@terreno/api 0.0.11-beta.1 → 0.0.12

package/dist/api.query.test.js

@@ -0,0 +1,805 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, generator) {
+    function adopt(value) { return value instanceof P ? value : new P(function (resolve) { resolve(value); }); }
+    return new (P || (P = Promise))(function (resolve, reject) {
+        function fulfilled(value) { try { step(generator.next(value)); } catch (e) { reject(e); } }
+        function rejected(value) { try { step(generator["throw"](value)); } catch (e) { reject(e); } }
+        function step(result) { result.done ? resolve(result.value) : adopt(result.value).then(fulfilled, rejected); }
+        step((generator = generator.apply(thisArg, _arguments || [])).next());
+    });
+};
+var __generator = (this && this.__generator) || function (thisArg, body) {
+    var _ = { label: 0, sent: function() { if (t[0] & 1) throw t[1]; return t[1]; }, trys: [], ops: [] }, f, y, t, g = Object.create((typeof Iterator === "function" ? Iterator : Object).prototype);
+    return g.next = verb(0), g["throw"] = verb(1), g["return"] = verb(2), typeof Symbol === "function" && (g[Symbol.iterator] = function() { return this; }), g;
+    function verb(n) { return function (v) { return step([n, v]); }; }
+    function step(op) {
+        if (f) throw new TypeError("Generator is already executing.");
+        while (g && (g = 0, op[0] && (_ = 0)), _) try {
+            if (f = 1, y && (t = op[0] & 2 ? y["return"] : op[0] ? y["throw"] || ((t = y["return"]) && t.call(y), 0) : y.next) && !(t = t.call(y, op[1])).done) return t;
+            if (y = 0, t) op = [op[0] & 2, t.value];
+            switch (op[0]) {
+                case 0: case 1: t = op; break;
+                case 4: _.label++; return { value: op[1], done: false };
+                case 5: _.label++; y = op[1]; op = [0]; continue;
+                case 7: op = _.ops.pop(); _.trys.pop(); continue;
+                default:
+                    if (!(t = _.trys, t = t.length > 0 && t[t.length - 1]) && (op[0] === 6 || op[0] === 2)) { _ = 0; continue; }
+                    if (op[0] === 3 && (!t || (op[1] > t[0] && op[1] < t[3]))) { _.label = op[1]; break; }
+                    if (op[0] === 6 && _.label < t[1]) { _.label = t[1]; t = op; break; }
+                    if (t && _.label < t[2]) { _.label = t[2]; _.ops.push(op); break; }
+                    if (t[2]) _.ops.pop();
+                    _.trys.pop(); continue;
+            }
+            op = body.call(thisArg, _);
+        } catch (e) { op = [6, e]; y = 0; } finally { f = t = 0; }
+        if (op[0] & 5) throw op[1]; return { value: op[0] ? op[1] : void 0, done: true };
+    }
+};
+var __read = (this && this.__read) || function (o, n) {
+    var m = typeof Symbol === "function" && o[Symbol.iterator];
+    if (!m) return o;
+    var i = m.call(o), r, ar = [], e;
+    try {
+        while ((n === void 0 || n-- > 0) && !(r = i.next()).done) ar.push(r.value);
+    }
+    catch (error) { e = { error: error }; }
+    finally {
+        try {
+            if (r && !r.done && (m = i["return"])) m.call(i);
+        }
+        finally { if (e) throw e.error; }
+    }
+    return ar;
+};
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+var bun_test_1 = require("bun:test");
+var Sentry = __importStar(require("@sentry/node"));
+var qs_1 = __importDefault(require("qs"));
+var supertest_1 = __importDefault(require("supertest"));
+var api_1 = require("./api");
+var auth_1 = require("./auth");
+var expressServer_1 = require("./expressServer");
+var permissions_1 = require("./permissions");
+var tests_1 = require("./tests");
+(0, bun_test_1.describe)("query and list methods", function () {
+    var server;
+    var app;
+    var notAdmin;
+    var admin;
+    var adminOther;
+    var agent;
+    var spinach;
+    var apple;
+    var carrots;
+    var pizza;
+    (0, bun_test_1.beforeEach)(function () { return __awaiter(void 0, void 0, void 0, function () {
+        var results;
+        var _a, _b;
+        return __generator(this, function (_c) {
+            switch (_c.label) {
+                case 0: return [4 /*yield*/, (0, tests_1.setupDb)()];
+                case 1:
+                    _a = __read.apply(void 0, [_c.sent(), 3]), admin = _a[0], notAdmin = _a[1], adminOther = _a[2];
+                    return [4 /*yield*/, Promise.all([
+                            tests_1.FoodModel.create({
+                                calories: 1,
+                                created: new Date("2021-12-03T00:00:20.000Z"),
+                                eatenBy: [admin._id],
+                                hidden: false,
+                                lastEatenWith: {
+                                    dressing: new Date("2021-12-03T19:00:30.000Z"),
+                                },
+                                name: "Spinach",
+                                ownerId: notAdmin._id,
+                                source: {
+                                    dateAdded: "2023-12-13T12:30:00.000Z",
+                                    href: "https://www.google.com",
+                                    name: "Brand",
+                                },
+                            }),
+                            tests_1.FoodModel.create({
+                                calories: 100,
+                                created: new Date("2021-12-03T00:00:30.000Z"),
+                                hidden: true,
+                                name: "Apple",
+                                ownerId: admin._id,
+                                tags: ["healthy"],
+                            }),
+                            tests_1.FoodModel.create({
+                                calories: 100,
+                                created: new Date("2021-12-03T00:00:00.000Z"),
+                                eatenBy: [admin._id, notAdmin._id],
+                                hidden: false,
+                                name: "Carrots",
+                                ownerId: admin._id,
+                                source: {
+                                    name: "USDA",
+                                },
+                                tags: ["healthy", "cheap"],
+                            }),
+                            tests_1.FoodModel.create({
+                                calories: 400,
+                                created: new Date("2021-12-03T00:00:10.000Z"),
+                                eatenBy: [adminOther._id],
+                                hidden: false,
+                                name: "Pizza",
+                                ownerId: admin._id,
+                                tags: ["cheap"],
+                            }),
+                        ])];
+                case 2:
+                    results = (_c.sent());
+                    _b = __read(results, 4), spinach = _b[0], apple = _b[1], carrots = _b[2], pizza = _b[3];
+                    app = (0, tests_1.getBaseServer)();
+                    (0, auth_1.setupAuth)(app, tests_1.UserModel);
+                    (0, auth_1.addAuthRoutes)(app, tests_1.UserModel);
+                    app.use(expressServer_1.logRequests);
+                    app.use("/food", (0, api_1.modelRouter)(tests_1.FoodModel, {
+                        allowAnonymous: true,
+                        defaultLimit: 2,
+                        defaultQueryParams: { hidden: false },
+                        maxLimit: 3,
+                        permissions: {
+                            create: [permissions_1.Permissions.IsAuthenticated],
+                            delete: [permissions_1.Permissions.IsAdmin],
+                            list: [permissions_1.Permissions.IsAny],
+                            read: [permissions_1.Permissions.IsAny],
+                            update: [permissions_1.Permissions.IsOwner],
+                        },
+                        populatePaths: [{ path: "ownerId" }],
+                        queryFields: ["hidden", "name", "calories", "created", "source.name", "tags", "eatenBy"],
+                        sort: { created: "descending" },
+                    }));
+                    server = (0, supertest_1.default)(app);
+                    return [4 /*yield*/, (0, tests_1.authAsUser)(app, "notAdmin")];
+                case 3:
+                    agent = _c.sent();
+                    return [2 /*return*/];
+            }
+        });
+    }); });
+    (0, bun_test_1.it)("read default", function () { return __awaiter(void 0, void 0, void 0, function () {
+        var res;
+        return __generator(this, function (_a) {
+            switch (_a.label) {
+                case 0: return [4 /*yield*/, agent.get("/food/".concat(spinach._id)).expect(200)];
+                case 1:
+                    res = _a.sent();
+                    (0, bun_test_1.expect)(res.body.data._id).toBe(spinach._id.toString());
+                    (0, bun_test_1.expect)(res.body.data.ownerId._id).toBe(notAdmin.id);
+                    (0, bun_test_1.expect)(res.body.data.lastEatenWith).toEqual({
+                        dressing: "2021-12-03T19:00:30.000Z",
+                    });
+                    return [2 /*return*/];
+            }
+        });
+    }); });
+    (0, bun_test_1.it)("list default", function () { return __awaiter(void 0, void 0, void 0, function () {
+        var res;
+        return __generator(this, function (_a) {
+            switch (_a.label) {
+                case 0: return [4 /*yield*/, agent.get("/food").expect(200)];
+                case 1:
+                    res = _a.sent();
+                    (0, bun_test_1.expect)(res.body.data).toHaveLength(2);
+                    (0, bun_test_1.expect)(res.body.data[0].id).toBe(spinach.id);
+                    (0, bun_test_1.expect)(res.body.data[0].ownerId._id).toBe(notAdmin.id);
+                    (0, bun_test_1.expect)(res.body.data[1].id).toBe(pizza.id);
+                    (0, bun_test_1.expect)(res.body.data[1].ownerId._id).toBe(admin.id);
+                    (0, bun_test_1.expect)(res.body.data[0].lastEatenWith).toEqual({
+                        dressing: "2021-12-03T19:00:30.000Z",
+                    });
+                    (0, bun_test_1.expect)(res.body.data[1].lastEatenWith).toEqual(undefined);
+                    (0, bun_test_1.expect)(res.body.more).toBe(true);
+                    (0, bun_test_1.expect)(res.body.total).toBe(3);
+                    return [2 /*return*/];
+            }
+        });
+    }); });
+    (0, bun_test_1.it)("list limit", function () { return __awaiter(void 0, void 0, void 0, function () {
+        var res;
+        return __generator(this, function (_a) {
+            switch (_a.label) {
+                case 0: return [4 /*yield*/, agent.get("/food?limit=1").expect(200)];
+                case 1:
+                    res = _a.sent();
+                    (0, bun_test_1.expect)(res.body.data).toHaveLength(1);
+                    (0, bun_test_1.expect)(res.body.data[0].id).toBe(spinach.id);
+                    (0, bun_test_1.expect)(res.body.data[0].ownerId._id).toBe(notAdmin.id);
+                    (0, bun_test_1.expect)(res.body.more).toBe(true);
+                    (0, bun_test_1.expect)(res.body.total).toBe(3);
+                    return [2 /*return*/];
+            }
+        });
+    }); });
+    (0, bun_test_1.it)("list limit over", function () { return __awaiter(void 0, void 0, void 0, function () {
+        var res;
+        return __generator(this, function (_a) {
+            switch (_a.label) {
+                case 0: return [4 /*yield*/, tests_1.FoodModel.create({
+                        calories: 400,
+                        created: new Date("2021-12-02T00:00:10.000Z"),
+                        hidden: false,
+                        name: "Pizza",
+                        ownerId: admin._id,
+                    })];
+                case 1:
+                    _a.sent();
+                    return [4 /*yield*/, agent.get("/food?limit=4").expect(200)];
+                case 2:
+                    res = _a.sent();
+                    (0, bun_test_1.expect)(res.body.data).toHaveLength(3);
+                    (0, bun_test_1.expect)(res.body.more).toBe(true);
+                    (0, bun_test_1.expect)(res.body.total).toBe(4);
+                    (0, bun_test_1.expect)(res.body.data[0].id).toBe(spinach.id);
+                    (0, bun_test_1.expect)(res.body.data[1].id).toBe(pizza.id);
+                    (0, bun_test_1.expect)(res.body.data[2].id).toBe(carrots.id);
+                    (0, bun_test_1.expect)(Sentry.captureMessage).toHaveBeenCalledWith('More than 3 results returned for foods without pagination, data may be silently truncated. req.query: {"limit":"4"}');
+                    return [2 /*return*/];
+            }
+        });
+    }); });
+    (0, bun_test_1.it)("list page", function () { return __awaiter(void 0, void 0, void 0, function () {
+        var res;
+        return __generator(this, function (_a) {
+            switch (_a.label) {
+                case 0: return [4 /*yield*/, agent.get("/food?limit=1&page=2").expect(200)];
+                case 1:
+                    res = _a.sent();
+                    (0, bun_test_1.expect)(res.body.data).toHaveLength(1);
+                    (0, bun_test_1.expect)(res.body.more).toBe(true);
+                    (0, bun_test_1.expect)(res.body.total).toBe(3);
+                    (0, bun_test_1.expect)(res.body.data[0].id).toBe(pizza.id);
+                    return [2 /*return*/];
+            }
+        });
+    }); });
+    (0, bun_test_1.it)("list page 0 ", function () { return __awaiter(void 0, void 0, void 0, function () {
+        var res;
+        return __generator(this, function (_a) {
+            switch (_a.label) {
+                case 0: return [4 /*yield*/, agent.get("/food?limit=1&page=0").expect(400)];
+                case 1:
+                    res = _a.sent();
+                    (0, bun_test_1.expect)(res.body.title).toBe("Invalid page: 0");
+                    return [2 /*return*/];
+            }
+        });
+    }); });
+    (0, bun_test_1.it)("list page with garbage ", function () { return __awaiter(void 0, void 0, void 0, function () {
+        var res;
+        return __generator(this, function (_a) {
+            switch (_a.label) {
+                case 0: return [4 /*yield*/, agent.get("/food?limit=1&page=abc").expect(400)];
+                case 1:
+                    res = _a.sent();
+                    (0, bun_test_1.expect)(res.body.title).toBe("Invalid page: abc");
+                    return [2 /*return*/];
+            }
+        });
+    }); });
+    (0, bun_test_1.it)("list page over", function () { return __awaiter(void 0, void 0, void 0, function () {
+        var res;
+        return __generator(this, function (_a) {
+            switch (_a.label) {
+                case 0: return [4 /*yield*/, agent.get("/food?limit=1&page=5").expect(200)];
+                case 1:
+                    res = _a.sent();
+                    (0, bun_test_1.expect)(res.body.data).toHaveLength(0);
+                    (0, bun_test_1.expect)(res.body.more).toBe(false);
+                    (0, bun_test_1.expect)(res.body.total).toBe(3);
+                    return [2 /*return*/];
+            }
+        });
+    }); });
+    (0, bun_test_1.it)("list query params", function () { return __awaiter(void 0, void 0, void 0, function () {
+        var res;
+        return __generator(this, function (_a) {
+            switch (_a.label) {
+                case 0: return [4 /*yield*/, agent.get("/food?hidden=true").expect(200)];
+                case 1:
+                    res = _a.sent();
+                    (0, bun_test_1.expect)(res.body.data).toHaveLength(1);
+                    (0, bun_test_1.expect)(res.body.more).toBe(false);
+                    (0, bun_test_1.expect)(res.body.total).toBe(1);
+                    (0, bun_test_1.expect)(res.body.data[0].id).toBe(apple.id);
+                    return [2 /*return*/];
+            }
+        });
+    }); });
+    (0, bun_test_1.it)("list query params not in list", function () { return __awaiter(void 0, void 0, void 0, function () {
+        var res;
+        return __generator(this, function (_a) {
+            switch (_a.label) {
+                case 0: return [4 /*yield*/, agent.get("/food?ownerId=".concat(admin._id)).expect(400)];
+                case 1:
+                    res = _a.sent();
+                    (0, bun_test_1.expect)(res.body.title).toBe("ownerId is not allowed as a query param.");
+                    return [2 /*return*/];
+            }
+        });
+    }); });
+    (0, bun_test_1.it)("list query by nested param", function () { return __awaiter(void 0, void 0, void 0, function () {
+        var res;
+        return __generator(this, function (_a) {
+            switch (_a.label) {
+                case 0: return [4 /*yield*/, agent.get("/food?source.name=USDA").expect(200)];
+                case 1:
+                    res = _a.sent();
+                    (0, bun_test_1.expect)(res.body.data).toHaveLength(1);
+                    (0, bun_test_1.expect)(res.body.total).toBe(1);
+                    (0, bun_test_1.expect)(res.body.data[0].id).toBe(carrots.id);
+                    return [2 /*return*/];
+            }
+        });
+    }); });
+    (0, bun_test_1.it)("query by date", function () { return __awaiter(void 0, void 0, void 0, function () {
+        var authRes, token, res, createdDates;
+        return __generator(this, function (_a) {
+            switch (_a.label) {
+                case 0: return [4 /*yield*/, server
+                        .post("/auth/login")
+                        .send({ email: "admin@example.com", password: "securePassword" })
+                        .expect(200)];
+                case 1:
+                    authRes = _a.sent();
+                    token = authRes.body.data.token;
+                    return [4 /*yield*/, server
+                            .get("/food?limit=3&".concat(qs_1.default.stringify({
+                            created: {
+                                $gte: "2021-12-03T00:00:00.000Z",
+                                $lte: "2021-12-03T00:00:20.000Z",
+                            },
+                        })))
+                            .set("authorization", "Bearer ".concat(token))
+                            .expect(200)];
+                case 2:
+                    res = _a.sent();
+                    (0, bun_test_1.expect)(res.body.data.map(function (d) { return d.created; })).toEqual(bun_test_1.expect.arrayContaining([
+                        "2021-12-03T00:00:20.000Z",
+                        "2021-12-03T00:00:10.000Z",
+                        "2021-12-03T00:00:00.000Z",
+                    ]));
+                    (0, bun_test_1.expect)(res.body.data.map(function (d) { return d.created; })).toHaveLength(3);
+                    return [4 /*yield*/, server
+                            .get("/food?limit=3&".concat(qs_1.default.stringify({
+                            created: {
+                                $gte: "2021-12-03T00:00:00.000Z",
+                                $lt: "2021-12-03T00:00:20.000Z",
+                            },
+                        })))
+                            .set("authorization", "Bearer ".concat(token))
+                            .expect(200)];
+                case 3:
+                    res = _a.sent();
+                    (0, bun_test_1.expect)(res.body.data.map(function (d) { return d.created; })).toEqual(bun_test_1.expect.arrayContaining(["2021-12-03T00:00:10.000Z", "2021-12-03T00:00:00.000Z"]));
+                    (0, bun_test_1.expect)(res.body.data.map(function (d) { return d.created; })).toHaveLength(2);
+                    return [4 /*yield*/, server
+                            .get("/food?limit=3&".concat(qs_1.default.stringify({
+                            created: {
+                                $gt: "2021-12-03T00:00:00.000Z",
+                                $lt: "2021-12-03T00:00:20.000Z",
+                            },
+                        })))
+                            .set("authorization", "Bearer ".concat(token))
+                            .expect(200)];
+                case 4:
+                    res = _a.sent();
+                    createdDates = res.body.data.map(function (d) { return d.created; });
+                    (0, bun_test_1.expect)(createdDates).toEqual(bun_test_1.expect.arrayContaining(["2021-12-03T00:00:10.000Z"]));
+                    (0, bun_test_1.expect)(createdDates).toHaveLength(1);
+                    return [2 /*return*/];
+            }
+        });
+    }); });
+    (0, bun_test_1.it)("query with a space", function () { return __awaiter(void 0, void 0, void 0, function () {
+        var greenBeans, res;
+        return __generator(this, function (_a) {
+            switch (_a.label) {
+                case 0: return [4 /*yield*/, tests_1.FoodModel.create({
+                        calories: 102,
+                        created: Date.now() - 10,
+                        name: "Green Beans",
+                        ownerId: admin === null || admin === void 0 ? void 0 : admin._id,
+                    })];
+                case 1:
+                    greenBeans = _a.sent();
+                    return [4 /*yield*/, agent.get("/food?".concat(qs_1.default.stringify({ name: "Green Beans" }))).expect(200)];
+                case 2:
+                    res = _a.sent();
+                    (0, bun_test_1.expect)(res.body.data).toHaveLength(1);
+                    (0, bun_test_1.expect)(res.body.data[0].id).toBe(greenBeans === null || greenBeans === void 0 ? void 0 : greenBeans.id);
+                    (0, bun_test_1.expect)(res.body.data[0].name).toBe("Green Beans");
+                    return [2 /*return*/];
+            }
+        });
+    }); });
+    (0, bun_test_1.it)("query with a regex", function () { return __awaiter(void 0, void 0, void 0, function () {
+        var greenBeans, res;
+        return __generator(this, function (_a) {
+            switch (_a.label) {
+                case 0: return [4 /*yield*/, tests_1.FoodModel.create({
+                        calories: 102,
+                        created: Date.now() - 10,
+                        name: "Green Beans",
+                        ownerId: admin === null || admin === void 0 ? void 0 : admin._id,
+                    })];
+                case 1:
+                    greenBeans = _a.sent();
+                    return [4 /*yield*/, agent.get("/food?".concat(qs_1.default.stringify({ name: { $regex: "Green" } }))).expect(200)];
+                case 2:
+                    res = _a.sent();
+                    (0, bun_test_1.expect)(res.body.data).toHaveLength(1);
+                    (0, bun_test_1.expect)(res.body.data[0].id).toBe(greenBeans === null || greenBeans === void 0 ? void 0 : greenBeans.id);
+                    (0, bun_test_1.expect)(res.body.data[0].name).toBe("Green Beans");
+                    return [4 /*yield*/, agent.get("/food?".concat(qs_1.default.stringify({ name: { $regex: "green" } }))).expect(200)];
+                case 3:
+                    res = _a.sent();
+                    (0, bun_test_1.expect)(res.body.data).toHaveLength(0);
+                    return [4 /*yield*/, agent
+                            .get("/food?".concat(qs_1.default.stringify({ name: { $options: "i", $regex: "green" } })))
+                            .expect(200)];
+                case 4:
+                    res = _a.sent();
+                    (0, bun_test_1.expect)(res.body.data).toHaveLength(1);
+                    (0, bun_test_1.expect)(res.body.data[0].id).toBe(greenBeans === null || greenBeans === void 0 ? void 0 : greenBeans.id);
+                    return [2 /*return*/];
+            }
+        });
+    }); });
+    (0, bun_test_1.it)("query with an $in operator", function () { return __awaiter(void 0, void 0, void 0, function () {
+        var res, names1, names2;
+        return __generator(this, function (_a) {
+            switch (_a.label) {
+                case 0: return [4 /*yield*/, server
+                        .get("/food?".concat(qs_1.default.stringify({
+                        name: {
+                            $in: ["Apple", "Spinach"],
+                        },
+                    })))
+                        .expect(200)];
+                case 1:
+                    res = _a.sent();
+                    names1 = res.body.data.map(function (d) { return d.name; });
+                    (0, bun_test_1.expect)(names1).toEqual(bun_test_1.expect.arrayContaining(["Spinach"]));
+                    (0, bun_test_1.expect)(names1).toHaveLength(1);
+                    return [4 /*yield*/, server
+                            .get("/food?".concat(qs_1.default.stringify({
+                            name: {
+                                $in: ["Carrots", "Spinach"],
+                            },
+                        })))
+                            .expect(200)];
+                case 2:
+                    res = _a.sent();
+                    names2 = res.body.data.map(function (d) { return d.name; });
+                    (0, bun_test_1.expect)(names2).toEqual(bun_test_1.expect.arrayContaining(["Spinach", "Carrots"]));
+                    (0, bun_test_1.expect)(names2).toHaveLength(2);
+                    return [2 /*return*/];
+            }
+        });
+    }); });
+    (0, bun_test_1.it)("query with an $in for _ids in nested object", function () { return __awaiter(void 0, void 0, void 0, function () {
+        var res, names3;
+        return __generator(this, function (_a) {
+            switch (_a.label) {
+                case 0: return [4 /*yield*/, server
+                        .get("/food?".concat(qs_1.default.stringify({
+                        eatenBy: {
+                            $in: [notAdmin._id.toString(), adminOther._id.toString()],
+                        },
+                    })))
+                        .expect(200)];
+                case 1:
+                    res = _a.sent();
+                    (0, bun_test_1.expect)(res.body.more).toBe(false);
+                    (0, bun_test_1.expect)(res.body.total).toBe(2);
+                    (0, bun_test_1.expect)(res.body.data).toHaveLength(2);
+                    names3 = res.body.data.map(function (d) { return d.name; });
+                    (0, bun_test_1.expect)(names3).toEqual(bun_test_1.expect.arrayContaining(["Carrots", "Pizza"]));
+                    (0, bun_test_1.expect)(names3).toHaveLength(2);
+                    return [2 /*return*/];
+            }
+        });
+    }); });
+    (0, bun_test_1.it)("query $and operator on same field", function () { return __awaiter(void 0, void 0, void 0, function () {
+        var res;
+        return __generator(this, function (_a) {
+            switch (_a.label) {
+                case 0: return [4 /*yield*/, agent
+                        .get("/food?".concat(qs_1.default.stringify({ $and: [{ tags: "healthy" }, { tags: "cheap" }] })))
+                        .expect(200)];
+                case 1:
+                    res = _a.sent();
+                    (0, bun_test_1.expect)(res.body.data).toHaveLength(1);
+                    (0, bun_test_1.expect)(res.body.data[0].id).toBe(carrots === null || carrots === void 0 ? void 0 : carrots._id.toString());
+                    return [2 /*return*/];
+            }
+        });
+    }); });
+    (0, bun_test_1.it)("query $and operator on same field, nested objects", function () { return __awaiter(void 0, void 0, void 0, function () {
+        var res;
+        return __generator(this, function (_a) {
+            switch (_a.label) {
+                case 0: return [4 /*yield*/, agent
+                        .get("/food?".concat(qs_1.default.stringify({
+                        $and: [{ eatenBy: admin.id }, { eatenBy: notAdmin.id }],
+                    })))
+                        .expect(200)];
+                case 1:
+                    res = _a.sent();
+                    (0, bun_test_1.expect)(res.body.data).toHaveLength(1);
+                    (0, bun_test_1.expect)(res.body.data[0].id).toBe(carrots === null || carrots === void 0 ? void 0 : carrots._id.toString());
+                    return [2 /*return*/];
+            }
+        });
+    }); });
+    (0, bun_test_1.it)("query $or operator on same field", function () { return __awaiter(void 0, void 0, void 0, function () {
+        var res, ids1;
+        return __generator(this, function (_a) {
+            switch (_a.label) {
+                case 0: return [4 /*yield*/, agent
+                        .get("/food?".concat(qs_1.default.stringify({ $or: [{ name: "Carrots" }, { name: "Pizza" }] })))
+                        .expect(200)];
+                case 1:
+                    res = _a.sent();
+                    (0, bun_test_1.expect)(res.body.data).toHaveLength(2);
+                    ids1 = res.body.data.map(function (d) { return d.id; });
+                    (0, bun_test_1.expect)(ids1).toEqual(bun_test_1.expect.arrayContaining([carrots === null || carrots === void 0 ? void 0 : carrots._id.toString(), pizza === null || pizza === void 0 ? void 0 : pizza._id.toString()]));
+                    (0, bun_test_1.expect)(ids1).toHaveLength(2);
+                    return [2 /*return*/];
+            }
+        });
+    }); });
+    (0, bun_test_1.it)("query $and operator on same field, nested objects for $or", function () { return __awaiter(void 0, void 0, void 0, function () {
+        var res, ids2;
+        return __generator(this, function (_a) {
+            switch (_a.label) {
+                case 0: return [4 /*yield*/, agent
+                        .get("/food?".concat(qs_1.default.stringify({
+                        $or: [{ eatenBy: admin.id }, { eatenBy: notAdmin.id }],
+                        limit: 3,
+                    })))
+                        .expect(200)];
+                case 1:
+                    res = _a.sent();
+                    (0, bun_test_1.expect)(res.body.data).toHaveLength(2);
+                    ids2 = res.body.data.map(function (d) { return d.id; });
+                    (0, bun_test_1.expect)(ids2).toEqual(bun_test_1.expect.arrayContaining([carrots === null || carrots === void 0 ? void 0 : carrots._id.toString(), spinach === null || spinach === void 0 ? void 0 : spinach._id.toString()]));
+                    (0, bun_test_1.expect)(ids2).toHaveLength(2);
+                    return [2 /*return*/];
+            }
+        });
+    }); });
+    (0, bun_test_1.it)("query $and and $or are rejected if field is not in queryFields", function () { return __awaiter(void 0, void 0, void 0, function () {
+        var res;
+        return __generator(this, function (_a) {
+            switch (_a.label) {
+                case 0: return [4 /*yield*/, agent
+                        .get("/food?".concat(qs_1.default.stringify({ $and: [{ ownerId: "healthy" }, { tags: "cheap" }] })))
+                        .expect(400)];
+                case 1:
+                    res = _a.sent();
+                    (0, bun_test_1.expect)(res.body.title).toBe("ownerId is not allowed as a query param.");
+                    return [4 /*yield*/, agent
+                            .get("/food?".concat(qs_1.default.stringify({ $and: [{ tags: "cheap" }, { ownerId: "healthy" }] })))
+                            .expect(400)];
+                case 2:
+                    res = _a.sent();
+                    (0, bun_test_1.expect)(res.body.title).toBe("ownerId is not allowed as a query param.");
+                    return [4 /*yield*/, agent
+                            .get("/food?".concat(qs_1.default.stringify({ $or: [{ tags: "cheap" }, { ownerId: "healthy" }] })))
+                            .expect(400)];
+                case 3:
+                    res = _a.sent();
+                    (0, bun_test_1.expect)(res.body.title).toBe("ownerId is not allowed as a query param.");
+                    return [2 /*return*/];
+            }
+        });
+    }); });
+    (0, bun_test_1.it)("query with a number", function () { return __awaiter(void 0, void 0, void 0, function () {
+        var res;
+        return __generator(this, function (_a) {
+            switch (_a.label) {
+                case 0: return [4 /*yield*/, agent.get("/food?calories=100").expect(200)];
+                case 1:
+                    res = _a.sent();
+                    (0, bun_test_1.expect)(res.body.data).toHaveLength(1);
+                    (0, bun_test_1.expect)(res.body.data[0].id).toBe(carrots === null || carrots === void 0 ? void 0 : carrots._id.toString());
+                    return [2 /*return*/];
+            }
+        });
+    }); });
+    (0, bun_test_1.it)("update", function () { return __awaiter(void 0, void 0, void 0, function () {
+        var res;
+        return __generator(this, function (_a) {
+            switch (_a.label) {
+                case 0: return [4 /*yield*/, agent.patch("/food/".concat(spinach._id)).send({ name: "Kale" }).expect(200)];
+                case 1:
+                    res = _a.sent();
+                    (0, bun_test_1.expect)(res.body.data.name).toBe("Kale");
+                    (0, bun_test_1.expect)(res.body.data.calories).toBe(1);
+                    (0, bun_test_1.expect)(res.body.data.hidden).toBe(false);
+                    return [4 /*yield*/, agent
+                            .patch("/food/".concat(spinach._id))
+                            .send({ lastEatenWith: { dressing: "2023-12-03T00:00:20.000Z" } })
+                            .expect(200)];
+                case 2:
+                    res = _a.sent();
+                    (0, bun_test_1.expect)(res.body.data.name).toBe("Kale");
+                    (0, bun_test_1.expect)(res.body.data.calories).toBe(1);
+                    (0, bun_test_1.expect)(res.body.data.hidden).toBe(false);
+                    (0, bun_test_1.expect)(res.body.data.lastEatenWith).toEqual({
+                        dressing: "2023-12-03T00:00:20.000Z",
+                    });
+                    return [4 /*yield*/, agent
+                            .patch("/food/".concat(spinach._id))
+                            .send({
+                            lastEatenWith: {
+                                cucumber: "2023-12-04T12:00:20.000Z",
+                                dressing: "2023-12-03T00:00:20.000Z",
+                            },
+                        })
+                            .expect(200)];
+                case 3:
+                    res = _a.sent();
+                    (0, bun_test_1.expect)(res.body.data.lastEatenWith).toEqual({
+                        cucumber: "2023-12-04T12:00:20.000Z",
+                        dressing: "2023-12-03T00:00:20.000Z",
+                    });
+                    return [2 /*return*/];
+            }
+        });
+    }); });
+    (0, bun_test_1.it)("update using dot notation", function () { return __awaiter(void 0, void 0, void 0, function () {
+        var res, dbSpinach;
+        return __generator(this, function (_a) {
+            switch (_a.label) {
+                case 0: return [4 /*yield*/, agent
+                        .patch("/food/".concat(spinach._id))
+                        .send({ "source.href": "https://food.com" })
+                        .expect(200)];
+                case 1:
+                    res = _a.sent();
+                    (0, bun_test_1.expect)(res.body.data.source.href).toBe("https://food.com");
+                    (0, bun_test_1.expect)(res.body.data.source.name).toBe("Brand");
+                    (0, bun_test_1.expect)(res.body.data.source.dateAdded).toBe("2023-12-13T12:30:00.000Z");
+                    return [4 /*yield*/, tests_1.FoodModel.findById(spinach._id)];
+                case 2:
+                    dbSpinach = _a.sent();
+                    (0, bun_test_1.expect)(dbSpinach === null || dbSpinach === void 0 ? void 0 : dbSpinach.source.href).toBe("https://food.com");
+                    (0, bun_test_1.expect)(dbSpinach === null || dbSpinach === void 0 ? void 0 : dbSpinach.source.name).toBe("Brand");
+                    (0, bun_test_1.expect)(dbSpinach === null || dbSpinach === void 0 ? void 0 : dbSpinach.source.dateAdded).toBe("2023-12-13T12:30:00.000Z");
+                    return [2 /*return*/];
+            }
+        });
+    }); });
+});
+(0, bun_test_1.describe)("special query params", function () {
+    var server;
+    var app;
+    var admin;
+    (0, bun_test_1.beforeEach)(function () { return __awaiter(void 0, void 0, void 0, function () {
+        var _a;
+        return __generator(this, function (_b) {
+            switch (_b.label) {
+                case 0: return [4 /*yield*/, (0, tests_1.setupDb)()];
+                case 1:
+                    _a = __read.apply(void 0, [_b.sent(), 1]), admin = _a[0];
+                    return [4 /*yield*/, tests_1.FoodModel.create({
+                            calories: 1,
+                            created: new Date("2021-12-03T00:00:20.000Z"),
+                            hidden: false,
+                            name: "Spinach",
+                            ownerId: admin._id,
+                        })];
+                case 2:
+                    _b.sent();
+                    app = (0, tests_1.getBaseServer)();
+                    (0, auth_1.setupAuth)(app, tests_1.UserModel);
+                    (0, auth_1.addAuthRoutes)(app, tests_1.UserModel);
+                    return [2 /*return*/];
+            }
+        });
+    }); });
+    (0, bun_test_1.it)("period query param is stripped from query", function () { return __awaiter(void 0, void 0, void 0, function () {
+        var res;
+        return __generator(this, function (_a) {
+            switch (_a.label) {
+                case 0:
+                    app.use("/food", (0, api_1.modelRouter)(tests_1.FoodModel, {
+                        allowAnonymous: true,
+                        permissions: {
+                            create: [permissions_1.Permissions.IsAny],
+                            delete: [permissions_1.Permissions.IsAny],
+                            list: [permissions_1.Permissions.IsAny],
+                            read: [permissions_1.Permissions.IsAny],
+                            update: [permissions_1.Permissions.IsAny],
+                        },
+                        queryFields: ["name", "period"],
+                        queryFilter: function (_user, query) {
+                            if (query === null || query === void 0 ? void 0 : query.period) {
+                                return query;
+                            }
+                            return query !== null && query !== void 0 ? query : {};
+                        },
+                    }));
+                    server = (0, supertest_1.default)(app);
+                    return [4 /*yield*/, server.get("/food?period=weekly").expect(200)];
+                case 1:
+                    res = _a.sent();
+                    (0, bun_test_1.expect)(res.body.data).toBeDefined();
+                    return [2 /*return*/];
+            }
+        });
+    }); });
+    (0, bun_test_1.it)("query with false value", function () { return __awaiter(void 0, void 0, void 0, function () {
+        var res;
+        return __generator(this, function (_a) {
+            switch (_a.label) {
+                case 0: return [4 /*yield*/, tests_1.FoodModel.create({
+                        calories: 50,
+                        created: new Date("2021-12-04T00:00:20.000Z"),
+                        hidden: true,
+                        name: "HiddenFood",
+                        ownerId: admin._id,
+                    })];
+                case 1:
+                    _a.sent();
+                    app.use("/food", (0, api_1.modelRouter)(tests_1.FoodModel, {
+                        allowAnonymous: true,
+                        permissions: {
+                            create: [permissions_1.Permissions.IsAny],
+                            delete: [permissions_1.Permissions.IsAny],
+                            list: [permissions_1.Permissions.IsAny],
+                            read: [permissions_1.Permissions.IsAny],
+                            update: [permissions_1.Permissions.IsAny],
+                        },
+                        queryFields: ["name", "hidden"],
+                    }));
+                    server = (0, supertest_1.default)(app);
+                    return [4 /*yield*/, server.get("/food?hidden=false").expect(200)];
+                case 2:
+                    res = _a.sent();
+                    (0, bun_test_1.expect)(res.body.data.every(function (f) { return f.hidden === false; })).toBe(true);
+                    return [2 /*return*/];
+            }
+        });
+    }); });
+});