true,
-          permissions: {
-            create: [Permissions.IsAdmin],
-            delete: [Permissions.IsAdmin],
-            list: [Permissions.IsAdmin],
-            read: [Permissions.IsAdmin],
-            update: [Permissions.IsAdmin],
-          },
-          postUpdate: async (doc: any, _cleanedBody: any, _request: any, prevValue: any) => {
-            postUpdateDoc = doc;
-            postUpdatePrevDoc = prevValue;
-            postUpdateCalled = true;
-          },
-        })
-      );
-      server = supertest(app);
-      agent = await authAsUser(app, "admin");
-
-      // Test POST operation (add to array)
-      await agent
-        .post(`/food/${apple._id}/categories`)
-        .send({categories: {name: "New Category", show: true}})
-        .expect(200);
-
-      expect(postUpdateCalled).toBe(true);
-      expect(postUpdateDoc).toBeDefined();
-      expect(postUpdatePrevDoc).toBeDefined();
-
-      // Verify they are different object references
-      expect(postUpdateDoc).not.toBe(postUpdatePrevDoc);
-
-      // Verify the content is different (new category added)
-      expect(postUpdateDoc.categories).toHaveLength(3);
-      expect(postUpdatePrevDoc.categories).toHaveLength(2);
-
-      // Reset for next test
-      postUpdateCalled = false;
-      postUpdateDoc = undefined;
-      postUpdatePrevDoc = undefined;
-
-      // Test PATCH operation (update array item)
-      const categoryId = apple.categories[0]._id;
-      if (!categoryId) {
-        throw new Error("Category ID is undefined");
-      }
-      await agent
-        .patch(`/food/${apple._id}/categories/${categoryId}`)
-        .send({categories: {name: "Updated Category", show: false}})
-        .expect(200);
-
-      expect(postUpdateCalled).toBe(true);
-      expect(postUpdateDoc).toBeDefined();
-      expect(postUpdatePrevDoc).toBeDefined();
-
-      // Verify they are different object references
-      expect(postUpdateDoc).not.toBe(postUpdatePrevDoc);
-
-      // Verify the content is different (category updated)
-      const updatedCategory = postUpdateDoc.categories.find(
-        (c: any) => c._id.toString() === categoryId.toString()
-      );
-      const prevCategory = postUpdatePrevDoc.categories.find(
-        (c: any) => c._id.toString() === categoryId.toString()
-      );
-
-      expect(updatedCategory.name).toBe("Updated Category");
-      expect(prevCategory.name).toBe("Fruit");
-
-      // Reset for next test
-      postUpdateCalled = false;
-      postUpdateDoc = undefined;
-      postUpdatePrevDoc = undefined;
-
-      // Test DELETE operation (remove from array)
-      await agent.delete(`/food/${apple._id}/categories/${categoryId}`).expect(200);
-
-      expect(postUpdateCalled).toBe(true);
-      expect(postUpdateDoc).toBeDefined();
-      expect(postUpdatePrevDoc).toBeDefined();
-
-      // Verify they are different object references
-      expect(postUpdateDoc).not.toBe(postUpdatePrevDoc);
-
-      // Verify the content is different (category removed)
-      const remainingCategories = postUpdateDoc.categories.filter(
-        (c: any) => c._id.toString() === categoryId.toString()
-      );
-      const prevCategories = postUpdatePrevDoc.categories.filter(
-        (c: any) => c._id.toString() === categoryId.toString()
-      );
-
-      expect(remainingCategories).toHaveLength(0);
-      expect(prevCategories).toHaveLength(1);
-    });
-
-    it("array operations with string arrays call postUpdate with different copy", async () => {
-      let postUpdateDoc: any;
-      let postUpdatePrevDoc: any;
-      let postUpdateCalled = false;
-
-      app = getBaseServer();
-      setupAuth(app, UserModel as any);
-      addAuthRoutes(app, UserModel as any);
-      app.use(
-        "/food",
-        modelRouter(FoodModel, {
-          allowAnonymous: true,
-          permissions: {
-            create: [Permissions.IsAdmin],
-            delete: [Permissions.IsAdmin],
-            list: [Permissions.IsAdmin],
-            read: [Permissions.IsAdmin],
-            update: [Permissions.IsAdmin],
-          },
-          postUpdate: async (doc: any, _cleanedBody: any, _request: any, prevValue: any) => {
-            postUpdateDoc = doc;
-            postUpdatePrevDoc = prevValue;
-            postUpdateCalled = true;
-          },
-        })
-      );
-      server = supertest(app);
-      agent = await authAsUser(app, "admin");
-
-      // Test POST operation with string array (add tag)
-      await agent.post(`/food/${apple._id}/tags`).send({tags: "organic"}).expect(200);
-
-      expect(postUpdateCalled).toBe(true);
-      expect(postUpdateDoc).toBeDefined();
-      expect(postUpdatePrevDoc).toBeDefined();
-
-      // Verify they are different object references
-      expect(postUpdateDoc).not.toBe(postUpdatePrevDoc);
-
-      // Verify the content is different (new tag added)
-      expect(postUpdateDoc.tags).toHaveLength(3);
-      expect(postUpdatePrevDoc.tags).toHaveLength(2);
-      expect(postUpdateDoc.tags).toContain("organic");
-      expect(postUpdatePrevDoc.tags).not.toContain("organic");
-
-      // Reset for next test
-      postUpdateCalled = false;
-      postUpdateDoc = undefined;
-      postUpdatePrevDoc = undefined;
-
-      // Test PATCH operation with string array (update tag)
-      await agent
-        .patch(`/food/${apple._id}/tags/healthy`)
-        .send({tags: "super-healthy"})
-        .expect(200);
-
-      expect(postUpdateCalled).toBe(true);
-      expect(postUpdateDoc).not.toBe(postUpdatePrevDoc);
-
-      // Verify the content is different (tag updated)
-      expect(postUpdateDoc.tags).toContain("super-healthy");
-      expect(postUpdatePrevDoc.tags).toContain("healthy");
-      expect(postUpdateDoc.tags).not.toContain("healthy");
-      expect(postUpdatePrevDoc.tags).not.toContain("super-healthy");
-    });
-  });
-
-  describe("standard methods", () => {
-    let notAdmin: any;
-    let admin: any;
-    let adminOther: any;
-    let agent: TestAgent;
-
-    let spinach: Food;
-    let apple: Food;
-    let carrots: Food;
-    let pizza: Food;
-
-    beforeEach(async () => {
-      [admin, notAdmin, adminOther] = await setupDb();
-
-      const results = (await Promise.all([
-        FoodModel.create({
-          calories: 1,
-          created: new Date("2021-12-03T00:00:20.000Z"),
-          eatenBy: [admin._id],
-          hidden: false,
-          lastEatenWith: {
-            dressing: new Date("2021-12-03T19:00:30.000Z"),
-          },
-          name: "Spinach",
-          ownerId: notAdmin._id,
-          source: {
-            dateAdded: "2023-12-13T12:30:00.000Z",
-            href: "https://www.google.com",
-            name: "Brand",
-          },
-        }),
-        FoodModel.create({
-          calories: 100,
-          created: new Date("2021-12-03T00:00:30.000Z"),
+          created: Date.now() - 10,
           hidden: true,
           name: "Apple",
-          ownerId: admin._id,
-          tags: ["healthy"],
-        }),
-        FoodModel.create({
-          calories: 100,
-          created: new Date("2021-12-03T00:00:00.000Z"),
-          eatenBy: [admin._id, notAdmin._id],
-          hidden: false,
-          name: "Carrots",
-          ownerId: admin._id,
-          source: {
-            name: "USDA",
-          },
-          tags: ["healthy", "cheap"],
-        }),
-        FoodModel.create({
-          calories: 400,
-          created: new Date("2021-12-03T00:00:10.000Z"),
-          eatenBy: [adminOther._id],
-          hidden: false,
-          name: "Pizza",
-          ownerId: admin._id,
-          tags: ["cheap"],
+          ownerId: admin?._id,
         }),
-      ])) as [Food, Food, Food, Food];
-      [spinach, apple, carrots, pizza] = results;
+      ]);
       app = getBaseServer();
       setupAuth(app, UserModel as any);
-      addAuthRoutes(app, UserModel as any);
-      app.use(logRequests);
-      app.use(
-        "/food",
-        modelRouter(FoodModel, {
-          allowAnonymous: true,
-          defaultLimit: 2,
-          defaultQueryParams: {hidden: false},
-          maxLimit: 3,
-          permissions: {
-            create: [Permissions.IsAuthenticated],
-            delete: [Permissions.IsAdmin],
-            list: [Permissions.IsAny],
-            read: [Permissions.IsAny],
-            update: [Permissions.IsOwner],
-          },
-          populatePaths: [{path: "ownerId"}],
-          queryFields: ["hidden", "name", "calories", "created", "source.name", "tags", "eatenBy"],
-          sort: {created: "descending"},
-        })
-      );
-      server = supertest(app);
-      agent = await authAsUser(app, "notAdmin");
-    });
-
-    it("read default", async () => {
-      const res = await agent.get(`/food/${spinach._id}`).expect(200);
-      expect(res.body.data._id).toBe(spinach._id.toString());
-      // Ensure populate works
-      expect(res.body.data.ownerId._id).toBe(notAdmin.id);
-      // Ensure maps are properly transformed
-      expect(res.body.data.lastEatenWith).toEqual({
-        dressing: "2021-12-03T19:00:30.000Z",
-      });
-    });
-
-    it("list default", async () => {
-      const res = await agent.get("/food").expect(200);
-      expect(res.body.data).toHaveLength(2);
-      expect(res.body.data[0].id).toBe((spinach as any).id);
-      expect(res.body.data[0].ownerId._id).toBe(notAdmin.id);
-      expect(res.body.data[1].id).toBe((pizza as any).id);
-      expect(res.body.data[1].ownerId._id).toBe(admin.id);
-      // Check that mongoose Map is handled correctly.
-      expect(res.body.data[0].lastEatenWith).toEqual({
-        dressing: "2021-12-03T19:00:30.000Z",
-      });
-      expect(res.body.data[1].lastEatenWith).toEqual(undefined);
-
-      expect(res.body.more).toBe(true);
-      expect(res.body.total).toBe(3);
-    });
-
-    it("list limit", async () => {
-      const res = await agent.get("/food?limit=1").expect(200);
-      expect(res.body.data).toHaveLength(1);
-      expect(res.body.data[0].id).toBe((spinach as any).id);
-      expect(res.body.data[0].ownerId._id).toBe(notAdmin.id);
-      expect(res.body.more).toBe(true);
-      expect(res.body.total).toBe(3);
-    });
-
-    it("list limit over", async () => {
-      // This shouldn't be seen, it's the end of the list.
-      await FoodModel.create({
-        calories: 400,
-        created: new Date("2021-12-02T00:00:10.000Z"),
-        hidden: false,
-        name: "Pizza",
-        ownerId: admin._id,
-      });
-      const res = await agent.get("/food?limit=4").expect(200);
-      expect(res.body.data).toHaveLength(3);
-      expect(res.body.more).toBe(true);
-      expect(res.body.total).toBe(4);
-      expect(res.body.data[0].id).toBe((spinach as any).id);
-      expect(res.body.data[1].id).toBe((pizza as any).id);
-      expect(res.body.data[2].id).toBe((carrots as any).id);
-
-      expect(Sentry.captureMessage).toHaveBeenCalledWith(
-        'More than 3 results returned for foods without pagination, data may be silently truncated. req.query: {"limit":"4"}'
-      );
-    });
-
-    it("list page", async () => {
-      // Should skip to carrots since apples are hidden
-      const res = await agent.get("/food?limit=1&page=2").expect(200);
-      expect(res.body.data).toHaveLength(1);
-      expect(res.body.more).toBe(true);
-      expect(res.body.total).toBe(3);
-      expect(res.body.data[0].id).toBe((pizza as any).id);
-    });
-
-    it("list page 0 ", async () => {
-      const res = await agent.get("/food?limit=1&page=0").expect(400);
-      expect(res.body.title).toBe("Invalid page: 0");
-    });
-
-    it("list page with garbage ", async () => {
-      const res = await agent.get("/food?limit=1&page=abc").expect(400);
-      expect(res.body.title).toBe("Invalid page: abc");
-    });
-
-    it("list page over", async () => {
-      // Should skip to carrots since apples are hidden
-      const res = await agent.get("/food?limit=1&page=5").expect(200);
-      expect(res.body.data).toHaveLength(0);
-      expect(res.body.more).toBe(false);
-      expect(res.body.total).toBe(3);
-    });
-
-    it("list query params", async () => {
-      // Should skip to carrots since apples are hidden
-      const res = await agent.get("/food?hidden=true").expect(200);
-      expect(res.body.data).toHaveLength(1);
-      expect(res.body.more).toBe(false);
-      expect(res.body.total).toBe(1);
-      expect(res.body.data[0].id).toBe((apple as any).id);
-    });
-
-    it("list query params not in list", async () => {
-      // Should skip to carrots since apples are hidden
-      const res = await agent.get(`/food?ownerId=${admin._id}`).expect(400);
-      expect(res.body.title).toBe("ownerId is not allowed as a query param.");
-    });
-
-    it("list query by nested param", async () => {
-      // Should skip to carrots since apples are hidden
-      const res = await agent.get("/food?source.name=USDA").expect(200);
-      expect(res.body.data).toHaveLength(1);
-      expect(res.body.total).toBe(1);
-      expect(res.body.data[0].id).toBe((carrots as any).id);
-    });
-
-    it("query by date", async () => {
-      const authRes = await server
-        .post("/auth/login")
-        .send({email: "admin@example.com", password: "securePassword"})
-        .expect(200);
-      const token = authRes.body.data.token;
-
-      // Inclusive
-      let res = await server
-        .get(
-          `/food?limit=3&${qs.stringify({
-            created: {
-              $gte: "2021-12-03T00:00:00.000Z",
-              $lte: "2021-12-03T00:00:20.000Z",
-            },
-          })}`
-        )
-        .set("authorization", `Bearer ${token}`)
-        .expect(200);
-      expect(res.body.data.map((d: any) => d.created)).toEqual(
-        expect.arrayContaining([
-          "2021-12-03T00:00:20.000Z",
-          "2021-12-03T00:00:10.000Z",
-          "2021-12-03T00:00:00.000Z",
-        ])
-      );
-      expect(res.body.data.map((d: any) => d.created)).toHaveLength(3);
-
-      // Inclusive one side
-      res = await server
-        .get(
-          `/food?limit=3&${qs.stringify({
-            created: {
-              $gte: "2021-12-03T00:00:00.000Z",
-              $lt: "2021-12-03T00:00:20.000Z",
-            },
-          })}`
-        )
-        .set("authorization", `Bearer ${token}`)
-        .expect(200);
-      expect(res.body.data.map((d: any) => d.created)).toEqual(
-        expect.arrayContaining(["2021-12-03T00:00:10.000Z", "2021-12-03T00:00:00.000Z"])
-      );
-      expect(res.body.data.map((d: any) => d.created)).toHaveLength(2);
-
-      // Inclusive both sides
-      res = await server
-        .get(
-          `/food?limit=3&${qs.stringify({
-            created: {
-              $gt: "2021-12-03T00:00:00.000Z",
-              $lt: "2021-12-03T00:00:20.000Z",
-            },
-          })}`
-        )
-        .set("authorization", `Bearer ${token}`)
-        .expect(200);
-      const createdDates = res.body.data.map((d: any) => d.created);
-      expect(createdDates).toEqual(expect.arrayContaining(["2021-12-03T00:00:10.000Z"]));
-      expect(createdDates).toHaveLength(1);
-    });
-
-    it("query with a space", async () => {
-      const greenBeans = await FoodModel.create({
-        calories: 102,
-        created: Date.now() - 10,
-        name: "Green Beans",
-        ownerId: admin?._id,
-      });
-      const res = await agent.get(`/food?${qs.stringify({name: "Green Beans"})}`).expect(200);
-      expect(res.body.data).toHaveLength(1);
-      expect(res.body.data[0].id).toBe(greenBeans?.id);
-      expect(res.body.data[0].name).toBe("Green Beans");
-    });
-
-    it("query with a regex", async () => {
-      const greenBeans = await FoodModel.create({
-        calories: 102,
-        created: Date.now() - 10,
-        name: "Green Beans",
-        ownerId: admin?._id,
-      });
-
-      // Case sensitive does match correct casing
-      let res = await agent.get(`/food?${qs.stringify({name: {$regex: "Green"}})}`).expect(200);
-      expect(res.body.data).toHaveLength(1);
-      expect(res.body.data[0].id).toBe(greenBeans?.id);
-      expect(res.body.data[0].name).toBe("Green Beans");
-
-      // Fails with different casing and sensitive
-      res = await agent.get(`/food?${qs.stringify({name: {$regex: "green"}})}`).expect(200);
-      expect(res.body.data).toHaveLength(0);
-
-      // Case insensitive does match different casing
-      res = await agent
-        .get(`/food?${qs.stringify({name: {$options: "i", $regex: "green"}})}`)
-        .expect(200);
-      expect(res.body.data).toHaveLength(1);
-      expect(res.body.data[0].id).toBe(greenBeans?.id);
-    });
-
-    it("query with an $in operator", async () => {
-      // Query including a hidden food
-      let res = await server
-        .get(
-          `/food?${qs.stringify({
-            name: {
-              $in: ["Apple", "Spinach"],
-            },
-          })}`
-        )
-        .expect(200);
-      const names1 = res.body.data.map((d: any) => d.name);
-      expect(names1).toEqual(expect.arrayContaining(["Spinach"]));
-      expect(names1).toHaveLength(1);
-
-      // Query without hidden food.
-      res = await server
-        .get(
-          `/food?${qs.stringify({
-            name: {
-              $in: ["Carrots", "Spinach"],
-            },
-          })}`
-        )
-        .expect(200);
-      const names2 = res.body.data.map((d: any) => d.name);
-      expect(names2).toEqual(expect.arrayContaining(["Spinach", "Carrots"]));
-      expect(names2).toHaveLength(2);
-    });
-
-    it("query with an $in for _ids in nested object", async () => {
-      // Query including a hidden food
-      const res = await server
-        .get(
-          `/food?${qs.stringify({
-            eatenBy: {
-              $in: [notAdmin._id.toString(), adminOther._id.toString()],
-            },
-          })}`
-        )
-        .expect(200);
-      expect(res.body.more).toBe(false);
-      expect(res.body.total).toBe(2);
-      expect(res.body.data).toHaveLength(2);
-      const names3 = res.body.data.map((d: any) => d.name);
-      expect(names3).toEqual(expect.arrayContaining(["Carrots", "Pizza"]));
-      expect(names3).toHaveLength(2);
-    });
-
-    it("query $and operator on same field", async () => {
-      const res = await agent
-        .get(`/food?${qs.stringify({$and: [{tags: "healthy"}, {tags: "cheap"}]})}`)
-        .expect(200);
-      expect(res.body.data).toHaveLength(1);
-      expect(res.body.data[0].id).toBe(carrots?._id.toString());
-    });
-
-    it("query $and operator on same field, nested objects", async () => {
-      const res = await agent
-        .get(
-          `/food?${qs.stringify({
-            $and: [{eatenBy: admin.id}, {eatenBy: notAdmin.id}],
-          })}`
-        )
-        .expect(200);
-      expect(res.body.data).toHaveLength(1);
-      expect(res.body.data[0].id).toBe(carrots?._id.toString());
-    });
-
-    it("query $or operator on same field", async () => {
-      const res = await agent
-        .get(`/food?${qs.stringify({$or: [{name: "Carrots"}, {name: "Pizza"}]})}`)
-        .expect(200);
-      expect(res.body.data).toHaveLength(2);
-      // Only carrots matches both
-      const ids1 = res.body.data.map((d) => d.id);
-      expect(ids1).toEqual(
-        expect.arrayContaining([carrots?._id.toString(), pizza?._id.toString()])
-      );
-      expect(ids1).toHaveLength(2);
-    });
-
-    it("query $and operator on same field, nested objects", async () => {
-      const res = await agent
-        .get(
-          `/food?${qs.stringify({
-            $or: [{eatenBy: admin.id}, {eatenBy: notAdmin.id}],
-            limit: 3,
-          })}`
-        )
-        .expect(200);
-      expect(res.body.data).toHaveLength(2);
-      const ids2 = res.body.data.map((d) => d.id);
-      expect(ids2).toEqual(
-        expect.arrayContaining([carrots?._id.toString(), spinach?._id.toString()])
-      );
-      expect(ids2).toHaveLength(2);
-    });
-
-    it("query $and and $or are rejected if field is not in queryFields", async () => {
-      let res = await agent
-        .get(`/food?${qs.stringify({$and: [{ownerId: "healthy"}, {tags: "cheap"}]})}`)
-        .expect(400);
-      expect(res.body.title).toBe("ownerId is not allowed as a query param.");
-      // Check in the other order
-      res = await agent
-        .get(`/food?${qs.stringify({$and: [{tags: "cheap"}, {ownerId: "healthy"}]})}`)
-        .expect(400);
-      expect(res.body.title).toBe("ownerId is not allowed as a query param.");
-
-      res = await agent
-        .get(`/food?${qs.stringify({$or: [{tags: "cheap"}, {ownerId: "healthy"}]})}`)
-        .expect(400);
-      expect(res.body.title).toBe("ownerId is not allowed as a query param.");
-    });
-
-    it("query with a number", async () => {
-      const res = await agent.get("/food?calories=100").expect(200);
-      expect(res.body.data).toHaveLength(1);
-      expect(res.body.data[0].id).toBe(carrots?._id.toString());
-    });
-
-    it("update", async () => {
-      let res = await agent.patch(`/food/${spinach._id}`).send({name: "Kale"}).expect(200);
-      expect(res.body.data.name).toBe("Kale");
-      expect(res.body.data.calories).toBe(1);
-      expect(res.body.data.hidden).toBe(false);
-
-      // Update a Map field.
-      res = await agent
-        .patch(`/food/${spinach._id}`)
-        .send({lastEatenWith: {dressing: "2023-12-03T00:00:20.000Z"}})
-        .expect(200);
-      expect(res.body.data.name).toBe("Kale");
-      expect(res.body.data.calories).toBe(1);
-      expect(res.body.data.hidden).toBe(false);
-      expect(res.body.data.lastEatenWith).toEqual({
-        dressing: "2023-12-03T00:00:20.000Z",
-      });
-
-      // Update a Map field.
-      res = await agent
-        .patch(`/food/${spinach._id}`)
-        .send({
-          lastEatenWith: {
-            cucumber: "2023-12-04T12:00:20.000Z",
-            dressing: "2023-12-03T00:00:20.000Z",
-          },
-        })
-        .expect(200);
-      expect(res.body.data.lastEatenWith).toEqual({
-        cucumber: "2023-12-04T12:00:20.000Z",
-        dressing: "2023-12-03T00:00:20.000Z",
-      });
-    });
-
-    it("update using dot notation", async () => {
-      // Allows updating a single field in a nested object
-      const res = await agent
-        .patch(`/food/${spinach._id}`)
-        .send({"source.href": "https://food.com"})
-        .expect(200);
-      // Assert the field was updated with dot notation.
-      expect(res.body.data.source.href).toBe("https://food.com");
-      // Assert these fields haven't changed.
-      expect(res.body.data.source.name).toBe("Brand");
-      expect(res.body.data.source.dateAdded).toBe("2023-12-13T12:30:00.000Z");
-
-      const dbSpinach = await FoodModel.findById(spinach._id);
-      expect(dbSpinach?.source.href).toBe("https://food.com");
-      expect(dbSpinach?.source.name).toBe("Brand");
-      expect(dbSpinach?.source.dateAdded).toBe("2023-12-13T12:30:00.000Z");
-    });
-  });
-
-  describe("populate", () => {
-    let admin: any;
-    let notAdmin: any;
-    let agent: TestAgent;
-
-    let spinach: Food;
-
-    beforeEach(async () => {
-      [admin, notAdmin] = await setupDb();
-
-      [spinach] = await Promise.all([
-        FoodModel.create({
-          calories: 1,
-          created: new Date("2021-12-03T00:00:20.000Z"),
-          hidden: false,
-          name: "Spinach",
-          ownerId: admin._id,
-          source: {
-            name: "Brand",
-          },
-        }),
-        FoodModel.create({
-          calories: 1,
-          created: new Date("2022-12-03T00:00:20.000Z"),
-          hidden: false,
-          name: "Carrots",
-          ownerId: notAdmin._id,
-          source: {
-            name: "User",
-          },
-        }),
-      ]);
-      app = getBaseServer();
-      setupAuth(app, UserModel as any);
-      addAuthRoutes(app, UserModel as any);
-      app.use(
-        "/food",
-        modelRouter(FoodModel, {
-          allowAnonymous: true,
-          permissions: {
-            create: [Permissions.IsAny],
-            delete: [Permissions.IsAny],
-            list: [Permissions.IsAny],
-            read: [Permissions.IsAny],
-            update: [Permissions.IsAny],
-          },
-          populatePaths: [{fields: ["email"], path: "ownerId"}],
-          sort: "-created",
-        })
-      );
-      server = supertest(app);
-      agent = await authAsUser(app, "notAdmin");
-    });
-
-    it("lists with populate", async () => {
-      const res = await agent.get("/food").expect(200);
-      expect(res.body.data).toHaveLength(2);
-      const [carrots, spin] = res.body.data;
-      expect(carrots.ownerId._id).toBe(notAdmin._id.toString());
-      expect(carrots.ownerId.email).toBe(notAdmin.email);
-      expect(carrots.ownerId.name).toBeUndefined();
-      expect(spin.ownerId._id).toBe(admin._id.toString());
-      expect(spin.ownerId.email).toBe(admin.email);
-      expect(spin.ownerId.name).toBeUndefined();
-    });
-
-    it("reads with populate", async () => {
-      const res = await agent.get(`/food/${spinach._id}`).expect(200);
-      expect(res.body.data.ownerId._id).toBe(admin._id.toString());
-      expect(res.body.data.ownerId.email).toBe(admin.email);
-      expect(res.body.data.ownerId.name).toBeUndefined();
-    });
-
-    it("creates with populate", async () => {
-      const res = await server
-        .post("/food")
-        .send({
-          calories: 15,
-          name: "Broccoli",
-          ownerId: admin._id,
-        })
-        .expect(201);
-      expect(res.body.data.ownerId._id).toBe(admin._id.toString());
-      expect(res.body.data.ownerId.email).toBe(admin.email);
-      expect(res.body.data.ownerId.name).toBeUndefined();
-    });
-
-    it("updates with populate", async () => {
-      const res = await server
-        .patch(`/food/${spinach._id}`)
-        .send({
-          name: "NotSpinach",
-        })
-        .expect(200);
-      expect(res.body.data.ownerId._id).toBe(admin._id.toString());
-      expect(res.body.data.ownerId.email).toBe(admin.email);
-      expect(res.body.data.ownerId.name).toBeUndefined();
-    });
-  });
-
-  describe("responseHandler", () => {
-    let admin: any;
-    let agent: TestAgent;
-
-    let spinach: Food;
-
-    beforeEach(async () => {
-      [admin] = await setupDb();
-
-      [spinach] = await Promise.all([
-        FoodModel.create({
-          calories: 1,
-          created: new Date("2021-12-03T00:00:20.000Z"),
-          hidden: false,
-          name: "Spinach",
-          ownerId: admin._id,
-          source: {
-            name: "Brand",
-          },
-        }),
-        FoodModel.create({
-          calories: 100,
-          created: Date.now() - 10,
-          hidden: true,
-          name: "Apple",
-          ownerId: admin?._id,
-        }),
-      ]);
-      app = getBaseServer();
-      setupAuth(app, UserModel as any);
-      addAuthRoutes(app, UserModel as any);
-      app.use(
-        "/food",
-        modelRouter(FoodModel, {
-          allowAnonymous: true,
-          permissions: {
-            create: [Permissions.IsAny],
-            delete: [Permissions.IsAny],
-            list: [Permissions.IsAny],
-            read: [Permissions.IsAny],
-            update: [Permissions.IsAny],
-          },
-          responseHandler: (data, method) => {
-            if (method === "list") {
-              return (data as any).map((d: any) => ({
-                foo: "bar",
-                id: (d as any)._id,
-              }));
-            }
-            return {
-              foo: "bar",
-              id: (data as any)._id,
-            };
-          },
-        })
-      );
-      server = supertest(app);
-      agent = await authAsUser(app, "notAdmin");
-    });
-
-    it("reads with serialize", async () => {
-      const res = await agent.get(`/food/${spinach._id}`).expect(200);
-      expect(res.body.data.ownerId).toBeUndefined();
-      expect(res.body.data.id).toBe(spinach._id.toString());
-      expect(res.body.data.foo).toBe("bar");
-    });
-
-    it("list with serialize", async () => {
-      const res = await agent.get("/food").expect(200);
-      expect(res.body.data[0].ownerId).toBeUndefined();
-      expect(res.body.data[1].ownerId).toBeUndefined();
-
-      expect(res.body.data[0].id).toBeDefined();
-      expect(res.body.data[0].foo).toBe("bar");
-      expect(res.body.data[1].id).toBeDefined();
-      expect(res.body.data[1].foo).toBe("bar");
-    });
-  });
-
-  describe("plugins", () => {
-    let agent: TestAgent;
-
-    beforeEach(async () => {
-      await setupDb();
-      app = getBaseServer();
-      setupAuth(app, UserModel as any);
-      addAuthRoutes(app, UserModel as any);
-      app.use(
-        "/users",
-        modelRouter(UserModel, {
-          allowAnonymous: true,
-          permissions: {
-            create: [Permissions.IsAny],
-            delete: [Permissions.IsAny],
-            list: [Permissions.IsAny],
-            read: [Permissions.IsAny],
-            update: [Permissions.IsAny],
-          },
-        })
-      );
-      server = supertest(app);
-      agent = await authAsUser(app, "notAdmin");
-    });
-
-    it("check that security fields are filtered", async () => {
-      const res = await agent.get("/users").expect(200);
-      expect(res.body.data[0].email).toBeDefined();
-      expect(res.body.data[0].token).toBeUndefined();
-      expect(res.body.data[0].hash).toBeUndefined();
-      expect(res.body.data[0].salt).toBeUndefined();
-    });
-  });
-
-  describe("error handling", () => {
-    let admin: any;
-    let agent: TestAgent;
-    let spinach: Food;
-
-    beforeEach(async () => {
-      [admin] = await setupDb();
-
-      spinach = await FoodModel.create({
-        calories: 1,
-        created: new Date("2021-12-03T00:00:20.000Z"),
-        hidden: false,
-        name: "Spinach",
-        ownerId: admin._id,
-        source: {
-          name: "Brand",
-        },
-      });
-
-      app = getBaseServer();
-      setupAuth(app, UserModel as any);
-      addAuthRoutes(app, UserModel as any);
-    });
-
-    it("PUT returns 500 not supported", async () => {
-      app.use(
-        "/food",
-        modelRouter(FoodModel, {
-          allowAnonymous: true,
-          permissions: {
-            create: [Permissions.IsAny],
-            delete: [Permissions.IsAny],
-            list: [Permissions.IsAny],
-            read: [Permissions.IsAny],
-            update: [Permissions.IsAny],
-          },
-        })
-      );
-      server = supertest(app);
-
-      const res = await server.put(`/food/${spinach._id}`).send({name: "Kale"}).expect(500);
-      expect(res.body.title).toBe("PUT is not supported.");
-    });
-
-    it("preCreate returning undefined throws error", async () => {
-      app.use(
-        "/food",
-        modelRouter(FoodModel, {
-          allowAnonymous: true,
-          permissions: {
-            create: [Permissions.IsAny],
-            delete: [Permissions.IsAny],
-            list: [Permissions.IsAny],
-            read: [Permissions.IsAny],
-            update: [Permissions.IsAny],
-          },
-          preCreate: () => undefined as any,
-        })
-      );
-      server = supertest(app);
-
-      const res = await server.post("/food").send({calories: 15, name: "Broccoli"}).expect(403);
-      expect(res.body.title).toBe("Create not allowed");
-      expect(res.body.detail).toBe("A body must be returned from preCreate");
-    });
-
-    it("preUpdate returning undefined throws error", async () => {
-      app.use(
-        "/food",
-        modelRouter(FoodModel, {
-          allowAnonymous: true,
-          permissions: {
-            create: [Permissions.IsAny],
-            delete: [Permissions.IsAny],
-            list: [Permissions.IsAny],
-            read: [Permissions.IsAny],
-            update: [Permissions.IsAny],
-          },
-          preUpdate: () => undefined as any,
-        })
-      );
-      server = supertest(app);
-
-      const res = await server.patch(`/food/${spinach._id}`).send({name: "Kale"}).expect(403);
-      expect(res.body.title).toBe("Update not allowed");
-      expect(res.body.detail).toBe("A body must be returned from preUpdate");
-    });
-
-    it("preDelete returning undefined throws error", async () => {
-      app.use(
-        "/food",
-        modelRouter(FoodModel, {
-          allowAnonymous: true,
-          permissions: {
-            create: [Permissions.IsAny],
-            delete: [Permissions.IsAny],
-            list: [Permissions.IsAny],
-            read: [Permissions.IsAny],
-            update: [Permissions.IsAny],
-          },
-          preDelete: () => undefined as any,
-        })
-      );
-      server = supertest(app);
-      agent = await authAsUser(app, "notAdmin");
-
-      const res = await agent.delete(`/food/${spinach._id}`).expect(403);
-      expect(res.body.title).toBe("Delete not allowed");
-      expect(res.body.detail).toBe("A body must be returned from preDelete");
-    });
-
-    it("postCreate hook error is handled", async () => {
-      app.use(
-        "/food",
-        modelRouter(FoodModel, {
-          allowAnonymous: true,
-          permissions: {
-            create: [Permissions.IsAny],
-            delete: [Permissions.IsAny],
-            list: [Permissions.IsAny],
-            read: [Permissions.IsAny],
-            update: [Permissions.IsAny],
-          },
-          postCreate: () => {
-            throw new Error("postCreate failed");
-          },
-        })
-      );
-      server = supertest(app);
-
-      const res = await server.post("/food").send({calories: 15, name: "Broccoli"}).expect(400);
-      expect(res.body.title).toContain("postCreate hook error");
-    });
-
-    it("postUpdate hook error is handled", async () => {
-      app.use(
-        "/food",
-        modelRouter(FoodModel, {
-          allowAnonymous: true,
-          permissions: {
-            create: [Permissions.IsAny],
-            delete: [Permissions.IsAny],
-            list: [Permissions.IsAny],
-            read: [Permissions.IsAny],
-            update: [Permissions.IsAny],
-          },
-          postUpdate: () => {
-            throw new Error("postUpdate failed");
-          },
-        })
-      );
-      server = supertest(app);
-
-      const res = await server.patch(`/food/${spinach._id}`).send({name: "Kale"}).expect(400);
-      expect(res.body.title).toContain("postUpdate hook error");
-    });
-
-    it("postDelete hook error is handled", async () => {
-      app.use(
-        "/food",
-        modelRouter(FoodModel, {
-          allowAnonymous: true,
-          permissions: {
-            create: [Permissions.IsAny],
-            delete: [Permissions.IsAny],
-            list: [Permissions.IsAny],
-            read: [Permissions.IsAny],
-            update: [Permissions.IsAny],
-          },
-          postDelete: () => {
-            throw new Error("postDelete failed");
-          },
-        })
-      );
-      server = supertest(app);
-      agent = await authAsUser(app, "notAdmin");
-
-      const res = await agent.delete(`/food/${spinach._id}`).expect(400);
-      expect(res.body.title).toContain("postDelete hook error");
-    });
-
-    it("responseHandler error in read is handled", async () => {
-      app.use(
-        "/food",
-        modelRouter(FoodModel, {
-          allowAnonymous: true,
-          permissions: {
-            create: [Permissions.IsAny],
-            delete: [Permissions.IsAny],
-            list: [Permissions.IsAny],
-            read: [Permissions.IsAny],
-            update: [Permissions.IsAny],
-          },
-          responseHandler: (_data, method) => {
-            if (method === "read") {
-              throw new Error("responseHandler read failed");
-            }
-            return {} as any;
-          },
-        })
-      );
-      server = supertest(app);
-
-      const res = await server.get(`/food/${spinach._id}`).expect(500);
-      expect(res.body.title).toContain("responseHandler error");
-    });
-
-    it("responseHandler error in create is handled", async () => {
-      app.use(
-        "/food",
-        modelRouter(FoodModel, {
-          allowAnonymous: true,
-          permissions: {
-            create: [Permissions.IsAny],
-            delete: [Permissions.IsAny],
-            list: [Permissions.IsAny],
-            read: [Permissions.IsAny],
-            update: [Permissions.IsAny],
-          },
-          responseHandler: (_data, method) => {
-            if (method === "create") {
-              throw new Error("responseHandler create failed");
-            }
-            return {} as any;
-          },
-        })
-      );
-      server = supertest(app);
-
-      const res = await server.post("/food").send({calories: 15, name: "Broccoli"}).expect(500);
-      expect(res.body.title).toContain("responseHandler error");
-    });
-
-    it("responseHandler error in update is handled", async () => {
-      app.use(
-        "/food",
-        modelRouter(FoodModel, {
-          allowAnonymous: true,
-          permissions: {
-            create: [Permissions.IsAny],
-            delete: [Permissions.IsAny],
-            list: [Permissions.IsAny],
-            read: [Permissions.IsAny],
-            update: [Permissions.IsAny],
-          },
-          responseHandler: (_data, method) => {
-            if (method === "update") {
-              throw new Error("responseHandler update failed");
-            }
-            return {} as any;
-          },
-        })
-      );
-      server = supertest(app);
-
-      const res = await server.patch(`/food/${spinach._id}`).send({name: "Kale"}).expect(500);
-      expect(res.body.title).toContain("responseHandler error");
-    });
-
-    it("responseHandler error in list is handled", async () => {
-      app.use(
-        "/food",
-        modelRouter(FoodModel, {
-          allowAnonymous: true,
-          permissions: {
-            create: [Permissions.IsAny],
-            delete: [Permissions.IsAny],
-            list: [Permissions.IsAny],
-            read: [Permissions.IsAny],
-            update: [Permissions.IsAny],
-          },
-          responseHandler: (_data, method) => {
-            if (method === "list") {
-              throw new Error("responseHandler list failed");
-            }
-            return {} as any;
-          },
-        })
-      );
-      server = supertest(app);
-
-      const res = await server.get("/food").expect(500);
-      expect(res.body.title).toContain("responseHandler error");
-    });
-
-    it("list with non-array responseHandler returns data directly", async () => {
-      app.use(
-        "/food",
-        modelRouter(FoodModel, {
-          allowAnonymous: true,
-          permissions: {
-            create: [Permissions.IsAny],
-            delete: [Permissions.IsAny],
-            list: [Permissions.IsAny],
-            read: [Permissions.IsAny],
-            update: [Permissions.IsAny],
-          },
-          responseHandler: (_data, method) => {
-            if (method === "list") {
-              return {custom: "response"} as any;
-            }
-            return {} as any;
-          },
-        })
-      );
-      server = supertest(app);
-
-      const res = await server.get("/food").expect(200);
-      expect(res.body.data).toEqual({custom: "response"});
-      expect(res.body.more).toBeUndefined();
-      expect(res.body.total).toBeUndefined();
-    });
-
-    it("list with query sort param", async () => {
-      await FoodModel.create({
-        calories: 200,
-        created: new Date("2021-12-04T00:00:20.000Z"),
-        hidden: false,
-        name: "Apple",
-        ownerId: admin._id,
-      });
-
-      app.use(
-        "/food",
-        modelRouter(FoodModel, {
-          allowAnonymous: true,
-          permissions: {
-            create: [Permissions.IsAny],
-            delete: [Permissions.IsAny],
-            list: [Permissions.IsAny],
-            read: [Permissions.IsAny],
-            update: [Permissions.IsAny],
-          },
-          queryFields: ["name"],
-        })
-      );
-      server = supertest(app);
-
-      // Sort by name ascending
-      let res = await server.get("/food?sort=name").expect(200);
-      expect(res.body.data[0].name).toBe("Apple");
-      expect(res.body.data[1].name).toBe("Spinach");
-
-      // Sort by name descending
-      res = await server.get("/food?sort=-name").expect(200);
-      expect(res.body.data[0].name).toBe("Spinach");
-      expect(res.body.data[1].name).toBe("Apple");
-    });
-
-    it("queryFilter error is handled", async () => {
-      app.use(
-        "/food",
-        modelRouter(FoodModel, {
-          allowAnonymous: true,
-          permissions: {
-            create: [Permissions.IsAny],
-            delete: [Permissions.IsAny],
-            list: [Permissions.IsAny],
-            read: [Permissions.IsAny],
-            update: [Permissions.IsAny],
-          },
-          queryFilter: () => {
-            throw new Error("queryFilter failed");
-          },
-        })
-      );
-      server = supertest(app);
-
-      const res = await server.get("/food").expect(400);
-      expect(res.body.title).toContain("Query filter error");
-    });
-
-    it("custom endpoints take priority", async () => {
-      app.use(
-        "/food",
-        modelRouter(FoodModel, {
-          allowAnonymous: true,
-          endpoints: (router: any) => {
-            router.get("/custom", (_req: any, res: any) => {
-              res.json({custom: true});
-            });
-          },
-          permissions: {
-            create: [Permissions.IsAny],
-            delete: [Permissions.IsAny],
-            list: [Permissions.IsAny],
-            read: [Permissions.IsAny],
-            update: [Permissions.IsAny],
-          },
-        })
-      );
-      server = supertest(app);
-
-      const res = await server.get("/food/custom").expect(200);
-      expect(res.body.custom).toBe(true);
-    });
-
-    it("disallowed query param returns 400", async () => {
-      app.use(
-        "/food",
-        modelRouter(FoodModel, {
-          allowAnonymous: true,
-          permissions: {
-            create: [Permissions.IsAny],
-            delete: [Permissions.IsAny],
-            list: [Permissions.IsAny],
-            read: [Permissions.IsAny],
-            update: [Permissions.IsAny],
-          },
-          queryFields: ["name"],
-        })
-      );
-      server = supertest(app);
-
-      const res = await server.get("/food?calories=100").expect(400);
-      expect(res.body.title).toContain("calories is not allowed as a query param");
-    });
-
-    it("queryFilter returning null returns empty array", async () => {
-      app.use(
-        "/food",
-        modelRouter(FoodModel, {
-          allowAnonymous: true,
-          permissions: {
-            create: [Permissions.IsAny],
-            delete: [Permissions.IsAny],
-            list: [Permissions.IsAny],
-            read: [Permissions.IsAny],
-            update: [Permissions.IsAny],
-          },
-          queryFilter: () => null,
-        })
-      );
-      server = supertest(app);
-
-      const res = await server.get("/food").expect(200);
-      expect(res.body.data).toEqual([]);
-    });
-
-    it("preUpdate returning null throws error", async () => {
+      addAuthRoutes(app, UserModel as any);
       app.use(
         "/food",
         modelRouter(FoodModel, {
@@ -1913,85 +161,54 @@ describe("@terreno/api", () => {
             read: [Permissions.IsAny],
             update: [Permissions.IsAny],
           },
-          preUpdate: () => null,
-        })
-      );
-      server = supertest(app);
-
-      const res = await server.patch(`/food/${spinach._id}`).send({name: "Kale"}).expect(403);
-      expect(res.body.title).toBe("Update not allowed");
-    });
-
-    it("preDelete returning null throws error", async () => {
-      app.use(
-        "/food",
-        modelRouter(FoodModel, {
-          allowAnonymous: true,
-          permissions: {
-            create: [Permissions.IsAny],
-            delete: [Permissions.IsAny],
-            list: [Permissions.IsAny],
-            read: [Permissions.IsAny],
-            update: [Permissions.IsAny],
+          responseHandler: (data, method) => {
+            if (method === "list") {
+              return (data as any).map((d: any) => ({
+                foo: "bar",
+                id: (d as any)._id,
+              }));
+            }
+            return {
+              foo: "bar",
+              id: (data as any)._id,
+            };
           },
-          preDelete: () => null,
         })
       );
       server = supertest(app);
       agent = await authAsUser(app, "notAdmin");
-
-      const res = await agent.delete(`/food/${spinach._id}`).expect(403);
-      expect(res.body.title).toBe("Delete not allowed");
     });
 
-    it("preCreate returning null throws error", async () => {
-      app.use(
-        "/food",
-        modelRouter(FoodModel, {
-          allowAnonymous: true,
-          permissions: {
-            create: [Permissions.IsAny],
-            delete: [Permissions.IsAny],
-            list: [Permissions.IsAny],
-            read: [Permissions.IsAny],
-            update: [Permissions.IsAny],
-          },
-          preCreate: () => null,
-        })
-      );
-      server = supertest(app);
-
-      const res = await server.post("/food").send({calories: 15, name: "Broccoli"}).expect(403);
-      expect(res.body.title).toBe("Create not allowed");
+    it("reads with serialize", async () => {
+      const res = await agent.get(`/food/${spinach._id}`).expect(200);
+      expect(res.body.data.ownerId).toBeUndefined();
+      expect(res.body.data.id).toBe(spinach._id.toString());
+      expect(res.body.data.foo).toBe("bar");
     });
 
-    it("preCreate error is handled", async () => {
-      app.use(
-        "/food",
-        modelRouter(FoodModel, {
-          allowAnonymous: true,
-          permissions: {
-            create: [Permissions.IsAny],
-            delete: [Permissions.IsAny],
-            list: [Permissions.IsAny],
-            read: [Permissions.IsAny],
-            update: [Permissions.IsAny],
-          },
-          preCreate: () => {
-            throw new Error("preCreate failed");
-          },
-        })
-      );
-      server = supertest(app);
+    it("list with serialize", async () => {
+      const res = await agent.get("/food").expect(200);
+      expect(res.body.data[0].ownerId).toBeUndefined();
+      expect(res.body.data[1].ownerId).toBeUndefined();
 
-      const res = await server.post("/food").send({calories: 15, name: "Broccoli"}).expect(400);
-      expect(res.body.title).toContain("preCreate hook error");
+      expect(res.body.data[0].id).toBeDefined();
+      expect(res.body.data[0].foo).toBe("bar");
+      expect(res.body.data[1].id).toBeDefined();
+      expect(res.body.data[1].foo).toBe("bar");
     });
+  });
+
+  describe("plugins", () => {
+    let agent: TestAgent;
 
-    it("preUpdate error is handled", async () => {
+    beforeEach(async () => {
+      await setupDb();
+      app = getBaseServer();
+      setupAuth(app, UserModel as any);
+      addAuthRoutes(app, UserModel as any);
       app.use(
-        "/food",
-        modelRouter(FoodModel, {
+        "/users",
+        modelRouter(UserModel, {
           allowAnonymous: true,
           permissions: {
             create: [Permissions.IsAny],
@@ -2000,44 +217,37 @@ describe("@terreno/api", () => {
             read: [Permissions.IsAny],
             update: [Permissions.IsAny],
           },
-          preUpdate: () => {
-            throw new Error("preUpdate failed");
-          },
         })
       );
       server = supertest(app);
-
-      const res = await server.patch(`/food/${spinach._id}`).send({name: "Kale"}).expect(400);
-      expect(res.body.title).toContain("preUpdate hook error");
+      agent = await authAsUser(app, "notAdmin");
     });
 
-    it("invalid array operation type returns 400", async () => {
-      // This tests the else branch for invalid array operations
-      // We need to manually call the endpoint with an invalid HTTP method
-      // The array operations use POST (add), PATCH (update), DELETE (remove)
-      // We can't easily test this without modifying the router, so skip for now
+    it("check that security fields are filtered", async () => {
+      const res = await agent.get("/users").expect(200);
+      expect(res.body.data[0].email).toBeDefined();
+      expect(res.body.data[0].token).toBeUndefined();
+      expect(res.body.data[0].hash).toBeUndefined();
+      expect(res.body.data[0].salt).toBeUndefined();
     });
   });
 
-  describe("array operation errors", () => {
+  describe("error handling", () => {
     let admin: any;
-    let apple: Food;
-    let agent: TestAgent;
+    let spinach: Food;
 
     beforeEach(async () => {
       [admin] = await setupDb();
 
-      apple = await FoodModel.create({
-        calories: 100,
-        categories: [
-          {name: "Fruit", show: true},
-          {name: "Popular", show: false},
-        ],
-        created: new Date("2021-12-03T00:00:30.000Z"),
+      spinach = await FoodModel.create({
+        calories: 1,
+        created: new Date("2021-12-03T00:00:20.000Z"),
         hidden: false,
-        name: "Apple",
+        name: "Spinach",
         ownerId: admin._id,
-        tags: ["healthy", "cheap"],
+        source: {
+          name: "Brand",
+        },
       });
 
       app = getBaseServer();
@@ -2045,216 +255,193 @@ describe("@terreno/api", () => {
       addAuthRoutes(app, UserModel as any);
     });
 
-    it("array operation preUpdate returning undefined throws error", async () => {
+    it("PUT returns 500 not supported", async () => {
       app.use(
         "/food",
         modelRouter(FoodModel, {
           allowAnonymous: true,
           permissions: {
-            create: [Permissions.IsAdmin],
-            delete: [Permissions.IsAdmin],
-            list: [Permissions.IsAdmin],
-            read: [Permissions.IsAdmin],
-            update: [Permissions.IsAdmin],
+            create: [Permissions.IsAny],
+            delete: [Permissions.IsAny],
+            list: [Permissions.IsAny],
+            read: [Permissions.IsAny],
+            update: [Permissions.IsAny],
           },
-          preUpdate: () => undefined as any,
         })
       );
       server = supertest(app);
-      agent = await authAsUser(app, "admin");
 
-      const res = await agent.post(`/food/${apple._id}/tags`).send({tags: "organic"}).expect(403);
-      expect(res.body.title).toBe("Update not allowed");
-      expect(res.body.detail).toBe("A body must be returned from preUpdate");
+      const res = await server.put(`/food/${spinach._id}`).send({name: "Kale"}).expect(500);
+      expect(res.body.title).toBe("PUT is not supported.");
     });
 
-    it("array operation preUpdate returning null throws error", async () => {
+    it("responseHandler error in read is handled", async () => {
       app.use(
         "/food",
         modelRouter(FoodModel, {
           allowAnonymous: true,
           permissions: {
-            create: [Permissions.IsAdmin],
-            delete: [Permissions.IsAdmin],
-            list: [Permissions.IsAdmin],
-            read: [Permissions.IsAdmin],
-            update: [Permissions.IsAdmin],
+            create: [Permissions.IsAny],
+            delete: [Permissions.IsAny],
+            list: [Permissions.IsAny],
+            read: [Permissions.IsAny],
+            update: [Permissions.IsAny],
+          },
+          responseHandler: (_data, method) => {
+            if (method === "read") {
+              throw new Error("responseHandler read failed");
+            }
+            return {} as any;
           },
-          preUpdate: () => null,
         })
       );
       server = supertest(app);
-      agent = await authAsUser(app, "admin");
 
-      const res = await agent.post(`/food/${apple._id}/tags`).send({tags: "organic"}).expect(403);
-      expect(res.body.title).toBe("Update not allowed");
+      const res = await server.get(`/food/${spinach._id}`).expect(500);
+      expect(res.body.title).toContain("responseHandler error");
     });
 
-    it("array operation preUpdate error is handled", async () => {
+    it("responseHandler error in create is handled", async () => {
       app.use(
         "/food",
         modelRouter(FoodModel, {
           allowAnonymous: true,
           permissions: {
-            create: [Permissions.IsAdmin],
-            delete: [Permissions.IsAdmin],
-            list: [Permissions.IsAdmin],
-            read: [Permissions.IsAdmin],
-            update: [Permissions.IsAdmin],
+            create: [Permissions.IsAny],
+            delete: [Permissions.IsAny],
+            list: [Permissions.IsAny],
+            read: [Permissions.IsAny],
+            update: [Permissions.IsAny],
           },
-          preUpdate: () => {
-            throw new Error("preUpdate array failed");
+          responseHandler: (_data, method) => {
+            if (method === "create") {
+              throw new Error("responseHandler create failed");
+            }
+            return {} as any;
           },
         })
       );
       server = supertest(app);
-      agent = await authAsUser(app, "admin");
 
-      const res = await agent.post(`/food/${apple._id}/tags`).send({tags: "organic"}).expect(400);
-      expect(res.body.title).toContain("preUpdate hook error");
+      const res = await server.post("/food").send({calories: 15, name: "Broccoli"}).expect(500);
+      expect(res.body.title).toContain("responseHandler error");
     });
 
-    it("array operation postUpdate error is handled", async () => {
+    it("responseHandler error in update is handled", async () => {
       app.use(
         "/food",
         modelRouter(FoodModel, {
           allowAnonymous: true,
           permissions: {
-            create: [Permissions.IsAdmin],
-            delete: [Permissions.IsAdmin],
-            list: [Permissions.IsAdmin],
-            read: [Permissions.IsAdmin],
-            update: [Permissions.IsAdmin],
+            create: [Permissions.IsAny],
+            delete: [Permissions.IsAny],
+            list: [Permissions.IsAny],
+            read: [Permissions.IsAny],
+            update: [Permissions.IsAny],
           },
-          postUpdate: () => {
-            throw new Error("postUpdate array failed");
+          responseHandler: (_data, method) => {
+            if (method === "update") {
+              throw new Error("responseHandler update failed");
+            }
+            return {} as any;
           },
         })
       );
       server = supertest(app);
-      agent = await authAsUser(app, "admin");
 
-      const res = await agent.post(`/food/${apple._id}/tags`).send({tags: "organic"}).expect(400);
-      expect(res.body.title).toContain("PATCH Post Update error");
+      const res = await server.patch(`/food/${spinach._id}`).send({name: "Kale"}).expect(500);
+      expect(res.body.title).toContain("responseHandler error");
     });
 
-    it("array operation denied without update permission", async () => {
+    it("responseHandler error in list is handled", async () => {
       app.use(
         "/food",
         modelRouter(FoodModel, {
           allowAnonymous: true,
           permissions: {
-            create: [Permissions.IsAdmin],
-            delete: [Permissions.IsAdmin],
+            create: [Permissions.IsAny],
+            delete: [Permissions.IsAny],
             list: [Permissions.IsAny],
             read: [Permissions.IsAny],
-            update: [Permissions.IsAdmin],
+            update: [Permissions.IsAny],
           },
-        })
-      );
-      server = supertest(app);
-      agent = await authAsUser(app, "notAdmin");
-
-      const res = await agent.post(`/food/${apple._id}/tags`).send({tags: "organic"}).expect(405);
-      expect(res.body.title).toContain("Access to PATCH");
-    });
-
-    it("array operation on non-existent document returns 404", async () => {
-      app.use(
-        "/food",
-        modelRouter(FoodModel, {
-          allowAnonymous: true,
-          permissions: {
-            create: [Permissions.IsAdmin],
-            delete: [Permissions.IsAdmin],
-            list: [Permissions.IsAdmin],
-            read: [Permissions.IsAdmin],
-            update: [Permissions.IsAdmin],
+          responseHandler: (_data, method) => {
+            if (method === "list") {
+              throw new Error("responseHandler list failed");
+            }
+            return {} as any;
           },
         })
       );
       server = supertest(app);
-      agent = await authAsUser(app, "admin");
 
-      const fakeId = "000000000000000000000000";
-      const res = await agent.post(`/food/${fakeId}/tags`).send({tags: "organic"}).expect(404);
-      expect(res.body.title).toContain("Could not find document to PATCH");
+      const res = await server.get("/food").expect(500);
+      expect(res.body.title).toContain("responseHandler error");
     });
 
-    it("array operation denied when user cannot update specific doc", async () => {
-      // Create food owned by admin, then try to update as notAdmin
+    it("list with non-array responseHandler returns data directly", async () => {
       app.use(
         "/food",
         modelRouter(FoodModel, {
           allowAnonymous: true,
           permissions: {
-            create: [Permissions.IsAuthenticated],
-            delete: [Permissions.IsAuthenticated],
-            list: [Permissions.IsAuthenticated],
-            read: [Permissions.IsAuthenticated],
-            update: [Permissions.IsOwner],
+            create: [Permissions.IsAny],
+            delete: [Permissions.IsAny],
+            list: [Permissions.IsAny],
+            read: [Permissions.IsAny],
+            update: [Permissions.IsAny],
+          },
+          responseHandler: (_data, method) => {
+            if (method === "list") {
+              return {custom: "response"} as any;
+            }
+            return {} as any;
           },
         })
       );
       server = supertest(app);
-      // Login as notAdmin and try to update admin's food (apple)
-      agent = await authAsUser(app, "notAdmin");
 
-      const res = await agent.post(`/food/${apple._id}/tags`).send({tags: "organic"}).expect(403);
-      expect(res.body.title).toContain("Patch not allowed");
+      const res = await server.get("/food").expect(200);
+      expect(res.body.data).toEqual({custom: "response"});
+      expect(res.body.more).toBeUndefined();
+      expect(res.body.total).toBeUndefined();
     });
 
-    it("array operation transform error is handled", async () => {
+    it("list with query sort param", async () => {
+      await FoodModel.create({
+        calories: 200,
+        created: new Date("2021-12-04T00:00:20.000Z"),
+        hidden: false,
+        name: "Apple",
+        ownerId: admin._id,
+      });
+
       app.use(
         "/food",
         modelRouter(FoodModel, {
           allowAnonymous: true,
           permissions: {
-            create: [Permissions.IsAdmin],
-            delete: [Permissions.IsAdmin],
-            list: [Permissions.IsAdmin],
-            read: [Permissions.IsAdmin],
-            update: [Permissions.IsAdmin],
+            create: [Permissions.IsAny],
+            delete: [Permissions.IsAny],
+            list: [Permissions.IsAny],
+            read: [Permissions.IsAny],
+            update: [Permissions.IsAny],
           },
-          transformer: AdminOwnerTransformer({
-            adminWriteFields: ["name"],
-          }),
+          queryFields: ["name"],
         })
       );
       server = supertest(app);
-      agent = await authAsUser(app, "admin");
-
-      // Try to update tags field, which is not in the allowed write fields
-      const res = await agent.post(`/food/${apple._id}/tags`).send({tags: "organic"}).expect(403);
-      expect(res.body.title).toContain("cannot write fields");
-    });
-  });
-
-  describe("transformer errors", () => {
-    let admin: any;
-    let spinach: Food;
-    let agent: TestAgent;
 
-    beforeEach(async () => {
-      [admin] = await setupDb();
-
-      spinach = await FoodModel.create({
-        calories: 1,
-        created: new Date("2021-12-03T00:00:20.000Z"),
-        hidden: false,
-        name: "Spinach",
-        ownerId: admin._id,
-        source: {
-          name: "Brand",
-        },
-      });
+      let res = await server.get("/food?sort=name").expect(200);
+      expect(res.body.data[0].name).toBe("Apple");
+      expect(res.body.data[1].name).toBe("Spinach");
 
-      app = getBaseServer();
-      setupAuth(app, UserModel as any);
-      addAuthRoutes(app, UserModel as any);
+      res = await server.get("/food?sort=-name").expect(200);
+      expect(res.body.data[0].name).toBe("Spinach");
+      expect(res.body.data[1].name).toBe("Apple");
     });
 
-    it("transform error in create is handled", async () => {
+    it("queryFilter error is handled", async () => {
       app.use(
         "/food",
         modelRouter(FoodModel, {
@@ -2266,23 +453,27 @@ describe("@terreno/api", () => {
             read: [Permissions.IsAny],
             update: [Permissions.IsAny],
           },
-          transformer: AdminOwnerTransformer({
-            // Only allow 'name' to be written, so 'calories' will throw
-            anonWriteFields: ["name"],
-          }),
+          queryFilter: () => {
+            throw new Error("queryFilter failed");
+          },
         })
       );
       server = supertest(app);
 
-      const res = await server.post("/food").send({calories: 15, name: "Broccoli"}).expect(400);
-      expect(res.body.title).toContain("cannot write fields");
+      const res = await server.get("/food").expect(400);
+      expect(res.body.title).toContain("Query filter error");
     });
 
-    it("transform error in patch is handled", async () => {
+    it("custom endpoints take priority", async () => {
       app.use(
         "/food",
         modelRouter(FoodModel, {
           allowAnonymous: true,
+          endpoints: (router: any) => {
+            router.get("/custom", (_req: any, res: any) => {
+              res.json({custom: true});
+            });
+          },
           permissions: {
             create: [Permissions.IsAny],
             delete: [Permissions.IsAny],
@@ -2290,25 +481,18 @@ describe("@terreno/api", () => {
             read: [Permissions.IsAny],
             update: [Permissions.IsAny],
           },
-          transformer: AdminOwnerTransformer({
-            // Only allow 'name' to be written, so 'calories' will throw
-            anonWriteFields: ["name"],
-          }),
         })
       );
       server = supertest(app);
 
-      const res = await server.patch(`/food/${spinach._id}`).send({calories: 100}).expect(403);
-      expect(res.body.title).toContain("cannot write fields");
+      const res = await server.get("/food/custom").expect(200);
+      expect(res.body.custom).toBe(true);
     });
 
-    it("model.create validation error is handled", async () => {
-      // Use a model that has required fields
-      const {RequiredModel} = await import("./tests");
-
+    it("disallowed query param returns 400", async () => {
       app.use(
-        "/required",
-        modelRouter(RequiredModel, {
+        "/food",
+        modelRouter(FoodModel, {
           allowAnonymous: true,
           permissions: {
             create: [Permissions.IsAny],
@@ -2317,16 +501,16 @@ describe("@terreno/api", () => {
             read: [Permissions.IsAny],
             update: [Permissions.IsAny],
           },
+          queryFields: ["name"],
         })
       );
       server = supertest(app);
 
-      // Send without required 'name' field
-      const res = await server.post("/required").send({about: "test"}).expect(400);
-      expect(res.body.title).toContain("Required");
+      const res = await server.get("/food?calories=100").expect(400);
+      expect(res.body.title).toContain("calories is not allowed as a query param");
     });
 
-    it("preDelete hook throwing APIError is re-thrown", async () => {
+    it("queryFilter returning null returns empty array", async () => {
       app.use(
         "/food",
         modelRouter(FoodModel, {
@@ -2338,36 +522,32 @@ describe("@terreno/api", () => {
             read: [Permissions.IsAny],
             update: [Permissions.IsAny],
           },
-          preDelete: () => {
-            throw new APIError({
-              disableExternalErrorTracking: true,
-              status: 400,
-              title: "Custom preDelete APIError",
-            });
-          },
+          queryFilter: () => null,
         })
       );
       server = supertest(app);
-      agent = await authAsUser(app, "notAdmin");
 
-      const res = await agent.delete(`/food/${spinach._id}`).expect(400);
-      expect(res.body.title).toBe("Custom preDelete APIError");
-      expect(res.body.disableExternalErrorTracking).toBe(true);
+      const res = await server.get("/food").expect(200);
+      expect(res.body.data).toEqual([]);
     });
   });
 
-  describe("special query params", () => {
+  describe("transformer errors", () => {
     let admin: any;
+    let spinach: Food;
 
     beforeEach(async () => {
       [admin] = await setupDb();
 
-      await FoodModel.create({
+      spinach = await FoodModel.create({
         calories: 1,
         created: new Date("2021-12-03T00:00:20.000Z"),
         hidden: false,
         name: "Spinach",
         ownerId: admin._id,
+        source: {
+          name: "Brand",
+        },
       });
 
       app = getBaseServer();
@@ -2375,46 +555,7 @@ describe("@terreno/api", () => {
       addAuthRoutes(app, UserModel as any);
     });
 
-    it("period query param is stripped from query", async () => {
-      app.use(
-        "/food",
-        modelRouter(FoodModel, {
-          allowAnonymous: true,
-          permissions: {
-            create: [Permissions.IsAny],
-            delete: [Permissions.IsAny],
-            list: [Permissions.IsAny],
-            read: [Permissions.IsAny],
-            update: [Permissions.IsAny],
-          },
-          queryFields: ["name", "period"],
-          queryFilter: (_user, query) => {
-            // Simulate a queryFilter that accepts and processes period
-            if (query?.period) {
-              // Period is processed but shouldn't be passed to mongo
-              return query;
-            }
-            return query ?? {};
-          },
-        })
-      );
-      server = supertest(app);
-
-      // period should be accepted and processed without error
-      const res = await server.get("/food?period=weekly").expect(200);
-      expect(res.body.data).toBeDefined();
-    });
-
-    it("query with false value", async () => {
-      // Create a food that is hidden
-      await FoodModel.create({
-        calories: 50,
-        created: new Date("2021-12-04T00:00:20.000Z"),
-        hidden: true,
-        name: "HiddenFood",
-        ownerId: admin._id,
-      });
-
+    it("transform error in create is handled", async () => {
       app.use(
         "/food",
         modelRouter(FoodModel, {
@@ -2426,19 +567,18 @@ describe("@terreno/api", () => {
             read: [Permissions.IsAny],
             update: [Permissions.IsAny],
           },
-          queryFields: ["name", "hidden"],
+          transformer: AdminOwnerTransformer({
+            anonWriteFields: ["name"],
+          }),
         })
       );
       server = supertest(app);
 
-      // Query for non-hidden foods using ?hidden=false
-      const res = await server.get("/food?hidden=false").expect(200);
-      expect(res.body.data.every((f: any) => f.hidden === false)).toBe(true);
+      const res = await server.post("/food").send({calories: 15, name: "Broccoli"}).expect(400);
+      expect(res.body.title).toContain("cannot write fields");
     });
 
-    it("$search query triggers special handling code path", async () => {
-      // The $search code path just accesses the collection but doesn't do anything with it
-      // This test verifies the code path is exercised
+    it("transform error in patch is handled", async () => {
       app.use(
         "/food",
         modelRouter(FoodModel, {
@@ -2450,24 +590,21 @@ describe("@terreno/api", () => {
             read: [Permissions.IsAny],
             update: [Permissions.IsAny],
           },
-          // Need to include $search in queryFields for it to pass validation
-          queryFields: ["name", "$search"],
+          transformer: AdminOwnerTransformer({
+            anonWriteFields: ["name"],
+          }),
         })
       );
       server = supertest(app);
 
-      // The $search will be added to the query params, triggering the special handling
-      // Even though the code doesn't actually do anything useful with it (stub for Atlas)
-      const res = await server.get("/food?$search=test");
-      // May return 500 because $search is passed to Mongo which doesn't support it without Atlas
-      // The important thing is we've exercised the code path
-      expect(res.status === 200 || res.status === 500).toBe(true);
+      const res = await server.patch(`/food/${spinach._id}`).send({calories: 100}).expect(403);
+      expect(res.body.title).toContain("cannot write fields");
     });
 
-    it("$autocomplete query triggers special handling code path", async () => {
+    it("model.create validation error is handled", async () => {
       app.use(
-        "/food",
-        modelRouter(FoodModel, {
+        "/required",
+        modelRouter(RequiredModel, {
           allowAnonymous: true,
           permissions: {
             create: [Permissions.IsAny],
@@ -2476,13 +613,12 @@ describe("@terreno/api", () => {
             read: [Permissions.IsAny],
             update: [Permissions.IsAny],
           },
-          queryFields: ["name", "$autocomplete"],
         })
       );
       server = supertest(app);
 
-      const res = await server.get("/food?$autocomplete=test");
-      expect(res.status === 200 || res.status === 500).toBe(true);
+      const res = await server.post("/required").send({about: "test"}).expect(400);
+      expect(res.body.title).toContain("Required");
     });
   });
 
@@ -2508,7 +644,6 @@ describe("@terreno/api", () => {
         {fields: ["email"], path: "ownerId"},
         {fields: ["name"], path: "eatenBy"},
       ]);
-      // The result should be a query with populate applied
       expect(result).toBeDefined();
     });
   });
@@ -2526,9 +661,6 @@ describe("@terreno/api", () => {
     });
 
     it("soft deletes user with deleted field", async () => {
-      // UserModel has the isDisabledPlugin which adds a 'disabled' field,
-      // but we need to test the 'deleted' field check.
-      // Let's use a model that has the deleted field.
       app.use(
         "/users",
         modelRouter(UserModel, {
@@ -2545,11 +677,9 @@ describe("@terreno/api", () => {
       server = supertest(app);
       agent = await authAsUser(app, "notAdmin");
 
-      // Delete a user - this should use deleteOne since User doesn't have deleted field
       const res = await agent.delete(`/users/${admin._id}`).expect(204);
       expect(res.body).toEqual({});
 
-      // Verify user was deleted
       const deletedUser = await UserModel.findById(admin._id);
       expect(deletedUser).toBeNull();
     });
@@ -2575,7 +705,6 @@ describe("@terreno/api", () => {
     });
 
     it("handles populate with valid path in create", async () => {
-      // Test that valid populate works in create flow
       app.use(
         "/food",
         modelRouter(FoodModel, {
@@ -2597,7 +726,6 @@ describe("@terreno/api", () => {
         .send({calories: 15, name: "Broccoli", ownerId: admin._id})
         .expect(201);
       expect(res.body.data.name).toBe("Broccoli");
-      // Verify populate worked - ownerId should be an object with email
       expect(res.body.data.ownerId.email).toBe(admin.email);
     });
   });
@@ -2626,7 +754,6 @@ describe("@terreno/api", () => {
     });
 
     it("handles patch save error with validation failure", async () => {
-      // The FoodModel has strict: "throw" which will cause validation errors for unknown fields
       app.use(
         "/food",
         modelRouter(FoodModel, {
@@ -2642,7 +769,6 @@ describe("@terreno/api", () => {
       );
       server = supertest(app);
 
-      // Try to patch with an invalid field (will be caught by strict: "throw")
       const res = await server
         .patch(`/food/${spinach._id}`)
         .send({invalidField: "value"})
@@ -2661,7 +787,6 @@ describe("@terreno/api", () => {
     });
 
     it("handles undefined body after transform when no preCreate", async () => {
-      // Create a transformer that returns undefined
       app.use(
         "/food",
         modelRouter(FoodModel, {
@@ -2699,18 +824,13 @@ describe("@terreno/api", () => {
     });
 
     it("soft deletes document with deleted field using isDeletedPlugin", async () => {
-      // Create a test schema with the isDeletedPlugin
       const mongoose = await import("mongoose");
 
-      // Create a temporary model with the deleted field
       const softDeleteSchema = new mongoose.Schema({
         deleted: {default: false, type: Boolean},
         name: String,
       });
-      // Manually add the deleted field (simulating what isDeletedPlugin does)
-      // The schema already has the deleted field, so it should use soft delete
 
-      // Check if the model already exists to avoid OverwriteModelError
       let SoftDeleteModel;
       try {
         SoftDeleteModel = mongoose.model("SoftDeleteTest");
@@ -2718,10 +838,8 @@ describe("@terreno/api", () => {
         SoftDeleteModel = mongoose.model("SoftDeleteTest", softDeleteSchema);
       }
 
-      // Clean up any existing documents
       await SoftDeleteModel.deleteMany({});
 
-      // Create a test document
       const testDoc = await SoftDeleteModel.create({name: "TestItem"});
 
       app.use(
@@ -2740,516 +858,13 @@ describe("@terreno/api", () => {
       server = supertest(app);
       agent = await authAsUser(app, "notAdmin");
 
-      // Delete should soft delete (set deleted: true) instead of hard delete
       await agent.delete(`/softdelete/${testDoc._id}`).expect(204);
 
-      // Verify document was soft deleted (not hard deleted)
       const softDeleted = await SoftDeleteModel.findById(testDoc._id);
       expect(softDeleted).not.toBeNull();
       expect(softDeleted?.deleted).toBe(true);
 
-      // Clean up
       await SoftDeleteModel.deleteMany({});
     });
   });
-
-  describe("array operation with undefined preUpdate return", () => {
-    let admin: any;
-    let apple: Food;
-    let agent: TestAgent;
-
-    beforeEach(async () => {
-      [admin] = await setupDb();
-
-      apple = await FoodModel.create({
-        calories: 100,
-        categories: [
-          {name: "Fruit", show: true},
-          {name: "Popular", show: false},
-        ],
-        created: new Date("2021-12-03T00:00:30.000Z"),
-        hidden: false,
-        name: "Apple",
-        ownerId: admin._id,
-        tags: ["healthy", "cheap"],
-      });
-
-      app = getBaseServer();
-      setupAuth(app, UserModel as any);
-      addAuthRoutes(app, UserModel as any);
-    });
-
-    it("array operation preUpdate returning undefined for array POST throws error", async () => {
-      app.use(
-        "/food",
-        modelRouter(FoodModel, {
-          allowAnonymous: true,
-          permissions: {
-            create: [Permissions.IsAdmin],
-            delete: [Permissions.IsAdmin],
-            list: [Permissions.IsAdmin],
-            read: [Permissions.IsAdmin],
-            update: [Permissions.IsAdmin],
-          },
-          preUpdate: () => undefined as any,
-        })
-      );
-      server = supertest(app);
-      agent = await authAsUser(app, "admin");
-
-      const res = await agent.post(`/food/${apple._id}/tags`).send({tags: "organic"}).expect(403);
-      expect(res.body.title).toBe("Update not allowed");
-      expect(res.body.detail).toBe("A body must be returned from preUpdate");
-    });
-
-    it("array operation preUpdate returning null for array PATCH throws error", async () => {
-      app.use(
-        "/food",
-        modelRouter(FoodModel, {
-          allowAnonymous: true,
-          permissions: {
-            create: [Permissions.IsAdmin],
-            delete: [Permissions.IsAdmin],
-            list: [Permissions.IsAdmin],
-            read: [Permissions.IsAdmin],
-            update: [Permissions.IsAdmin],
-          },
-          preUpdate: () => null,
-        })
-      );
-      server = supertest(app);
-      agent = await authAsUser(app, "admin");
-
-      const res = await agent
-        .patch(`/food/${apple._id}/tags/healthy`)
-        .send({tags: "unhealthy"})
-        .expect(403);
-      expect(res.body.title).toBe("Update not allowed");
-    });
-
-    it("array operation preUpdate error for array DELETE is handled", async () => {
-      app.use(
-        "/food",
-        modelRouter(FoodModel, {
-          allowAnonymous: true,
-          permissions: {
-            create: [Permissions.IsAdmin],
-            delete: [Permissions.IsAdmin],
-            list: [Permissions.IsAdmin],
-            read: [Permissions.IsAdmin],
-            update: [Permissions.IsAdmin],
-          },
-          preUpdate: () => {
-            throw new Error("preUpdate error during delete");
-          },
-        })
-      );
-      server = supertest(app);
-      agent = await authAsUser(app, "admin");
-
-      const res = await agent.delete(`/food/${apple._id}/tags/healthy`).expect(400);
-      expect(res.body.title).toContain("preUpdate hook error");
-    });
-  });
-});
-
-describe("errors module", () => {
-  describe("APIError", () => {
-    it("sets default status to 500 when not provided", () => {
-      const error = new APIError({title: "Test error"});
-      expect(error.status).toBe(500);
-    });
-
-    it("sets status to 500 for invalid status codes below 400", () => {
-      const error = new APIError({status: 200, title: "Test error"});
-      expect(error.status).toBe(500);
-    });
-
-    it("sets status to 500 for invalid status codes above 599", () => {
-      const error = new APIError({status: 600, title: "Test error"});
-      expect(error.status).toBe(500);
-    });
-
-    it("includes error stack in message when error is provided", () => {
-      const originalError = new Error("Original error");
-      const apiError = new APIError({
-        error: originalError,
-        title: "Wrapped error",
-      });
-      expect(apiError.message).toContain("Wrapped error");
-      expect(originalError.stack).toBeDefined();
-      expect(apiError.message).toContain(originalError.stack as string);
-    });
-
-    it("includes detail in message when provided", () => {
-      const error = new APIError({
-        detail: "More details here",
-        title: "Test error",
-      });
-      expect(error.message).toContain("Test error");
-      expect(error.message).toContain("More details here");
-    });
-
-    it("sets fields in meta when provided", () => {
-      const error = new APIError({
-        fields: {email: "Invalid email format"},
-        title: "Validation error",
-      });
-      expect(error.meta?.fields).toEqual({email: "Invalid email format"});
-    });
-  });
-
-  describe("errorsPlugin", () => {
-    it("adds apiErrors field to schema", async () => {
-      const mongoose = await import("mongoose");
-      const {errorsPlugin} = await import("./errors");
-
-      const testSchema = new mongoose.Schema({name: String});
-      errorsPlugin(testSchema);
-
-      expect(testSchema.path("apiErrors")).toBeDefined();
-    });
-  });
-
-  describe("isAPIError", () => {
-    it("returns true for APIError instances", () => {
-      const {isAPIError} = require("./errors");
-      const error = new APIError({title: "Test"});
-      expect(isAPIError(error)).toBe(true);
-    });
-
-    it("returns false for regular Error instances", () => {
-      const {isAPIError} = require("./errors");
-      const error = new Error("Test");
-      expect(isAPIError(error)).toBe(false);
-    });
-  });
-
-  describe("getDisableExternalErrorTracking", () => {
-    it("returns undefined for non-objects", () => {
-      const {getDisableExternalErrorTracking} = require("./errors");
-      expect(getDisableExternalErrorTracking(null)).toBeUndefined();
-      expect(getDisableExternalErrorTracking("string")).toBeUndefined();
-    });
-
-    it("returns value from APIError", () => {
-      const {getDisableExternalErrorTracking} = require("./errors");
-      const error = new APIError({disableExternalErrorTracking: true, title: "Test"});
-      expect(getDisableExternalErrorTracking(error)).toBe(true);
-    });
-
-    it("returns value from plain object with property", () => {
-      const {getDisableExternalErrorTracking} = require("./errors");
-      const obj = {disableExternalErrorTracking: true};
-      expect(getDisableExternalErrorTracking(obj)).toBe(true);
-    });
-  });
-
-  describe("getAPIErrorBody", () => {
-    it("includes all non-undefined fields", () => {
-      const {getAPIErrorBody} = require("./errors");
-      const error = new APIError({
-        code: "TEST_CODE",
-        detail: "Test detail",
-        id: "error-123",
-        links: {about: "http://example.com"},
-        meta: {extra: "data"},
-        source: {parameter: "id"},
-        status: 400,
-        title: "Test error",
-      });
-      const body = getAPIErrorBody(error);
-
-      expect(body.title).toBe("Test error");
-      expect(body.status).toBe(400);
-      expect(body.code).toBe("TEST_CODE");
-      expect(body.detail).toBe("Test detail");
-      expect(body.id).toBe("error-123");
-      expect(body.links).toEqual({about: "http://example.com"});
-      expect(body.source).toEqual({parameter: "id"});
-      expect(body.meta).toEqual({extra: "data"});
-    });
-  });
-
-  describe("apiUnauthorizedMiddleware", () => {
-    it("returns 401 for Unauthorized errors", () => {
-      const {apiUnauthorizedMiddleware} = require("./errors");
-      const err = new Error("Unauthorized");
-      const res = {
-        json: function (data: any) {
-          (this as any).body = data;
-          return this;
-        },
-        send: function () {
-          return this;
-        },
-        status: function (code: number) {
-          (this as any).statusCode = code;
-          return this;
-        },
-      };
-      const next = () => {};
-
-      apiUnauthorizedMiddleware(err, {}, res, next);
-      expect((res as any).statusCode).toBe(401);
-      expect((res as any).body.title).toBe("Unauthorized");
-    });
-
-    it("calls next for non-Unauthorized errors", () => {
-      const {apiUnauthorizedMiddleware} = require("./errors");
-      const err = new Error("Some other error");
-      let nextCalled = false;
-      const next = () => {
-        nextCalled = true;
-      };
-
-      apiUnauthorizedMiddleware(err, {}, {}, next);
-      expect(nextCalled).toBe(true);
-    });
-  });
-});
-
-describe("permissions module", () => {
-  describe("OwnerQueryFilter", () => {
-    it("returns ownerId filter when user is provided", () => {
-      const {OwnerQueryFilter} = require("./permissions");
-      const user = {id: "user-123"};
-      const filter = OwnerQueryFilter(user);
-      expect(filter).toEqual({ownerId: "user-123"});
-    });
-
-    it("returns null when user is undefined", () => {
-      const {OwnerQueryFilter} = require("./permissions");
-      const filter = OwnerQueryFilter(undefined);
-      expect(filter).toBeNull();
-    });
-  });
-
-  describe("Permissions.IsAuthenticatedOrReadOnly", () => {
-    it("returns true for authenticated non-anonymous users", () => {
-      const {Permissions} = require("./permissions");
-      const user = {id: "user-123", isAnonymous: false};
-      expect(Permissions.IsAuthenticatedOrReadOnly("create", user)).toBe(true);
-    });
-
-    it("returns true for read methods when user is anonymous", () => {
-      const {Permissions} = require("./permissions");
-      const user = {id: "user-123", isAnonymous: true};
-      expect(Permissions.IsAuthenticatedOrReadOnly("list", user)).toBe(true);
-      expect(Permissions.IsAuthenticatedOrReadOnly("read", user)).toBe(true);
-    });
-
-    it("returns false for write methods when user is anonymous", () => {
-      const {Permissions} = require("./permissions");
-      const user = {id: "user-123", isAnonymous: true};
-      expect(Permissions.IsAuthenticatedOrReadOnly("create", user)).toBe(false);
-      expect(Permissions.IsAuthenticatedOrReadOnly("update", user)).toBe(false);
-      expect(Permissions.IsAuthenticatedOrReadOnly("delete", user)).toBe(false);
-    });
-  });
-
-  describe("Permissions.IsOwnerOrReadOnly", () => {
-    it("returns true when no object is provided", () => {
-      const {Permissions} = require("./permissions");
-      expect(Permissions.IsOwnerOrReadOnly("update", {id: "user-123"}, undefined)).toBe(true);
-    });
-
-    it("returns true for admin users", () => {
-      const {Permissions} = require("./permissions");
-      const user = {admin: true, id: "admin-123"};
-      const obj = {ownerId: "other-user"};
-      expect(Permissions.IsOwnerOrReadOnly("update", user, obj)).toBe(true);
-    });
-
-    it("returns true when user is owner", () => {
-      const {Permissions} = require("./permissions");
-      const user = {id: "user-123"};
-      const obj = {ownerId: "user-123"};
-      expect(Permissions.IsOwnerOrReadOnly("update", user, obj)).toBe(true);
-    });
-
-    it("returns true for read methods when not owner", () => {
-      const {Permissions} = require("./permissions");
-      const user = {id: "user-123"};
-      const obj = {ownerId: "other-user"};
-      expect(Permissions.IsOwnerOrReadOnly("list", user, obj)).toBe(true);
-      expect(Permissions.IsOwnerOrReadOnly("read", user, obj)).toBe(true);
-    });
-
-    it("returns false for write methods when not owner", () => {
-      const {Permissions} = require("./permissions");
-      const user = {id: "user-123"};
-      const obj = {ownerId: "other-user"};
-      expect(Permissions.IsOwnerOrReadOnly("update", user, obj)).toBe(false);
-      expect(Permissions.IsOwnerOrReadOnly("delete", user, obj)).toBe(false);
-    });
-  });
-});
-
-describe("utils module", () => {
-  describe("isValidObjectId", () => {
-    it("returns true for valid ObjectId strings", () => {
-      const {isValidObjectId} = require("./utils");
-      expect(isValidObjectId("507f1f77bcf86cd799439011")).toBe(true);
-    });
-
-    it("returns false for invalid ObjectId strings", () => {
-      const {isValidObjectId} = require("./utils");
-      expect(isValidObjectId("invalid-id")).toBe(false);
-      expect(isValidObjectId("12345")).toBe(false);
-      expect(isValidObjectId("")).toBe(false);
-    });
-
-    it("returns false for 12-character strings that are not valid ObjectIds", () => {
-      const {isValidObjectId} = require("./utils");
-      // mongoose's native isValid returns true for any 12-char string
-      // but our implementation should return false since toString won't match
-      expect(isValidObjectId("123456789012")).toBe(false);
-    });
-  });
-
-  describe("timeout", () => {
-    it("resolves after specified time", async () => {
-      const {timeout} = require("./utils");
-      const start = Date.now();
-      await timeout(50);
-      const elapsed = Date.now() - start;
-      expect(elapsed).toBeGreaterThanOrEqual(40);
-    });
-  });
-
-  // Note: Comprehensive checkModelsStrict tests are in utils.test.ts with mocked mongoose
-});
-
-describe("populate module", () => {
-  describe("unpopulate", () => {
-    it("throws error when path is empty", async () => {
-      const {unpopulate} = await import("./populate");
-      const doc = {name: "test"};
-      expect(() => unpopulate(doc as any, "")).toThrow("path is required");
-    });
-
-    it("unpopulates single populated field", async () => {
-      const {unpopulate} = await import("./populate");
-      const doc = {
-        name: "test",
-        ownerId: {_id: "owner-123", email: "owner@test.com"},
-      };
-      const result = unpopulate(doc as any, "ownerId") as any;
-      expect(result.ownerId).toBe("owner-123");
-    });
-
-    it("unpopulates array of populated fields", async () => {
-      const {unpopulate} = await import("./populate");
-      const doc = {
-        items: [{_id: "item-1", name: "Item 1"}, {_id: "item-2", name: "Item 2"}, "item-3"],
-        name: "test",
-      };
-      const result = unpopulate(doc as any, "items") as any;
-      expect(result.items).toEqual(["item-1", "item-2", "item-3"]);
-    });
-
-    it("handles nested paths", async () => {
-      const {unpopulate} = await import("./populate");
-      const doc = {
-        name: "test",
-        nested: {
-          items: [
-            {_id: "item-1", name: "Item 1"},
-            {_id: "item-2", name: "Item 2"},
-          ],
-        },
-      };
-      const result = unpopulate(doc as any, "nested.items") as any;
-      expect(result.nested.items).toEqual(["item-1", "item-2"]);
-    });
-
-    it("returns original doc when path does not exist", async () => {
-      const {unpopulate} = await import("./populate");
-      const doc = {name: "test"};
-      const result = unpopulate(doc as any, "nonexistent") as any;
-      expect(result).toEqual(doc);
-    });
-
-    it("handles nested array paths", async () => {
-      const {unpopulate} = await import("./populate");
-      const doc = {
-        containers: [
-          {items: [{_id: "item-1"}, {_id: "item-2"}]},
-          {items: [{_id: "item-3"}, {_id: "item-4"}]},
-        ],
-        name: "test",
-      };
-      const result = unpopulate(doc as any, "containers.items") as any;
-      expect(result.containers[0].items).toEqual(["item-1", "item-2"]);
-      expect(result.containers[1].items).toEqual(["item-3", "item-4"]);
-    });
-  });
-});
-
-describe("auth module edge cases", () => {
-  describe("generateTokens", () => {
-    it("returns null tokens when user is missing", async () => {
-      const {generateTokens} = await import("./auth");
-      const result = await generateTokens(null);
-      expect(result.token).toBeNull();
-      expect(result.refreshToken).toBeNull();
-    });
-
-    it("returns null tokens when user has no _id", async () => {
-      const {generateTokens} = await import("./auth");
-      const result = await generateTokens({email: "test@test.com"});
-      expect(result.token).toBeNull();
-      expect(result.refreshToken).toBeNull();
-    });
-
-    it("includes custom payload from generateJWTPayload option", async () => {
-      const {generateTokens} = await import("./auth");
-      const jwt = await import("jsonwebtoken");
-
-      const user = {_id: "user-123"};
-      const result = await generateTokens(user, {
-        generateJWTPayload: (u) => ({customField: "customValue", userId: u._id}),
-      });
-
-      expect(result.token).toBeDefined();
-      const decoded = jwt.decode(result.token as string) as any;
-      expect(decoded.customField).toBe("customValue");
-      expect(decoded.id).toBe("user-123");
-    });
-
-    it("uses custom token expiration from generateTokenExpiration option", async () => {
-      const {generateTokens} = await import("./auth");
-      const jwt = await import("jsonwebtoken");
-
-      const user = {_id: "user-123"};
-      const result = await generateTokens(user, {
-        generateTokenExpiration: () => "1h",
-      });
-
-      expect(result.token).toBeDefined();
-      const decoded = jwt.decode(result.token as string) as any;
-      // Check that exp is roughly 1 hour from now (within 5 seconds tolerance)
-      const expectedExp = Math.floor(Date.now() / 1000) + 3600;
-      expect(decoded.exp).toBeGreaterThan(expectedExp - 5);
-      expect(decoded.exp).toBeLessThan(expectedExp + 5);
-    });
-
-    it("uses custom refresh token expiration from generateRefreshTokenExpiration option", async () => {
-      const {generateTokens} = await import("./auth");
-      const jwt = await import("jsonwebtoken");
-
-      const user = {_id: "user-123"};
-      const result = await generateTokens(user, {
-        generateRefreshTokenExpiration: () => "7d",
-      });
-
-      expect(result.refreshToken).toBeDefined();
-      const decoded = jwt.decode(result.refreshToken as string) as any;
-      // Check that exp is roughly 7 days from now
-      const expectedExp = Math.floor(Date.now() / 1000) + 7 * 24 * 3600;
-      expect(decoded.exp).toBeGreaterThan(expectedExp - 10);
-      expect(decoded.exp).toBeLessThan(expectedExp + 10);
-    });
-  });
 });