@terreno/api 0.0.11-beta.1 → 0.0.12

package/dist/api.test.js

@@ -89,493 +89,27 @@ var __importDefault = (this && this.__importDefault) || function (mod) {
 };
 Object.defineProperty(exports, "__esModule", { value: true });
 var bun_test_1 = require("bun:test");
-var Sentry = __importStar(require("@sentry/node"));
-var qs_1 = __importDefault(require("qs"));
 var supertest_1 = __importDefault(require("supertest"));
 var api_1 = require("./api");
 var auth_1 = require("./auth");
-var errors_1 = require("./errors");
-var expressServer_1 = require("./expressServer");
 var permissions_1 = require("./permissions");
 var tests_1 = require("./tests");
 var transformers_1 = require("./transformers");
 (0, bun_test_1.describe)("@terreno/api", function () {
     var server;
     var app;
-    (0, bun_test_1.describe)("pre and post hooks", function () {
+    (0, bun_test_1.describe)("populate", function () {
+        var admin;
+        var notAdmin;
         var agent;
+        var spinach;
         (0, bun_test_1.beforeEach)(function () { return __awaiter(void 0, void 0, void 0, function () {
-            return __generator(this, function (_a) {
-                switch (_a.label) {
+            var _a, _b;
+            return __generator(this, function (_c) {
+                switch (_c.label) {
                     case 0: return [4 /*yield*/, (0, tests_1.setupDb)()];
                     case 1:
-                        _a.sent();
-                        app = (0, tests_1.getBaseServer)();
-                        (0, auth_1.setupAuth)(app, tests_1.UserModel);
-                        (0, auth_1.addAuthRoutes)(app, tests_1.UserModel);
-                        return [4 /*yield*/, (0, tests_1.authAsUser)(app, "notAdmin")];
-                    case 2:
-                        agent = _a.sent();
-                        return [2 /*return*/];
-                }
-            });
-        }); });
-        (0, bun_test_1.it)("pre hooks change data", function () { return __awaiter(void 0, void 0, void 0, function () {
-            var deleteCalled, res, broccoli;
-            return __generator(this, function (_a) {
-                switch (_a.label) {
-                    case 0:
-                        deleteCalled = false;
-                        app.use("/food", (0, api_1.modelRouter)(tests_1.FoodModel, {
-                            allowAnonymous: true,
-                            permissions: {
-                                create: [permissions_1.Permissions.IsAny],
-                                delete: [permissions_1.Permissions.IsAny],
-                                list: [permissions_1.Permissions.IsAny],
-                                read: [permissions_1.Permissions.IsAny],
-                                update: [permissions_1.Permissions.IsAny],
-                            },
-                            preCreate: function (data) {
-                                data.calories = 14;
-                                return data;
-                            },
-                            preDelete: function (data) {
-                                deleteCalled = true;
-                                return data;
-                            },
-                            preUpdate: function (data) {
-                                data.calories = 15;
-                                return data;
-                            },
-                        }));
-                        server = (0, supertest_1.default)(app);
-                        return [4 /*yield*/, server
-                                .post("/food")
-                                .send({
-                                calories: 15,
-                                name: "Broccoli",
-                            })
-                                .expect(201)];
-                    case 1:
-                        res = _a.sent();
-                        return [4 /*yield*/, tests_1.FoodModel.findById(res.body.data._id)];
-                    case 2:
-                        broccoli = _a.sent();
-                        if (!broccoli) {
-                            throw new Error("Broccoli was not created");
-                        }
-                        (0, bun_test_1.expect)(broccoli.name).toBe("Broccoli");
-                        // Overwritten by the pre create hook
-                        (0, bun_test_1.expect)(broccoli.calories).toBe(14);
-                        return [4 /*yield*/, server
-                                .patch("/food/".concat(broccoli._id))
-                                .send({
-                                name: "Broccoli2",
-                            })
-                                .expect(200)];
-                    case 3:
-                        res = _a.sent();
-                        (0, bun_test_1.expect)(res.body.data.name).toBe("Broccoli2");
-                        // Updated by the pre update hook
-                        (0, bun_test_1.expect)(res.body.data.calories).toBe(15);
-                        return [4 /*yield*/, agent.delete("/food/".concat(broccoli._id)).expect(204)];
-                    case 4:
-                        _a.sent();
-                        (0, bun_test_1.expect)(deleteCalled).toBe(true);
-                        return [2 /*return*/];
-                }
-            });
-        }); });
-        (0, bun_test_1.it)("pre hooks return null", function () { return __awaiter(void 0, void 0, void 0, function () {
-            var notAdmin, spinach, res, broccoli;
-            return __generator(this, function (_a) {
-                switch (_a.label) {
-                    case 0: return [4 /*yield*/, tests_1.UserModel.findOne({
-                            email: "notAdmin@example.com",
-                        })];
-                    case 1:
-                        notAdmin = _a.sent();
-                        return [4 /*yield*/, tests_1.FoodModel.create({
-                                calories: 1,
-                                created: new Date("2021-12-03T00:00:20.000Z"),
-                                hidden: false,
-                                name: "Spinach",
-                                ownerId: notAdmin._id,
-                                source: {
-                                    name: "Brand",
-                                },
-                            })];
-                    case 2:
-                        spinach = _a.sent();
-                        app.use("/food", (0, api_1.modelRouter)(tests_1.FoodModel, {
-                            allowAnonymous: true,
-                            permissions: {
-                                create: [permissions_1.Permissions.IsAny],
-                                delete: [permissions_1.Permissions.IsAny],
-                                list: [permissions_1.Permissions.IsAny],
-                                read: [permissions_1.Permissions.IsAny],
-                                update: [permissions_1.Permissions.IsAny],
-                            },
-                            preCreate: function () { return null; },
-                            preDelete: function () { return null; },
-                            preUpdate: function () { return null; },
-                        }));
-                        server = (0, supertest_1.default)(app);
-                        return [4 /*yield*/, server
-                                .post("/food")
-                                .send({
-                                calories: 15,
-                                name: "Broccoli",
-                            })
-                                .expect(403)];
-                    case 3:
-                        res = _a.sent();
-                        return [4 /*yield*/, tests_1.FoodModel.findById(res.body._id)];
-                    case 4:
-                        broccoli = _a.sent();
-                        (0, bun_test_1.expect)(broccoli).toBeNull();
-                        return [4 /*yield*/, server
-                                .patch("/food/".concat(spinach._id))
-                                .send({
-                                name: "Broccoli",
-                            })
-                                .expect(403)];
-                    case 5:
-                        _a.sent();
-                        return [4 /*yield*/, server.delete("/food/".concat(spinach._id)).expect(403)];
-                    case 6:
-                        _a.sent();
-                        return [2 /*return*/];
-                }
-            });
-        }); });
-        (0, bun_test_1.it)("post hooks succeed", function () { return __awaiter(void 0, void 0, void 0, function () {
-            var deleteCalled, res, broccoli;
-            return __generator(this, function (_a) {
-                switch (_a.label) {
-                    case 0:
-                        deleteCalled = false;
-                        app.use("/food", (0, api_1.modelRouter)(tests_1.FoodModel, {
-                            allowAnonymous: true,
-                            permissions: {
-                                create: [permissions_1.Permissions.IsAny],
-                                delete: [permissions_1.Permissions.IsAny],
-                                list: [permissions_1.Permissions.IsAny],
-                                read: [permissions_1.Permissions.IsAny],
-                                update: [permissions_1.Permissions.IsAny],
-                            },
-                            postCreate: function (data) { return __awaiter(void 0, void 0, void 0, function () {
-                                return __generator(this, function (_a) {
-                                    switch (_a.label) {
-                                        case 0:
-                                            data.calories = 14;
-                                            return [4 /*yield*/, data.save()];
-                                        case 1:
-                                            _a.sent();
-                                            return [2 /*return*/, data];
-                                    }
-                                });
-                            }); },
-                            postDelete: function (data) {
-                                deleteCalled = true;
-                                return data;
-                            },
-                            postUpdate: function (data) { return __awaiter(void 0, void 0, void 0, function () {
-                                return __generator(this, function (_a) {
-                                    switch (_a.label) {
-                                        case 0:
-                                            data.calories = 15;
-                                            return [4 /*yield*/, data.save()];
-                                        case 1:
-                                            _a.sent();
-                                            return [2 /*return*/, data];
-                                    }
-                                });
-                            }); },
-                        }));
-                        server = (0, supertest_1.default)(app);
-                        return [4 /*yield*/, server
-                                .post("/food")
-                                .send({
-                                calories: 15,
-                                name: "Broccoli",
-                            })
-                                .expect(201)];
-                    case 1:
-                        res = _a.sent();
-                        return [4 /*yield*/, tests_1.FoodModel.findById(res.body.data._id)];
-                    case 2:
-                        broccoli = _a.sent();
-                        if (!broccoli) {
-                            throw new Error("Broccoli was not created");
-                        }
-                        (0, bun_test_1.expect)(broccoli.name).toBe("Broccoli");
-                        // Overwritten by the pre create hook
-                        (0, bun_test_1.expect)(broccoli.calories).toBe(14);
-                        return [4 /*yield*/, server
-                                .patch("/food/".concat(broccoli._id))
-                                .send({
-                                name: "Broccoli2",
-                            })
-                                .expect(200)];
-                    case 3:
-                        res = _a.sent();
-                        return [4 /*yield*/, tests_1.FoodModel.findById(res.body.data._id)];
-                    case 4:
-                        broccoli = _a.sent();
-                        if (!broccoli) {
-                            throw new Error("Broccoli was not update");
-                        }
-                        (0, bun_test_1.expect)(broccoli.name).toBe("Broccoli2");
-                        // Updated by the post update hook
-                        (0, bun_test_1.expect)(broccoli.calories).toBe(15);
-                        return [4 /*yield*/, agent.delete("/food/".concat(broccoli._id)).expect(204)];
-                    case 5:
-                        _a.sent();
-                        (0, bun_test_1.expect)(deleteCalled).toBe(true);
-                        return [2 /*return*/];
-                }
-            });
-        }); });
-        (0, bun_test_1.it)("preCreate hook preserves disableExternalErrorTracking on APIError", function () { return __awaiter(void 0, void 0, void 0, function () {
-            var res;
-            return __generator(this, function (_a) {
-                switch (_a.label) {
-                    case 0:
-                        app.use("/food", (0, api_1.modelRouter)(tests_1.FoodModel, {
-                            allowAnonymous: true,
-                            permissions: {
-                                create: [permissions_1.Permissions.IsAny],
-                                delete: [permissions_1.Permissions.IsAny],
-                                list: [permissions_1.Permissions.IsAny],
-                                read: [permissions_1.Permissions.IsAny],
-                                update: [permissions_1.Permissions.IsAny],
-                            },
-                            preCreate: function () {
-                                throw new errors_1.APIError({
-                                    disableExternalErrorTracking: true,
-                                    status: 400,
-                                    title: "Custom preCreate error",
-                                });
-                            },
-                        }));
-                        server = (0, supertest_1.default)(app);
-                        return [4 /*yield*/, server
-                                .post("/food")
-                                .send({
-                                calories: 15,
-                                name: "Broccoli",
-                            })
-                                .expect(400)];
-                    case 1:
-                        res = _a.sent();
-                        (0, bun_test_1.expect)(res.body.title).toBe("Custom preCreate error");
-                        (0, bun_test_1.expect)(res.body.disableExternalErrorTracking).toBe(true);
-                        return [2 /*return*/];
-                }
-            });
-        }); });
-        (0, bun_test_1.it)("preCreate hook preserves disableExternalErrorTracking on non-APIError", function () { return __awaiter(void 0, void 0, void 0, function () {
-            var res;
-            return __generator(this, function (_a) {
-                switch (_a.label) {
-                    case 0:
-                        app.use("/food", (0, api_1.modelRouter)(tests_1.FoodModel, {
-                            allowAnonymous: true,
-                            permissions: {
-                                create: [permissions_1.Permissions.IsAny],
-                                delete: [permissions_1.Permissions.IsAny],
-                                list: [permissions_1.Permissions.IsAny],
-                                read: [permissions_1.Permissions.IsAny],
-                                update: [permissions_1.Permissions.IsAny],
-                            },
-                            preCreate: function () {
-                                var error = new Error("Some custom error");
-                                error.disableExternalErrorTracking = true;
-                                throw error;
-                            },
-                        }));
-                        server = (0, supertest_1.default)(app);
-                        return [4 /*yield*/, server
-                                .post("/food")
-                                .send({
-                                calories: 15,
-                                name: "Broccoli",
-                            })
-                                .expect(400)];
-                    case 1:
-                        res = _a.sent();
-                        (0, bun_test_1.expect)(res.body.title).toContain("preCreate hook error");
-                        (0, bun_test_1.expect)(res.body.disableExternalErrorTracking).toBe(true);
-                        return [2 /*return*/];
-                }
-            });
-        }); });
-        (0, bun_test_1.it)("preUpdate hook preserves disableExternalErrorTracking on APIError", function () { return __awaiter(void 0, void 0, void 0, function () {
-            var notAdmin, spinach, res;
-            return __generator(this, function (_a) {
-                switch (_a.label) {
-                    case 0: return [4 /*yield*/, tests_1.UserModel.findOne({
-                            email: "notAdmin@example.com",
-                        })];
-                    case 1:
-                        notAdmin = _a.sent();
-                        return [4 /*yield*/, tests_1.FoodModel.create({
-                                calories: 1,
-                                created: new Date("2021-12-03T00:00:20.000Z"),
-                                hidden: false,
-                                name: "Spinach",
-                                ownerId: notAdmin._id,
-                                source: {
-                                    name: "Brand",
-                                },
-                            })];
-                    case 2:
-                        spinach = _a.sent();
-                        app.use("/food", (0, api_1.modelRouter)(tests_1.FoodModel, {
-                            allowAnonymous: true,
-                            permissions: {
-                                create: [permissions_1.Permissions.IsAny],
-                                delete: [permissions_1.Permissions.IsAny],
-                                list: [permissions_1.Permissions.IsAny],
-                                read: [permissions_1.Permissions.IsAny],
-                                update: [permissions_1.Permissions.IsAny],
-                            },
-                            preUpdate: function () {
-                                throw new errors_1.APIError({
-                                    disableExternalErrorTracking: true,
-                                    status: 400,
-                                    title: "Custom preUpdate error",
-                                });
-                            },
-                        }));
-                        server = (0, supertest_1.default)(app);
-                        return [4 /*yield*/, server
-                                .patch("/food/".concat(spinach._id))
-                                .send({
-                                name: "Broccoli",
-                            })
-                                .expect(400)];
-                    case 3:
-                        res = _a.sent();
-                        (0, bun_test_1.expect)(res.body.title).toBe("Custom preUpdate error");
-                        (0, bun_test_1.expect)(res.body.disableExternalErrorTracking).toBe(true);
-                        return [2 /*return*/];
-                }
-            });
-        }); });
-        (0, bun_test_1.it)("preUpdate hook preserves disableExternalErrorTracking on non-APIError", function () { return __awaiter(void 0, void 0, void 0, function () {
-            var notAdmin, spinach, res;
-            return __generator(this, function (_a) {
-                switch (_a.label) {
-                    case 0: return [4 /*yield*/, tests_1.UserModel.findOne({
-                            email: "notAdmin@example.com",
-                        })];
-                    case 1:
-                        notAdmin = _a.sent();
-                        return [4 /*yield*/, tests_1.FoodModel.create({
-                                calories: 1,
-                                created: new Date("2021-12-03T00:00:20.000Z"),
-                                hidden: false,
-                                name: "Spinach",
-                                ownerId: notAdmin._id,
-                                source: {
-                                    name: "Brand",
-                                },
-                            })];
-                    case 2:
-                        spinach = _a.sent();
-                        app.use("/food", (0, api_1.modelRouter)(tests_1.FoodModel, {
-                            allowAnonymous: true,
-                            permissions: {
-                                create: [permissions_1.Permissions.IsAny],
-                                delete: [permissions_1.Permissions.IsAny],
-                                list: [permissions_1.Permissions.IsAny],
-                                read: [permissions_1.Permissions.IsAny],
-                                update: [permissions_1.Permissions.IsAny],
-                            },
-                            preUpdate: function () {
-                                var error = new Error("Some custom error");
-                                error.disableExternalErrorTracking = true;
-                                throw error;
-                            },
-                        }));
-                        server = (0, supertest_1.default)(app);
-                        return [4 /*yield*/, server
-                                .patch("/food/".concat(spinach._id))
-                                .send({
-                                name: "Broccoli",
-                            })
-                                .expect(400)];
-                    case 3:
-                        res = _a.sent();
-                        (0, bun_test_1.expect)(res.body.title).toContain("preUpdate hook error");
-                        (0, bun_test_1.expect)(res.body.disableExternalErrorTracking).toBe(true);
-                        return [2 /*return*/];
-                }
-            });
-        }); });
-        (0, bun_test_1.it)("preDelete hook preserves disableExternalErrorTracking on non-APIError", function () { return __awaiter(void 0, void 0, void 0, function () {
-            var notAdmin, spinach, res;
-            return __generator(this, function (_a) {
-                switch (_a.label) {
-                    case 0: return [4 /*yield*/, tests_1.UserModel.findOne({
-                            email: "notAdmin@example.com",
-                        })];
-                    case 1:
-                        notAdmin = _a.sent();
-                        return [4 /*yield*/, tests_1.FoodModel.create({
-                                calories: 1,
-                                created: new Date("2021-12-03T00:00:20.000Z"),
-                                hidden: false,
-                                name: "Spinach",
-                                ownerId: notAdmin._id,
-                                source: {
-                                    name: "Brand",
-                                },
-                            })];
-                    case 2:
-                        spinach = _a.sent();
-                        app.use("/food", (0, api_1.modelRouter)(tests_1.FoodModel, {
-                            allowAnonymous: true,
-                            permissions: {
-                                create: [permissions_1.Permissions.IsAny],
-                                delete: [permissions_1.Permissions.IsAny],
-                                list: [permissions_1.Permissions.IsAny],
-                                read: [permissions_1.Permissions.IsAny],
-                                update: [permissions_1.Permissions.IsAny],
-                            },
-                            preDelete: function () {
-                                var error = new Error("Some custom error");
-                                error.disableExternalErrorTracking = true;
-                                throw error;
-                            },
-                        }));
-                        server = (0, supertest_1.default)(app);
-                        return [4 /*yield*/, agent.delete("/food/".concat(spinach._id)).expect(403)];
-                    case 3:
-                        res = _a.sent();
-                        (0, bun_test_1.expect)(res.body.title).toContain("preDelete hook error");
-                        (0, bun_test_1.expect)(res.body.disableExternalErrorTracking).toBe(true);
-                        return [2 /*return*/];
-                }
-            });
-        }); });
-    });
-    (0, bun_test_1.describe)("model array operations", function () {
-        var admin;
-        var spinach;
-        var apple;
-        var agent;
-        (0, bun_test_1.beforeEach)(function () { return __awaiter(void 0, void 0, void 0, function () {
-            var _a, _b;
-            return __generator(this, function (_c) {
-                switch (_c.label) {
-                    case 0:
-                        process.env.REFRESH_TOKEN_SECRET = "testsecret1234";
-                        return [4 /*yield*/, (0, tests_1.setupDb)()];
-                    case 1:
-                        _a = __read.apply(void 0, [_c.sent(), 1]), admin = _a[0];
+                        _a = __read.apply(void 0, [_c.sent(), 2]), admin = _a[0], notAdmin = _a[1];
                         return [4 /*yield*/, Promise.all([
                                 tests_1.FoodModel.create({
                                     calories: 1,
@@ -586,1683 +120,23 @@ var transformers_1 = require("./transformers");
                                     source: {
                                         name: "Brand",
                                     },
-                                }),
-                                tests_1.FoodModel.create({
-                                    calories: 100,
-                                    categories: [
-                                        {
-                                            name: "Fruit",
-                                            show: true,
-                                        },
-                                        {
-                                            name: "Popular",
-                                            show: false,
-                                        },
-                                    ],
-                                    created: new Date("2021-12-03T00:00:30.000Z"),
-                                    hidden: false,
-                                    name: "Apple",
-                                    ownerId: admin._id,
-                                    tags: ["healthy", "cheap"],
-                                }),
-                            ])];
-                    case 2:
-                        _b = __read.apply(void 0, [_c.sent(), 2]), spinach = _b[0], apple = _b[1];
-                        app = (0, tests_1.getBaseServer)();
-                        (0, auth_1.setupAuth)(app, tests_1.UserModel);
-                        (0, auth_1.addAuthRoutes)(app, tests_1.UserModel);
-                        app.use("/food", (0, api_1.modelRouter)(tests_1.FoodModel, {
-                            allowAnonymous: true,
-                            permissions: {
-                                create: [permissions_1.Permissions.IsAdmin],
-                                delete: [permissions_1.Permissions.IsAdmin],
-                                list: [permissions_1.Permissions.IsAdmin],
-                                read: [permissions_1.Permissions.IsAdmin],
-                                update: [permissions_1.Permissions.IsAdmin],
-                            },
-                            queryFields: ["hidden", "calories", "created", "source.name"],
-                            sort: { created: "descending" },
-                        }));
-                        server = (0, supertest_1.default)(app);
-                        return [4 /*yield*/, (0, tests_1.authAsUser)(app, "admin")];
-                    case 3:
-                        agent = _c.sent();
-                        return [2 /*return*/];
-                }
-            });
-        }); });
-        (0, bun_test_1.it)("add array sub-schema item", function () { return __awaiter(void 0, void 0, void 0, function () {
-            var res;
-            return __generator(this, function (_a) {
-                switch (_a.label) {
-                    case 0: return [4 /*yield*/, agent
-                            .post("/food/".concat(apple._id, "/categories"))
-                            .send({ name: "Good Seller", show: false })
-                            .expect(400)];
-                    case 1:
-                        res = _a.sent();
-                        (0, bun_test_1.expect)(res.body.title).toBe("Malformed body, array operations should have a single, top level key, got: name,show");
-                        return [4 /*yield*/, agent
-                                .post("/food/".concat(apple._id, "/categories"))
-                                .send({ categories: { name: "Good Seller", show: false } })
-                                .expect(200)];
-                    case 2:
-                        res = _a.sent();
-                        (0, bun_test_1.expect)(res.body.data.categories).toHaveLength(3);
-                        (0, bun_test_1.expect)(res.body.data.categories[2].name).toBe("Good Seller");
-                        return [4 /*yield*/, agent
-                                .post("/food/".concat(spinach._id, "/categories"))
-                                .send({ categories: { name: "Good Seller", show: false } })
-                                .expect(200)];
-                    case 3:
-                        res = _a.sent();
-                        (0, bun_test_1.expect)(res.body.data.categories).toHaveLength(1);
-                        return [2 /*return*/];
-                }
-            });
-        }); });
-        (0, bun_test_1.it)("update array sub-schema item", function () { return __awaiter(void 0, void 0, void 0, function () {
-            var res;
-            return __generator(this, function (_a) {
-                switch (_a.label) {
-                    case 0: return [4 /*yield*/, agent
-                            .patch("/food/".concat(apple._id, "/categories/xyz"))
-                            .send({ categories: { name: "Good Seller", show: false } })
-                            .expect(404)];
-                    case 1:
-                        res = _a.sent();
-                        (0, bun_test_1.expect)(res.body.title).toBe("Could not find categories/xyz");
-                        return [4 /*yield*/, agent
-                                .patch("/food/".concat(apple._id, "/categories/").concat(apple.categories[1]._id))
-                                .send({ categories: { name: "Good Seller", show: false } })
-                                .expect(200)];
-                    case 2:
-                        res = _a.sent();
-                        (0, bun_test_1.expect)(res.body.data.categories).toHaveLength(2);
-                        (0, bun_test_1.expect)(res.body.data.categories[1].name).toBe("Good Seller");
-                        return [2 /*return*/];
-                }
-            });
-        }); });
-        (0, bun_test_1.it)("delete array sub-schema item", function () { return __awaiter(void 0, void 0, void 0, function () {
-            var res;
-            return __generator(this, function (_a) {
-                switch (_a.label) {
-                    case 0: return [4 /*yield*/, agent.delete("/food/".concat(apple._id, "/categories/xyz")).expect(404)];
-                    case 1:
-                        res = _a.sent();
-                        (0, bun_test_1.expect)(res.body.title).toBe("Could not find categories/xyz");
-                        return [4 /*yield*/, agent
-                                .delete("/food/".concat(apple._id, "/categories/").concat(apple.categories[0]._id))
-                                .expect(200)];
-                    case 2:
-                        res = _a.sent();
-                        (0, bun_test_1.expect)(res.body.data.categories).toHaveLength(1);
-                        (0, bun_test_1.expect)(res.body.data.categories[0].name).toBe("Popular");
-                        return [2 /*return*/];
-                }
-            });
-        }); });
-        (0, bun_test_1.it)("add array item", function () { return __awaiter(void 0, void 0, void 0, function () {
-            var res;
-            return __generator(this, function (_a) {
-                switch (_a.label) {
-                    case 0: return [4 /*yield*/, agent.post("/food/".concat(apple._id, "/tags")).send({ tags: "popular" }).expect(200)];
-                    case 1:
-                        res = _a.sent();
-                        (0, bun_test_1.expect)(res.body.data.tags).toHaveLength(3);
-                        (0, bun_test_1.expect)(res.body.data.tags).toEqual(["healthy", "cheap", "popular"]);
-                        return [4 /*yield*/, agent.post("/food/".concat(spinach._id, "/tags")).send({ tags: "popular" }).expect(200)];
-                    case 2:
-                        res = _a.sent();
-                        (0, bun_test_1.expect)(res.body.data.tags).toEqual(["popular"]);
-                        return [2 /*return*/];
-                }
-            });
-        }); });
-        (0, bun_test_1.it)("update array item", function () { return __awaiter(void 0, void 0, void 0, function () {
-            var res;
-            return __generator(this, function (_a) {
-                switch (_a.label) {
-                    case 0: return [4 /*yield*/, agent
-                            .patch("/food/".concat(apple._id, "/tags/xyz"))
-                            .send({ tags: "unhealthy" })
-                            .expect(404)];
-                    case 1:
-                        res = _a.sent();
-                        (0, bun_test_1.expect)(res.body.title).toBe("Could not find tags/xyz");
-                        return [4 /*yield*/, agent
-                                .patch("/food/".concat(apple._id, "/tags/healthy"))
-                                .send({ tags: "unhealthy" })
-                                .expect(200)];
-                    case 2:
-                        res = _a.sent();
-                        (0, bun_test_1.expect)(res.body.data.tags).toEqual(["unhealthy", "cheap"]);
-                        return [2 /*return*/];
-                }
-            });
-        }); });
-        (0, bun_test_1.it)("delete array item", function () { return __awaiter(void 0, void 0, void 0, function () {
-            var res;
-            return __generator(this, function (_a) {
-                switch (_a.label) {
-                    case 0: return [4 /*yield*/, agent.delete("/food/".concat(apple._id, "/tags/xyz")).expect(404)];
-                    case 1:
-                        res = _a.sent();
-                        (0, bun_test_1.expect)(res.body.title).toBe("Could not find tags/xyz");
-                        return [4 /*yield*/, agent.delete("/food/".concat(apple._id, "/tags/healthy")).expect(200)];
-                    case 2:
-                        res = _a.sent();
-                        (0, bun_test_1.expect)(res.body.data.tags).toEqual(["cheap"]);
-                        return [2 /*return*/];
-                }
-            });
-        }); });
-        (0, bun_test_1.it)("updates timestamps on array subdocuments", function () { return __awaiter(void 0, void 0, void 0, function () {
-            var foodWithTimestamps, firstCategoryId, secondCategoryId, res, updatedCategory, unchangedCategory;
-            var _a, _b, _c, _d, _e, _f;
-            return __generator(this, function (_g) {
-                switch (_g.label) {
-                    case 0: return [4 /*yield*/, tests_1.FoodModel.create({
-                            calories: 100,
-                            categories: [
-                                {
-                                    name: "Category 1",
-                                    show: true,
-                                    updated: new Date("2024-01-01T00:00:00.000Z"),
-                                },
-                                {
-                                    name: "Category 2",
-                                    show: true,
-                                    updated: new Date("2024-01-01T00:00:00.000Z"),
-                                },
-                            ],
-                            created: new Date(),
-                            name: "Food with Timestamps",
-                            ownerId: admin._id,
-                        })];
-                    case 1:
-                        foodWithTimestamps = _g.sent();
-                        firstCategoryId = (_c = (_b = (_a = foodWithTimestamps.categories) === null || _a === void 0 ? void 0 : _a[0]) === null || _b === void 0 ? void 0 : _b._id) === null || _c === void 0 ? void 0 : _c.toString();
-                        secondCategoryId = (_f = (_e = (_d = foodWithTimestamps.categories) === null || _d === void 0 ? void 0 : _d[1]) === null || _e === void 0 ? void 0 : _e._id) === null || _f === void 0 ? void 0 : _f.toString();
-                        if (!firstCategoryId || !secondCategoryId) {
-                            throw new Error("Failed to create food with categories");
-                        }
-                        // Wait a moment to ensure timestamp difference
-                        return [4 /*yield*/, new Promise(function (resolve) { return setTimeout(resolve, 100); })];
-                    case 2:
-                        // Wait a moment to ensure timestamp difference
-                        _g.sent();
-                        return [4 /*yield*/, agent
-                                .patch("/food/".concat(foodWithTimestamps._id, "/categories/").concat(firstCategoryId))
-                                .send({ categories: { name: "Updated Category" } })
-                                .expect(200)];
-                    case 3:
-                        res = _g.sent();
-                        updatedCategory = res.body.data.categories.find(function (c) { return c._id === firstCategoryId; });
-                        unchangedCategory = res.body.data.categories.find(function (c) { return c._id === secondCategoryId; });
-                        if (!updatedCategory || !unchangedCategory) {
-                            throw new Error("Failed to find categories in response");
-                        }
-                        (0, bun_test_1.expect)(updatedCategory.updated).not.toBe(updatedCategory.created);
-                        (0, bun_test_1.expect)(unchangedCategory.updated).toBe(unchangedCategory.created);
-                        (0, bun_test_1.expect)(updatedCategory.name).toBe("Updated Category");
-                        // Unchanged.
-                        (0, bun_test_1.expect)(updatedCategory.show).toBe(true);
-                        (0, bun_test_1.expect)(unchangedCategory.show).toBe(true);
-                        return [2 /*return*/];
-                }
-            });
-        }); });
-        (0, bun_test_1.it)("array operations call postUpdate with different copy of document", function () { return __awaiter(void 0, void 0, void 0, function () {
-            var postUpdateDoc, postUpdatePrevDoc, postUpdateCalled, categoryId, updatedCategory, prevCategory, remainingCategories, prevCategories;
-            return __generator(this, function (_a) {
-                switch (_a.label) {
-                    case 0:
-                        postUpdateCalled = false;
-                        app = (0, tests_1.getBaseServer)();
-                        (0, auth_1.setupAuth)(app, tests_1.UserModel);
-                        (0, auth_1.addAuthRoutes)(app, tests_1.UserModel);
-                        app.use("/food", (0, api_1.modelRouter)(tests_1.FoodModel, {
-                            allowAnonymous: true,
-                            permissions: {
-                                create: [permissions_1.Permissions.IsAdmin],
-                                delete: [permissions_1.Permissions.IsAdmin],
-                                list: [permissions_1.Permissions.IsAdmin],
-                                read: [permissions_1.Permissions.IsAdmin],
-                                update: [permissions_1.Permissions.IsAdmin],
-                            },
-                            postUpdate: function (doc, _cleanedBody, _request, prevValue) { return __awaiter(void 0, void 0, void 0, function () {
-                                return __generator(this, function (_a) {
-                                    postUpdateDoc = doc;
-                                    postUpdatePrevDoc = prevValue;
-                                    postUpdateCalled = true;
-                                    return [2 /*return*/];
-                                });
-                            }); },
-                        }));
-                        server = (0, supertest_1.default)(app);
-                        return [4 /*yield*/, (0, tests_1.authAsUser)(app, "admin")];
-                    case 1:
-                        agent = _a.sent();
-                        // Test POST operation (add to array)
-                        return [4 /*yield*/, agent
-                                .post("/food/".concat(apple._id, "/categories"))
-                                .send({ categories: { name: "New Category", show: true } })
-                                .expect(200)];
-                    case 2:
-                        // Test POST operation (add to array)
-                        _a.sent();
-                        (0, bun_test_1.expect)(postUpdateCalled).toBe(true);
-                        (0, bun_test_1.expect)(postUpdateDoc).toBeDefined();
-                        (0, bun_test_1.expect)(postUpdatePrevDoc).toBeDefined();
-                        // Verify they are different object references
-                        (0, bun_test_1.expect)(postUpdateDoc).not.toBe(postUpdatePrevDoc);
-                        // Verify the content is different (new category added)
-                        (0, bun_test_1.expect)(postUpdateDoc.categories).toHaveLength(3);
-                        (0, bun_test_1.expect)(postUpdatePrevDoc.categories).toHaveLength(2);
-                        // Reset for next test
-                        postUpdateCalled = false;
-                        postUpdateDoc = undefined;
-                        postUpdatePrevDoc = undefined;
-                        categoryId = apple.categories[0]._id;
-                        if (!categoryId) {
-                            throw new Error("Category ID is undefined");
-                        }
-                        return [4 /*yield*/, agent
-                                .patch("/food/".concat(apple._id, "/categories/").concat(categoryId))
-                                .send({ categories: { name: "Updated Category", show: false } })
-                                .expect(200)];
-                    case 3:
-                        _a.sent();
-                        (0, bun_test_1.expect)(postUpdateCalled).toBe(true);
-                        (0, bun_test_1.expect)(postUpdateDoc).toBeDefined();
-                        (0, bun_test_1.expect)(postUpdatePrevDoc).toBeDefined();
-                        // Verify they are different object references
-                        (0, bun_test_1.expect)(postUpdateDoc).not.toBe(postUpdatePrevDoc);
-                        updatedCategory = postUpdateDoc.categories.find(function (c) { return c._id.toString() === categoryId.toString(); });
-                        prevCategory = postUpdatePrevDoc.categories.find(function (c) { return c._id.toString() === categoryId.toString(); });
-                        (0, bun_test_1.expect)(updatedCategory.name).toBe("Updated Category");
-                        (0, bun_test_1.expect)(prevCategory.name).toBe("Fruit");
-                        // Reset for next test
-                        postUpdateCalled = false;
-                        postUpdateDoc = undefined;
-                        postUpdatePrevDoc = undefined;
-                        // Test DELETE operation (remove from array)
-                        return [4 /*yield*/, agent.delete("/food/".concat(apple._id, "/categories/").concat(categoryId)).expect(200)];
-                    case 4:
-                        // Test DELETE operation (remove from array)
-                        _a.sent();
-                        (0, bun_test_1.expect)(postUpdateCalled).toBe(true);
-                        (0, bun_test_1.expect)(postUpdateDoc).toBeDefined();
-                        (0, bun_test_1.expect)(postUpdatePrevDoc).toBeDefined();
-                        // Verify they are different object references
-                        (0, bun_test_1.expect)(postUpdateDoc).not.toBe(postUpdatePrevDoc);
-                        remainingCategories = postUpdateDoc.categories.filter(function (c) { return c._id.toString() === categoryId.toString(); });
-                        prevCategories = postUpdatePrevDoc.categories.filter(function (c) { return c._id.toString() === categoryId.toString(); });
-                        (0, bun_test_1.expect)(remainingCategories).toHaveLength(0);
-                        (0, bun_test_1.expect)(prevCategories).toHaveLength(1);
-                        return [2 /*return*/];
-                }
-            });
-        }); });
-        (0, bun_test_1.it)("array operations with string arrays call postUpdate with different copy", function () { return __awaiter(void 0, void 0, void 0, function () {
-            var postUpdateDoc, postUpdatePrevDoc, postUpdateCalled;
-            return __generator(this, function (_a) {
-                switch (_a.label) {
-                    case 0:
-                        postUpdateCalled = false;
-                        app = (0, tests_1.getBaseServer)();
-                        (0, auth_1.setupAuth)(app, tests_1.UserModel);
-                        (0, auth_1.addAuthRoutes)(app, tests_1.UserModel);
-                        app.use("/food", (0, api_1.modelRouter)(tests_1.FoodModel, {
-                            allowAnonymous: true,
-                            permissions: {
-                                create: [permissions_1.Permissions.IsAdmin],
-                                delete: [permissions_1.Permissions.IsAdmin],
-                                list: [permissions_1.Permissions.IsAdmin],
-                                read: [permissions_1.Permissions.IsAdmin],
-                                update: [permissions_1.Permissions.IsAdmin],
-                            },
-                            postUpdate: function (doc, _cleanedBody, _request, prevValue) { return __awaiter(void 0, void 0, void 0, function () {
-                                return __generator(this, function (_a) {
-                                    postUpdateDoc = doc;
-                                    postUpdatePrevDoc = prevValue;
-                                    postUpdateCalled = true;
-                                    return [2 /*return*/];
-                                });
-                            }); },
-                        }));
-                        server = (0, supertest_1.default)(app);
-                        return [4 /*yield*/, (0, tests_1.authAsUser)(app, "admin")];
-                    case 1:
-                        agent = _a.sent();
-                        // Test POST operation with string array (add tag)
-                        return [4 /*yield*/, agent.post("/food/".concat(apple._id, "/tags")).send({ tags: "organic" }).expect(200)];
-                    case 2:
-                        // Test POST operation with string array (add tag)
-                        _a.sent();
-                        (0, bun_test_1.expect)(postUpdateCalled).toBe(true);
-                        (0, bun_test_1.expect)(postUpdateDoc).toBeDefined();
-                        (0, bun_test_1.expect)(postUpdatePrevDoc).toBeDefined();
-                        // Verify they are different object references
-                        (0, bun_test_1.expect)(postUpdateDoc).not.toBe(postUpdatePrevDoc);
-                        // Verify the content is different (new tag added)
-                        (0, bun_test_1.expect)(postUpdateDoc.tags).toHaveLength(3);
-                        (0, bun_test_1.expect)(postUpdatePrevDoc.tags).toHaveLength(2);
-                        (0, bun_test_1.expect)(postUpdateDoc.tags).toContain("organic");
-                        (0, bun_test_1.expect)(postUpdatePrevDoc.tags).not.toContain("organic");
-                        // Reset for next test
-                        postUpdateCalled = false;
-                        postUpdateDoc = undefined;
-                        postUpdatePrevDoc = undefined;
-                        // Test PATCH operation with string array (update tag)
-                        return [4 /*yield*/, agent
-                                .patch("/food/".concat(apple._id, "/tags/healthy"))
-                                .send({ tags: "super-healthy" })
-                                .expect(200)];
-                    case 3:
-                        // Test PATCH operation with string array (update tag)
-                        _a.sent();
-                        (0, bun_test_1.expect)(postUpdateCalled).toBe(true);
-                        (0, bun_test_1.expect)(postUpdateDoc).not.toBe(postUpdatePrevDoc);
-                        // Verify the content is different (tag updated)
-                        (0, bun_test_1.expect)(postUpdateDoc.tags).toContain("super-healthy");
-                        (0, bun_test_1.expect)(postUpdatePrevDoc.tags).toContain("healthy");
-                        (0, bun_test_1.expect)(postUpdateDoc.tags).not.toContain("healthy");
-                        (0, bun_test_1.expect)(postUpdatePrevDoc.tags).not.toContain("super-healthy");
-                        return [2 /*return*/];
-                }
-            });
-        }); });
-    });
-    (0, bun_test_1.describe)("standard methods", function () {
-        var notAdmin;
-        var admin;
-        var adminOther;
-        var agent;
-        var spinach;
-        var apple;
-        var carrots;
-        var pizza;
-        (0, bun_test_1.beforeEach)(function () { return __awaiter(void 0, void 0, void 0, function () {
-            var results;
-            var _a, _b;
-            return __generator(this, function (_c) {
-                switch (_c.label) {
-                    case 0: return [4 /*yield*/, (0, tests_1.setupDb)()];
-                    case 1:
-                        _a = __read.apply(void 0, [_c.sent(), 3]), admin = _a[0], notAdmin = _a[1], adminOther = _a[2];
-                        return [4 /*yield*/, Promise.all([
-                                tests_1.FoodModel.create({
-                                    calories: 1,
-                                    created: new Date("2021-12-03T00:00:20.000Z"),
-                                    eatenBy: [admin._id],
-                                    hidden: false,
-                                    lastEatenWith: {
-                                        dressing: new Date("2021-12-03T19:00:30.000Z"),
-                                    },
-                                    name: "Spinach",
-                                    ownerId: notAdmin._id,
-                                    source: {
-                                        dateAdded: "2023-12-13T12:30:00.000Z",
-                                        href: "https://www.google.com",
-                                        name: "Brand",
-                                    },
-                                }),
-                                tests_1.FoodModel.create({
-                                    calories: 100,
-                                    created: new Date("2021-12-03T00:00:30.000Z"),
-                                    hidden: true,
-                                    name: "Apple",
-                                    ownerId: admin._id,
-                                    tags: ["healthy"],
-                                }),
-                                tests_1.FoodModel.create({
-                                    calories: 100,
-                                    created: new Date("2021-12-03T00:00:00.000Z"),
-                                    eatenBy: [admin._id, notAdmin._id],
-                                    hidden: false,
-                                    name: "Carrots",
-                                    ownerId: admin._id,
-                                    source: {
-                                        name: "USDA",
-                                    },
-                                    tags: ["healthy", "cheap"],
-                                }),
-                                tests_1.FoodModel.create({
-                                    calories: 400,
-                                    created: new Date("2021-12-03T00:00:10.000Z"),
-                                    eatenBy: [adminOther._id],
-                                    hidden: false,
-                                    name: "Pizza",
-                                    ownerId: admin._id,
-                                    tags: ["cheap"],
-                                }),
-                            ])];
-                    case 2:
-                        results = (_c.sent());
-                        _b = __read(results, 4), spinach = _b[0], apple = _b[1], carrots = _b[2], pizza = _b[3];
-                        app = (0, tests_1.getBaseServer)();
-                        (0, auth_1.setupAuth)(app, tests_1.UserModel);
-                        (0, auth_1.addAuthRoutes)(app, tests_1.UserModel);
-                        app.use(expressServer_1.logRequests);
-                        app.use("/food", (0, api_1.modelRouter)(tests_1.FoodModel, {
-                            allowAnonymous: true,
-                            defaultLimit: 2,
-                            defaultQueryParams: { hidden: false },
-                            maxLimit: 3,
-                            permissions: {
-                                create: [permissions_1.Permissions.IsAuthenticated],
-                                delete: [permissions_1.Permissions.IsAdmin],
-                                list: [permissions_1.Permissions.IsAny],
-                                read: [permissions_1.Permissions.IsAny],
-                                update: [permissions_1.Permissions.IsOwner],
-                            },
-                            populatePaths: [{ path: "ownerId" }],
-                            queryFields: ["hidden", "name", "calories", "created", "source.name", "tags", "eatenBy"],
-                            sort: { created: "descending" },
-                        }));
-                        server = (0, supertest_1.default)(app);
-                        return [4 /*yield*/, (0, tests_1.authAsUser)(app, "notAdmin")];
-                    case 3:
-                        agent = _c.sent();
-                        return [2 /*return*/];
-                }
-            });
-        }); });
-        (0, bun_test_1.it)("read default", function () { return __awaiter(void 0, void 0, void 0, function () {
-            var res;
-            return __generator(this, function (_a) {
-                switch (_a.label) {
-                    case 0: return [4 /*yield*/, agent.get("/food/".concat(spinach._id)).expect(200)];
-                    case 1:
-                        res = _a.sent();
-                        (0, bun_test_1.expect)(res.body.data._id).toBe(spinach._id.toString());
-                        // Ensure populate works
-                        (0, bun_test_1.expect)(res.body.data.ownerId._id).toBe(notAdmin.id);
-                        // Ensure maps are properly transformed
-                        (0, bun_test_1.expect)(res.body.data.lastEatenWith).toEqual({
-                            dressing: "2021-12-03T19:00:30.000Z",
-                        });
-                        return [2 /*return*/];
-                }
-            });
-        }); });
-        (0, bun_test_1.it)("list default", function () { return __awaiter(void 0, void 0, void 0, function () {
-            var res;
-            return __generator(this, function (_a) {
-                switch (_a.label) {
-                    case 0: return [4 /*yield*/, agent.get("/food").expect(200)];
-                    case 1:
-                        res = _a.sent();
-                        (0, bun_test_1.expect)(res.body.data).toHaveLength(2);
-                        (0, bun_test_1.expect)(res.body.data[0].id).toBe(spinach.id);
-                        (0, bun_test_1.expect)(res.body.data[0].ownerId._id).toBe(notAdmin.id);
-                        (0, bun_test_1.expect)(res.body.data[1].id).toBe(pizza.id);
-                        (0, bun_test_1.expect)(res.body.data[1].ownerId._id).toBe(admin.id);
-                        // Check that mongoose Map is handled correctly.
-                        (0, bun_test_1.expect)(res.body.data[0].lastEatenWith).toEqual({
-                            dressing: "2021-12-03T19:00:30.000Z",
-                        });
-                        (0, bun_test_1.expect)(res.body.data[1].lastEatenWith).toEqual(undefined);
-                        (0, bun_test_1.expect)(res.body.more).toBe(true);
-                        (0, bun_test_1.expect)(res.body.total).toBe(3);
-                        return [2 /*return*/];
-                }
-            });
-        }); });
-        (0, bun_test_1.it)("list limit", function () { return __awaiter(void 0, void 0, void 0, function () {
-            var res;
-            return __generator(this, function (_a) {
-                switch (_a.label) {
-                    case 0: return [4 /*yield*/, agent.get("/food?limit=1").expect(200)];
-                    case 1:
-                        res = _a.sent();
-                        (0, bun_test_1.expect)(res.body.data).toHaveLength(1);
-                        (0, bun_test_1.expect)(res.body.data[0].id).toBe(spinach.id);
-                        (0, bun_test_1.expect)(res.body.data[0].ownerId._id).toBe(notAdmin.id);
-                        (0, bun_test_1.expect)(res.body.more).toBe(true);
-                        (0, bun_test_1.expect)(res.body.total).toBe(3);
-                        return [2 /*return*/];
-                }
-            });
-        }); });
-        (0, bun_test_1.it)("list limit over", function () { return __awaiter(void 0, void 0, void 0, function () {
-            var res;
-            return __generator(this, function (_a) {
-                switch (_a.label) {
-                    case 0: 
-                    // This shouldn't be seen, it's the end of the list.
-                    return [4 /*yield*/, tests_1.FoodModel.create({
-                            calories: 400,
-                            created: new Date("2021-12-02T00:00:10.000Z"),
-                            hidden: false,
-                            name: "Pizza",
-                            ownerId: admin._id,
-                        })];
-                    case 1:
-                        // This shouldn't be seen, it's the end of the list.
-                        _a.sent();
-                        return [4 /*yield*/, agent.get("/food?limit=4").expect(200)];
-                    case 2:
-                        res = _a.sent();
-                        (0, bun_test_1.expect)(res.body.data).toHaveLength(3);
-                        (0, bun_test_1.expect)(res.body.more).toBe(true);
-                        (0, bun_test_1.expect)(res.body.total).toBe(4);
-                        (0, bun_test_1.expect)(res.body.data[0].id).toBe(spinach.id);
-                        (0, bun_test_1.expect)(res.body.data[1].id).toBe(pizza.id);
-                        (0, bun_test_1.expect)(res.body.data[2].id).toBe(carrots.id);
-                        (0, bun_test_1.expect)(Sentry.captureMessage).toHaveBeenCalledWith('More than 3 results returned for foods without pagination, data may be silently truncated. req.query: {"limit":"4"}');
-                        return [2 /*return*/];
-                }
-            });
-        }); });
-        (0, bun_test_1.it)("list page", function () { return __awaiter(void 0, void 0, void 0, function () {
-            var res;
-            return __generator(this, function (_a) {
-                switch (_a.label) {
-                    case 0: return [4 /*yield*/, agent.get("/food?limit=1&page=2").expect(200)];
-                    case 1:
-                        res = _a.sent();
-                        (0, bun_test_1.expect)(res.body.data).toHaveLength(1);
-                        (0, bun_test_1.expect)(res.body.more).toBe(true);
-                        (0, bun_test_1.expect)(res.body.total).toBe(3);
-                        (0, bun_test_1.expect)(res.body.data[0].id).toBe(pizza.id);
-                        return [2 /*return*/];
-                }
-            });
-        }); });
-        (0, bun_test_1.it)("list page 0 ", function () { return __awaiter(void 0, void 0, void 0, function () {
-            var res;
-            return __generator(this, function (_a) {
-                switch (_a.label) {
-                    case 0: return [4 /*yield*/, agent.get("/food?limit=1&page=0").expect(400)];
-                    case 1:
-                        res = _a.sent();
-                        (0, bun_test_1.expect)(res.body.title).toBe("Invalid page: 0");
-                        return [2 /*return*/];
-                }
-            });
-        }); });
-        (0, bun_test_1.it)("list page with garbage ", function () { return __awaiter(void 0, void 0, void 0, function () {
-            var res;
-            return __generator(this, function (_a) {
-                switch (_a.label) {
-                    case 0: return [4 /*yield*/, agent.get("/food?limit=1&page=abc").expect(400)];
-                    case 1:
-                        res = _a.sent();
-                        (0, bun_test_1.expect)(res.body.title).toBe("Invalid page: abc");
-                        return [2 /*return*/];
-                }
-            });
-        }); });
-        (0, bun_test_1.it)("list page over", function () { return __awaiter(void 0, void 0, void 0, function () {
-            var res;
-            return __generator(this, function (_a) {
-                switch (_a.label) {
-                    case 0: return [4 /*yield*/, agent.get("/food?limit=1&page=5").expect(200)];
-                    case 1:
-                        res = _a.sent();
-                        (0, bun_test_1.expect)(res.body.data).toHaveLength(0);
-                        (0, bun_test_1.expect)(res.body.more).toBe(false);
-                        (0, bun_test_1.expect)(res.body.total).toBe(3);
-                        return [2 /*return*/];
-                }
-            });
-        }); });
-        (0, bun_test_1.it)("list query params", function () { return __awaiter(void 0, void 0, void 0, function () {
-            var res;
-            return __generator(this, function (_a) {
-                switch (_a.label) {
-                    case 0: return [4 /*yield*/, agent.get("/food?hidden=true").expect(200)];
-                    case 1:
-                        res = _a.sent();
-                        (0, bun_test_1.expect)(res.body.data).toHaveLength(1);
-                        (0, bun_test_1.expect)(res.body.more).toBe(false);
-                        (0, bun_test_1.expect)(res.body.total).toBe(1);
-                        (0, bun_test_1.expect)(res.body.data[0].id).toBe(apple.id);
-                        return [2 /*return*/];
-                }
-            });
-        }); });
-        (0, bun_test_1.it)("list query params not in list", function () { return __awaiter(void 0, void 0, void 0, function () {
-            var res;
-            return __generator(this, function (_a) {
-                switch (_a.label) {
-                    case 0: return [4 /*yield*/, agent.get("/food?ownerId=".concat(admin._id)).expect(400)];
-                    case 1:
-                        res = _a.sent();
-                        (0, bun_test_1.expect)(res.body.title).toBe("ownerId is not allowed as a query param.");
-                        return [2 /*return*/];
-                }
-            });
-        }); });
-        (0, bun_test_1.it)("list query by nested param", function () { return __awaiter(void 0, void 0, void 0, function () {
-            var res;
-            return __generator(this, function (_a) {
-                switch (_a.label) {
-                    case 0: return [4 /*yield*/, agent.get("/food?source.name=USDA").expect(200)];
-                    case 1:
-                        res = _a.sent();
-                        (0, bun_test_1.expect)(res.body.data).toHaveLength(1);
-                        (0, bun_test_1.expect)(res.body.total).toBe(1);
-                        (0, bun_test_1.expect)(res.body.data[0].id).toBe(carrots.id);
-                        return [2 /*return*/];
-                }
-            });
-        }); });
-        (0, bun_test_1.it)("query by date", function () { return __awaiter(void 0, void 0, void 0, function () {
-            var authRes, token, res, createdDates;
-            return __generator(this, function (_a) {
-                switch (_a.label) {
-                    case 0: return [4 /*yield*/, server
-                            .post("/auth/login")
-                            .send({ email: "admin@example.com", password: "securePassword" })
-                            .expect(200)];
-                    case 1:
-                        authRes = _a.sent();
-                        token = authRes.body.data.token;
-                        return [4 /*yield*/, server
-                                .get("/food?limit=3&".concat(qs_1.default.stringify({
-                                created: {
-                                    $gte: "2021-12-03T00:00:00.000Z",
-                                    $lte: "2021-12-03T00:00:20.000Z",
-                                },
-                            })))
-                                .set("authorization", "Bearer ".concat(token))
-                                .expect(200)];
-                    case 2:
-                        res = _a.sent();
-                        (0, bun_test_1.expect)(res.body.data.map(function (d) { return d.created; })).toEqual(bun_test_1.expect.arrayContaining([
-                            "2021-12-03T00:00:20.000Z",
-                            "2021-12-03T00:00:10.000Z",
-                            "2021-12-03T00:00:00.000Z",
-                        ]));
-                        (0, bun_test_1.expect)(res.body.data.map(function (d) { return d.created; })).toHaveLength(3);
-                        return [4 /*yield*/, server
-                                .get("/food?limit=3&".concat(qs_1.default.stringify({
-                                created: {
-                                    $gte: "2021-12-03T00:00:00.000Z",
-                                    $lt: "2021-12-03T00:00:20.000Z",
-                                },
-                            })))
-                                .set("authorization", "Bearer ".concat(token))
-                                .expect(200)];
-                    case 3:
-                        // Inclusive one side
-                        res = _a.sent();
-                        (0, bun_test_1.expect)(res.body.data.map(function (d) { return d.created; })).toEqual(bun_test_1.expect.arrayContaining(["2021-12-03T00:00:10.000Z", "2021-12-03T00:00:00.000Z"]));
-                        (0, bun_test_1.expect)(res.body.data.map(function (d) { return d.created; })).toHaveLength(2);
-                        return [4 /*yield*/, server
-                                .get("/food?limit=3&".concat(qs_1.default.stringify({
-                                created: {
-                                    $gt: "2021-12-03T00:00:00.000Z",
-                                    $lt: "2021-12-03T00:00:20.000Z",
-                                },
-                            })))
-                                .set("authorization", "Bearer ".concat(token))
-                                .expect(200)];
-                    case 4:
-                        // Inclusive both sides
-                        res = _a.sent();
-                        createdDates = res.body.data.map(function (d) { return d.created; });
-                        (0, bun_test_1.expect)(createdDates).toEqual(bun_test_1.expect.arrayContaining(["2021-12-03T00:00:10.000Z"]));
-                        (0, bun_test_1.expect)(createdDates).toHaveLength(1);
-                        return [2 /*return*/];
-                }
-            });
-        }); });
-        (0, bun_test_1.it)("query with a space", function () { return __awaiter(void 0, void 0, void 0, function () {
-            var greenBeans, res;
-            return __generator(this, function (_a) {
-                switch (_a.label) {
-                    case 0: return [4 /*yield*/, tests_1.FoodModel.create({
-                            calories: 102,
-                            created: Date.now() - 10,
-                            name: "Green Beans",
-                            ownerId: admin === null || admin === void 0 ? void 0 : admin._id,
-                        })];
-                    case 1:
-                        greenBeans = _a.sent();
-                        return [4 /*yield*/, agent.get("/food?".concat(qs_1.default.stringify({ name: "Green Beans" }))).expect(200)];
-                    case 2:
-                        res = _a.sent();
-                        (0, bun_test_1.expect)(res.body.data).toHaveLength(1);
-                        (0, bun_test_1.expect)(res.body.data[0].id).toBe(greenBeans === null || greenBeans === void 0 ? void 0 : greenBeans.id);
-                        (0, bun_test_1.expect)(res.body.data[0].name).toBe("Green Beans");
-                        return [2 /*return*/];
-                }
-            });
-        }); });
-        (0, bun_test_1.it)("query with a regex", function () { return __awaiter(void 0, void 0, void 0, function () {
-            var greenBeans, res;
-            return __generator(this, function (_a) {
-                switch (_a.label) {
-                    case 0: return [4 /*yield*/, tests_1.FoodModel.create({
-                            calories: 102,
-                            created: Date.now() - 10,
-                            name: "Green Beans",
-                            ownerId: admin === null || admin === void 0 ? void 0 : admin._id,
-                        })];
-                    case 1:
-                        greenBeans = _a.sent();
-                        return [4 /*yield*/, agent.get("/food?".concat(qs_1.default.stringify({ name: { $regex: "Green" } }))).expect(200)];
-                    case 2:
-                        res = _a.sent();
-                        (0, bun_test_1.expect)(res.body.data).toHaveLength(1);
-                        (0, bun_test_1.expect)(res.body.data[0].id).toBe(greenBeans === null || greenBeans === void 0 ? void 0 : greenBeans.id);
-                        (0, bun_test_1.expect)(res.body.data[0].name).toBe("Green Beans");
-                        return [4 /*yield*/, agent.get("/food?".concat(qs_1.default.stringify({ name: { $regex: "green" } }))).expect(200)];
-                    case 3:
-                        // Fails with different casing and sensitive
-                        res = _a.sent();
-                        (0, bun_test_1.expect)(res.body.data).toHaveLength(0);
-                        return [4 /*yield*/, agent
-                                .get("/food?".concat(qs_1.default.stringify({ name: { $options: "i", $regex: "green" } })))
-                                .expect(200)];
-                    case 4:
-                        // Case insensitive does match different casing
-                        res = _a.sent();
-                        (0, bun_test_1.expect)(res.body.data).toHaveLength(1);
-                        (0, bun_test_1.expect)(res.body.data[0].id).toBe(greenBeans === null || greenBeans === void 0 ? void 0 : greenBeans.id);
-                        return [2 /*return*/];
-                }
-            });
-        }); });
-        (0, bun_test_1.it)("query with an $in operator", function () { return __awaiter(void 0, void 0, void 0, function () {
-            var res, names1, names2;
-            return __generator(this, function (_a) {
-                switch (_a.label) {
-                    case 0: return [4 /*yield*/, server
-                            .get("/food?".concat(qs_1.default.stringify({
-                            name: {
-                                $in: ["Apple", "Spinach"],
-                            },
-                        })))
-                            .expect(200)];
-                    case 1:
-                        res = _a.sent();
-                        names1 = res.body.data.map(function (d) { return d.name; });
-                        (0, bun_test_1.expect)(names1).toEqual(bun_test_1.expect.arrayContaining(["Spinach"]));
-                        (0, bun_test_1.expect)(names1).toHaveLength(1);
-                        return [4 /*yield*/, server
-                                .get("/food?".concat(qs_1.default.stringify({
-                                name: {
-                                    $in: ["Carrots", "Spinach"],
-                                },
-                            })))
-                                .expect(200)];
-                    case 2:
-                        // Query without hidden food.
-                        res = _a.sent();
-                        names2 = res.body.data.map(function (d) { return d.name; });
-                        (0, bun_test_1.expect)(names2).toEqual(bun_test_1.expect.arrayContaining(["Spinach", "Carrots"]));
-                        (0, bun_test_1.expect)(names2).toHaveLength(2);
-                        return [2 /*return*/];
-                }
-            });
-        }); });
-        (0, bun_test_1.it)("query with an $in for _ids in nested object", function () { return __awaiter(void 0, void 0, void 0, function () {
-            var res, names3;
-            return __generator(this, function (_a) {
-                switch (_a.label) {
-                    case 0: return [4 /*yield*/, server
-                            .get("/food?".concat(qs_1.default.stringify({
-                            eatenBy: {
-                                $in: [notAdmin._id.toString(), adminOther._id.toString()],
-                            },
-                        })))
-                            .expect(200)];
-                    case 1:
-                        res = _a.sent();
-                        (0, bun_test_1.expect)(res.body.more).toBe(false);
-                        (0, bun_test_1.expect)(res.body.total).toBe(2);
-                        (0, bun_test_1.expect)(res.body.data).toHaveLength(2);
-                        names3 = res.body.data.map(function (d) { return d.name; });
-                        (0, bun_test_1.expect)(names3).toEqual(bun_test_1.expect.arrayContaining(["Carrots", "Pizza"]));
-                        (0, bun_test_1.expect)(names3).toHaveLength(2);
-                        return [2 /*return*/];
-                }
-            });
-        }); });
-        (0, bun_test_1.it)("query $and operator on same field", function () { return __awaiter(void 0, void 0, void 0, function () {
-            var res;
-            return __generator(this, function (_a) {
-                switch (_a.label) {
-                    case 0: return [4 /*yield*/, agent
-                            .get("/food?".concat(qs_1.default.stringify({ $and: [{ tags: "healthy" }, { tags: "cheap" }] })))
-                            .expect(200)];
-                    case 1:
-                        res = _a.sent();
-                        (0, bun_test_1.expect)(res.body.data).toHaveLength(1);
-                        (0, bun_test_1.expect)(res.body.data[0].id).toBe(carrots === null || carrots === void 0 ? void 0 : carrots._id.toString());
-                        return [2 /*return*/];
-                }
-            });
-        }); });
-        (0, bun_test_1.it)("query $and operator on same field, nested objects", function () { return __awaiter(void 0, void 0, void 0, function () {
-            var res;
-            return __generator(this, function (_a) {
-                switch (_a.label) {
-                    case 0: return [4 /*yield*/, agent
-                            .get("/food?".concat(qs_1.default.stringify({
-                            $and: [{ eatenBy: admin.id }, { eatenBy: notAdmin.id }],
-                        })))
-                            .expect(200)];
-                    case 1:
-                        res = _a.sent();
-                        (0, bun_test_1.expect)(res.body.data).toHaveLength(1);
-                        (0, bun_test_1.expect)(res.body.data[0].id).toBe(carrots === null || carrots === void 0 ? void 0 : carrots._id.toString());
-                        return [2 /*return*/];
-                }
-            });
-        }); });
-        (0, bun_test_1.it)("query $or operator on same field", function () { return __awaiter(void 0, void 0, void 0, function () {
-            var res, ids1;
-            return __generator(this, function (_a) {
-                switch (_a.label) {
-                    case 0: return [4 /*yield*/, agent
-                            .get("/food?".concat(qs_1.default.stringify({ $or: [{ name: "Carrots" }, { name: "Pizza" }] })))
-                            .expect(200)];
-                    case 1:
-                        res = _a.sent();
-                        (0, bun_test_1.expect)(res.body.data).toHaveLength(2);
-                        ids1 = res.body.data.map(function (d) { return d.id; });
-                        (0, bun_test_1.expect)(ids1).toEqual(bun_test_1.expect.arrayContaining([carrots === null || carrots === void 0 ? void 0 : carrots._id.toString(), pizza === null || pizza === void 0 ? void 0 : pizza._id.toString()]));
-                        (0, bun_test_1.expect)(ids1).toHaveLength(2);
-                        return [2 /*return*/];
-                }
-            });
-        }); });
-        (0, bun_test_1.it)("query $and operator on same field, nested objects", function () { return __awaiter(void 0, void 0, void 0, function () {
-            var res, ids2;
-            return __generator(this, function (_a) {
-                switch (_a.label) {
-                    case 0: return [4 /*yield*/, agent
-                            .get("/food?".concat(qs_1.default.stringify({
-                            $or: [{ eatenBy: admin.id }, { eatenBy: notAdmin.id }],
-                            limit: 3,
-                        })))
-                            .expect(200)];
-                    case 1:
-                        res = _a.sent();
-                        (0, bun_test_1.expect)(res.body.data).toHaveLength(2);
-                        ids2 = res.body.data.map(function (d) { return d.id; });
-                        (0, bun_test_1.expect)(ids2).toEqual(bun_test_1.expect.arrayContaining([carrots === null || carrots === void 0 ? void 0 : carrots._id.toString(), spinach === null || spinach === void 0 ? void 0 : spinach._id.toString()]));
-                        (0, bun_test_1.expect)(ids2).toHaveLength(2);
-                        return [2 /*return*/];
-                }
-            });
-        }); });
-        (0, bun_test_1.it)("query $and and $or are rejected if field is not in queryFields", function () { return __awaiter(void 0, void 0, void 0, function () {
-            var res;
-            return __generator(this, function (_a) {
-                switch (_a.label) {
-                    case 0: return [4 /*yield*/, agent
-                            .get("/food?".concat(qs_1.default.stringify({ $and: [{ ownerId: "healthy" }, { tags: "cheap" }] })))
-                            .expect(400)];
-                    case 1:
-                        res = _a.sent();
-                        (0, bun_test_1.expect)(res.body.title).toBe("ownerId is not allowed as a query param.");
-                        return [4 /*yield*/, agent
-                                .get("/food?".concat(qs_1.default.stringify({ $and: [{ tags: "cheap" }, { ownerId: "healthy" }] })))
-                                .expect(400)];
-                    case 2:
-                        // Check in the other order
-                        res = _a.sent();
-                        (0, bun_test_1.expect)(res.body.title).toBe("ownerId is not allowed as a query param.");
-                        return [4 /*yield*/, agent
-                                .get("/food?".concat(qs_1.default.stringify({ $or: [{ tags: "cheap" }, { ownerId: "healthy" }] })))
-                                .expect(400)];
-                    case 3:
-                        res = _a.sent();
-                        (0, bun_test_1.expect)(res.body.title).toBe("ownerId is not allowed as a query param.");
-                        return [2 /*return*/];
-                }
-            });
-        }); });
-        (0, bun_test_1.it)("query with a number", function () { return __awaiter(void 0, void 0, void 0, function () {
-            var res;
-            return __generator(this, function (_a) {
-                switch (_a.label) {
-                    case 0: return [4 /*yield*/, agent.get("/food?calories=100").expect(200)];
-                    case 1:
-                        res = _a.sent();
-                        (0, bun_test_1.expect)(res.body.data).toHaveLength(1);
-                        (0, bun_test_1.expect)(res.body.data[0].id).toBe(carrots === null || carrots === void 0 ? void 0 : carrots._id.toString());
-                        return [2 /*return*/];
-                }
-            });
-        }); });
-        (0, bun_test_1.it)("update", function () { return __awaiter(void 0, void 0, void 0, function () {
-            var res;
-            return __generator(this, function (_a) {
-                switch (_a.label) {
-                    case 0: return [4 /*yield*/, agent.patch("/food/".concat(spinach._id)).send({ name: "Kale" }).expect(200)];
-                    case 1:
-                        res = _a.sent();
-                        (0, bun_test_1.expect)(res.body.data.name).toBe("Kale");
-                        (0, bun_test_1.expect)(res.body.data.calories).toBe(1);
-                        (0, bun_test_1.expect)(res.body.data.hidden).toBe(false);
-                        return [4 /*yield*/, agent
-                                .patch("/food/".concat(spinach._id))
-                                .send({ lastEatenWith: { dressing: "2023-12-03T00:00:20.000Z" } })
-                                .expect(200)];
-                    case 2:
-                        // Update a Map field.
-                        res = _a.sent();
-                        (0, bun_test_1.expect)(res.body.data.name).toBe("Kale");
-                        (0, bun_test_1.expect)(res.body.data.calories).toBe(1);
-                        (0, bun_test_1.expect)(res.body.data.hidden).toBe(false);
-                        (0, bun_test_1.expect)(res.body.data.lastEatenWith).toEqual({
-                            dressing: "2023-12-03T00:00:20.000Z",
-                        });
-                        return [4 /*yield*/, agent
-                                .patch("/food/".concat(spinach._id))
-                                .send({
-                                lastEatenWith: {
-                                    cucumber: "2023-12-04T12:00:20.000Z",
-                                    dressing: "2023-12-03T00:00:20.000Z",
-                                },
-                            })
-                                .expect(200)];
-                    case 3:
-                        // Update a Map field.
-                        res = _a.sent();
-                        (0, bun_test_1.expect)(res.body.data.lastEatenWith).toEqual({
-                            cucumber: "2023-12-04T12:00:20.000Z",
-                            dressing: "2023-12-03T00:00:20.000Z",
-                        });
-                        return [2 /*return*/];
-                }
-            });
-        }); });
-        (0, bun_test_1.it)("update using dot notation", function () { return __awaiter(void 0, void 0, void 0, function () {
-            var res, dbSpinach;
-            return __generator(this, function (_a) {
-                switch (_a.label) {
-                    case 0: return [4 /*yield*/, agent
-                            .patch("/food/".concat(spinach._id))
-                            .send({ "source.href": "https://food.com" })
-                            .expect(200)];
-                    case 1:
-                        res = _a.sent();
-                        // Assert the field was updated with dot notation.
-                        (0, bun_test_1.expect)(res.body.data.source.href).toBe("https://food.com");
-                        // Assert these fields haven't changed.
-                        (0, bun_test_1.expect)(res.body.data.source.name).toBe("Brand");
-                        (0, bun_test_1.expect)(res.body.data.source.dateAdded).toBe("2023-12-13T12:30:00.000Z");
-                        return [4 /*yield*/, tests_1.FoodModel.findById(spinach._id)];
-                    case 2:
-                        dbSpinach = _a.sent();
-                        (0, bun_test_1.expect)(dbSpinach === null || dbSpinach === void 0 ? void 0 : dbSpinach.source.href).toBe("https://food.com");
-                        (0, bun_test_1.expect)(dbSpinach === null || dbSpinach === void 0 ? void 0 : dbSpinach.source.name).toBe("Brand");
-                        (0, bun_test_1.expect)(dbSpinach === null || dbSpinach === void 0 ? void 0 : dbSpinach.source.dateAdded).toBe("2023-12-13T12:30:00.000Z");
-                        return [2 /*return*/];
-                }
-            });
-        }); });
-    });
-    (0, bun_test_1.describe)("populate", function () {
-        var admin;
-        var notAdmin;
-        var agent;
-        var spinach;
-        (0, bun_test_1.beforeEach)(function () { return __awaiter(void 0, void 0, void 0, function () {
-            var _a, _b;
-            return __generator(this, function (_c) {
-                switch (_c.label) {
-                    case 0: return [4 /*yield*/, (0, tests_1.setupDb)()];
-                    case 1:
-                        _a = __read.apply(void 0, [_c.sent(), 2]), admin = _a[0], notAdmin = _a[1];
-                        return [4 /*yield*/, Promise.all([
-                                tests_1.FoodModel.create({
-                                    calories: 1,
-                                    created: new Date("2021-12-03T00:00:20.000Z"),
-                                    hidden: false,
-                                    name: "Spinach",
-                                    ownerId: admin._id,
-                                    source: {
-                                        name: "Brand",
-                                    },
-                                }),
-                                tests_1.FoodModel.create({
-                                    calories: 1,
-                                    created: new Date("2022-12-03T00:00:20.000Z"),
-                                    hidden: false,
-                                    name: "Carrots",
-                                    ownerId: notAdmin._id,
-                                    source: {
-                                        name: "User",
-                                    },
-                                }),
-                            ])];
-                    case 2:
-                        _b = __read.apply(void 0, [_c.sent(), 1]), spinach = _b[0];
-                        app = (0, tests_1.getBaseServer)();
-                        (0, auth_1.setupAuth)(app, tests_1.UserModel);
-                        (0, auth_1.addAuthRoutes)(app, tests_1.UserModel);
-                        app.use("/food", (0, api_1.modelRouter)(tests_1.FoodModel, {
-                            allowAnonymous: true,
-                            permissions: {
-                                create: [permissions_1.Permissions.IsAny],
-                                delete: [permissions_1.Permissions.IsAny],
-                                list: [permissions_1.Permissions.IsAny],
-                                read: [permissions_1.Permissions.IsAny],
-                                update: [permissions_1.Permissions.IsAny],
-                            },
-                            populatePaths: [{ fields: ["email"], path: "ownerId" }],
-                            sort: "-created",
-                        }));
-                        server = (0, supertest_1.default)(app);
-                        return [4 /*yield*/, (0, tests_1.authAsUser)(app, "notAdmin")];
-                    case 3:
-                        agent = _c.sent();
-                        return [2 /*return*/];
-                }
-            });
-        }); });
-        (0, bun_test_1.it)("lists with populate", function () { return __awaiter(void 0, void 0, void 0, function () {
-            var res, _a, carrots, spin;
-            return __generator(this, function (_b) {
-                switch (_b.label) {
-                    case 0: return [4 /*yield*/, agent.get("/food").expect(200)];
-                    case 1:
-                        res = _b.sent();
-                        (0, bun_test_1.expect)(res.body.data).toHaveLength(2);
-                        _a = __read(res.body.data, 2), carrots = _a[0], spin = _a[1];
-                        (0, bun_test_1.expect)(carrots.ownerId._id).toBe(notAdmin._id.toString());
-                        (0, bun_test_1.expect)(carrots.ownerId.email).toBe(notAdmin.email);
-                        (0, bun_test_1.expect)(carrots.ownerId.name).toBeUndefined();
-                        (0, bun_test_1.expect)(spin.ownerId._id).toBe(admin._id.toString());
-                        (0, bun_test_1.expect)(spin.ownerId.email).toBe(admin.email);
-                        (0, bun_test_1.expect)(spin.ownerId.name).toBeUndefined();
-                        return [2 /*return*/];
-                }
-            });
-        }); });
-        (0, bun_test_1.it)("reads with populate", function () { return __awaiter(void 0, void 0, void 0, function () {
-            var res;
-            return __generator(this, function (_a) {
-                switch (_a.label) {
-                    case 0: return [4 /*yield*/, agent.get("/food/".concat(spinach._id)).expect(200)];
-                    case 1:
-                        res = _a.sent();
-                        (0, bun_test_1.expect)(res.body.data.ownerId._id).toBe(admin._id.toString());
-                        (0, bun_test_1.expect)(res.body.data.ownerId.email).toBe(admin.email);
-                        (0, bun_test_1.expect)(res.body.data.ownerId.name).toBeUndefined();
-                        return [2 /*return*/];
-                }
-            });
-        }); });
-        (0, bun_test_1.it)("creates with populate", function () { return __awaiter(void 0, void 0, void 0, function () {
-            var res;
-            return __generator(this, function (_a) {
-                switch (_a.label) {
-                    case 0: return [4 /*yield*/, server
-                            .post("/food")
-                            .send({
-                            calories: 15,
-                            name: "Broccoli",
-                            ownerId: admin._id,
-                        })
-                            .expect(201)];
-                    case 1:
-                        res = _a.sent();
-                        (0, bun_test_1.expect)(res.body.data.ownerId._id).toBe(admin._id.toString());
-                        (0, bun_test_1.expect)(res.body.data.ownerId.email).toBe(admin.email);
-                        (0, bun_test_1.expect)(res.body.data.ownerId.name).toBeUndefined();
-                        return [2 /*return*/];
-                }
-            });
-        }); });
-        (0, bun_test_1.it)("updates with populate", function () { return __awaiter(void 0, void 0, void 0, function () {
-            var res;
-            return __generator(this, function (_a) {
-                switch (_a.label) {
-                    case 0: return [4 /*yield*/, server
-                            .patch("/food/".concat(spinach._id))
-                            .send({
-                            name: "NotSpinach",
-                        })
-                            .expect(200)];
-                    case 1:
-                        res = _a.sent();
-                        (0, bun_test_1.expect)(res.body.data.ownerId._id).toBe(admin._id.toString());
-                        (0, bun_test_1.expect)(res.body.data.ownerId.email).toBe(admin.email);
-                        (0, bun_test_1.expect)(res.body.data.ownerId.name).toBeUndefined();
-                        return [2 /*return*/];
-                }
-            });
-        }); });
-    });
-    (0, bun_test_1.describe)("responseHandler", function () {
-        var admin;
-        var agent;
-        var spinach;
-        (0, bun_test_1.beforeEach)(function () { return __awaiter(void 0, void 0, void 0, function () {
-            var _a, _b;
-            return __generator(this, function (_c) {
-                switch (_c.label) {
-                    case 0: return [4 /*yield*/, (0, tests_1.setupDb)()];
-                    case 1:
-                        _a = __read.apply(void 0, [_c.sent(), 1]), admin = _a[0];
-                        return [4 /*yield*/, Promise.all([
-                                tests_1.FoodModel.create({
-                                    calories: 1,
-                                    created: new Date("2021-12-03T00:00:20.000Z"),
-                                    hidden: false,
-                                    name: "Spinach",
-                                    ownerId: admin._id,
-                                    source: {
-                                        name: "Brand",
-                                    },
-                                }),
-                                tests_1.FoodModel.create({
-                                    calories: 100,
-                                    created: Date.now() - 10,
-                                    hidden: true,
-                                    name: "Apple",
-                                    ownerId: admin === null || admin === void 0 ? void 0 : admin._id,
-                                }),
-                            ])];
-                    case 2:
-                        _b = __read.apply(void 0, [_c.sent(), 1]), spinach = _b[0];
-                        app = (0, tests_1.getBaseServer)();
-                        (0, auth_1.setupAuth)(app, tests_1.UserModel);
-                        (0, auth_1.addAuthRoutes)(app, tests_1.UserModel);
-                        app.use("/food", (0, api_1.modelRouter)(tests_1.FoodModel, {
-                            allowAnonymous: true,
-                            permissions: {
-                                create: [permissions_1.Permissions.IsAny],
-                                delete: [permissions_1.Permissions.IsAny],
-                                list: [permissions_1.Permissions.IsAny],
-                                read: [permissions_1.Permissions.IsAny],
-                                update: [permissions_1.Permissions.IsAny],
-                            },
-                            responseHandler: function (data, method) {
-                                if (method === "list") {
-                                    return data.map(function (d) { return ({
-                                        foo: "bar",
-                                        id: d._id,
-                                    }); });
-                                }
-                                return {
-                                    foo: "bar",
-                                    id: data._id,
-                                };
-                            },
-                        }));
-                        server = (0, supertest_1.default)(app);
-                        return [4 /*yield*/, (0, tests_1.authAsUser)(app, "notAdmin")];
-                    case 3:
-                        agent = _c.sent();
-                        return [2 /*return*/];
-                }
-            });
-        }); });
-        (0, bun_test_1.it)("reads with serialize", function () { return __awaiter(void 0, void 0, void 0, function () {
-            var res;
-            return __generator(this, function (_a) {
-                switch (_a.label) {
-                    case 0: return [4 /*yield*/, agent.get("/food/".concat(spinach._id)).expect(200)];
-                    case 1:
-                        res = _a.sent();
-                        (0, bun_test_1.expect)(res.body.data.ownerId).toBeUndefined();
-                        (0, bun_test_1.expect)(res.body.data.id).toBe(spinach._id.toString());
-                        (0, bun_test_1.expect)(res.body.data.foo).toBe("bar");
-                        return [2 /*return*/];
-                }
-            });
-        }); });
-        (0, bun_test_1.it)("list with serialize", function () { return __awaiter(void 0, void 0, void 0, function () {
-            var res;
-            return __generator(this, function (_a) {
-                switch (_a.label) {
-                    case 0: return [4 /*yield*/, agent.get("/food").expect(200)];
-                    case 1:
-                        res = _a.sent();
-                        (0, bun_test_1.expect)(res.body.data[0].ownerId).toBeUndefined();
-                        (0, bun_test_1.expect)(res.body.data[1].ownerId).toBeUndefined();
-                        (0, bun_test_1.expect)(res.body.data[0].id).toBeDefined();
-                        (0, bun_test_1.expect)(res.body.data[0].foo).toBe("bar");
-                        (0, bun_test_1.expect)(res.body.data[1].id).toBeDefined();
-                        (0, bun_test_1.expect)(res.body.data[1].foo).toBe("bar");
-                        return [2 /*return*/];
-                }
-            });
-        }); });
-    });
-    (0, bun_test_1.describe)("plugins", function () {
-        var agent;
-        (0, bun_test_1.beforeEach)(function () { return __awaiter(void 0, void 0, void 0, function () {
-            return __generator(this, function (_a) {
-                switch (_a.label) {
-                    case 0: return [4 /*yield*/, (0, tests_1.setupDb)()];
-                    case 1:
-                        _a.sent();
-                        app = (0, tests_1.getBaseServer)();
-                        (0, auth_1.setupAuth)(app, tests_1.UserModel);
-                        (0, auth_1.addAuthRoutes)(app, tests_1.UserModel);
-                        app.use("/users", (0, api_1.modelRouter)(tests_1.UserModel, {
-                            allowAnonymous: true,
-                            permissions: {
-                                create: [permissions_1.Permissions.IsAny],
-                                delete: [permissions_1.Permissions.IsAny],
-                                list: [permissions_1.Permissions.IsAny],
-                                read: [permissions_1.Permissions.IsAny],
-                                update: [permissions_1.Permissions.IsAny],
-                            },
-                        }));
-                        server = (0, supertest_1.default)(app);
-                        return [4 /*yield*/, (0, tests_1.authAsUser)(app, "notAdmin")];
-                    case 2:
-                        agent = _a.sent();
-                        return [2 /*return*/];
-                }
-            });
-        }); });
-        (0, bun_test_1.it)("check that security fields are filtered", function () { return __awaiter(void 0, void 0, void 0, function () {
-            var res;
-            return __generator(this, function (_a) {
-                switch (_a.label) {
-                    case 0: return [4 /*yield*/, agent.get("/users").expect(200)];
-                    case 1:
-                        res = _a.sent();
-                        (0, bun_test_1.expect)(res.body.data[0].email).toBeDefined();
-                        (0, bun_test_1.expect)(res.body.data[0].token).toBeUndefined();
-                        (0, bun_test_1.expect)(res.body.data[0].hash).toBeUndefined();
-                        (0, bun_test_1.expect)(res.body.data[0].salt).toBeUndefined();
-                        return [2 /*return*/];
-                }
-            });
-        }); });
-    });
-    (0, bun_test_1.describe)("error handling", function () {
-        var admin;
-        var agent;
-        var spinach;
-        (0, bun_test_1.beforeEach)(function () { return __awaiter(void 0, void 0, void 0, function () {
-            var _a;
-            return __generator(this, function (_b) {
-                switch (_b.label) {
-                    case 0: return [4 /*yield*/, (0, tests_1.setupDb)()];
-                    case 1:
-                        _a = __read.apply(void 0, [_b.sent(), 1]), admin = _a[0];
-                        return [4 /*yield*/, tests_1.FoodModel.create({
-                                calories: 1,
-                                created: new Date("2021-12-03T00:00:20.000Z"),
-                                hidden: false,
-                                name: "Spinach",
-                                ownerId: admin._id,
-                                source: {
-                                    name: "Brand",
-                                },
-                            })];
-                    case 2:
-                        spinach = _b.sent();
-                        app = (0, tests_1.getBaseServer)();
-                        (0, auth_1.setupAuth)(app, tests_1.UserModel);
-                        (0, auth_1.addAuthRoutes)(app, tests_1.UserModel);
-                        return [2 /*return*/];
-                }
-            });
-        }); });
-        (0, bun_test_1.it)("PUT returns 500 not supported", function () { return __awaiter(void 0, void 0, void 0, function () {
-            var res;
-            return __generator(this, function (_a) {
-                switch (_a.label) {
-                    case 0:
-                        app.use("/food", (0, api_1.modelRouter)(tests_1.FoodModel, {
-                            allowAnonymous: true,
-                            permissions: {
-                                create: [permissions_1.Permissions.IsAny],
-                                delete: [permissions_1.Permissions.IsAny],
-                                list: [permissions_1.Permissions.IsAny],
-                                read: [permissions_1.Permissions.IsAny],
-                                update: [permissions_1.Permissions.IsAny],
-                            },
-                        }));
-                        server = (0, supertest_1.default)(app);
-                        return [4 /*yield*/, server.put("/food/".concat(spinach._id)).send({ name: "Kale" }).expect(500)];
-                    case 1:
-                        res = _a.sent();
-                        (0, bun_test_1.expect)(res.body.title).toBe("PUT is not supported.");
-                        return [2 /*return*/];
-                }
-            });
-        }); });
-        (0, bun_test_1.it)("preCreate returning undefined throws error", function () { return __awaiter(void 0, void 0, void 0, function () {
-            var res;
-            return __generator(this, function (_a) {
-                switch (_a.label) {
-                    case 0:
-                        app.use("/food", (0, api_1.modelRouter)(tests_1.FoodModel, {
-                            allowAnonymous: true,
-                            permissions: {
-                                create: [permissions_1.Permissions.IsAny],
-                                delete: [permissions_1.Permissions.IsAny],
-                                list: [permissions_1.Permissions.IsAny],
-                                read: [permissions_1.Permissions.IsAny],
-                                update: [permissions_1.Permissions.IsAny],
-                            },
-                            preCreate: function () { return undefined; },
-                        }));
-                        server = (0, supertest_1.default)(app);
-                        return [4 /*yield*/, server.post("/food").send({ calories: 15, name: "Broccoli" }).expect(403)];
-                    case 1:
-                        res = _a.sent();
-                        (0, bun_test_1.expect)(res.body.title).toBe("Create not allowed");
-                        (0, bun_test_1.expect)(res.body.detail).toBe("A body must be returned from preCreate");
-                        return [2 /*return*/];
-                }
-            });
-        }); });
-        (0, bun_test_1.it)("preUpdate returning undefined throws error", function () { return __awaiter(void 0, void 0, void 0, function () {
-            var res;
-            return __generator(this, function (_a) {
-                switch (_a.label) {
-                    case 0:
-                        app.use("/food", (0, api_1.modelRouter)(tests_1.FoodModel, {
-                            allowAnonymous: true,
-                            permissions: {
-                                create: [permissions_1.Permissions.IsAny],
-                                delete: [permissions_1.Permissions.IsAny],
-                                list: [permissions_1.Permissions.IsAny],
-                                read: [permissions_1.Permissions.IsAny],
-                                update: [permissions_1.Permissions.IsAny],
-                            },
-                            preUpdate: function () { return undefined; },
-                        }));
-                        server = (0, supertest_1.default)(app);
-                        return [4 /*yield*/, server.patch("/food/".concat(spinach._id)).send({ name: "Kale" }).expect(403)];
-                    case 1:
-                        res = _a.sent();
-                        (0, bun_test_1.expect)(res.body.title).toBe("Update not allowed");
-                        (0, bun_test_1.expect)(res.body.detail).toBe("A body must be returned from preUpdate");
-                        return [2 /*return*/];
-                }
-            });
-        }); });
-        (0, bun_test_1.it)("preDelete returning undefined throws error", function () { return __awaiter(void 0, void 0, void 0, function () {
-            var res;
-            return __generator(this, function (_a) {
-                switch (_a.label) {
-                    case 0:
-                        app.use("/food", (0, api_1.modelRouter)(tests_1.FoodModel, {
-                            allowAnonymous: true,
-                            permissions: {
-                                create: [permissions_1.Permissions.IsAny],
-                                delete: [permissions_1.Permissions.IsAny],
-                                list: [permissions_1.Permissions.IsAny],
-                                read: [permissions_1.Permissions.IsAny],
-                                update: [permissions_1.Permissions.IsAny],
-                            },
-                            preDelete: function () { return undefined; },
-                        }));
-                        server = (0, supertest_1.default)(app);
-                        return [4 /*yield*/, (0, tests_1.authAsUser)(app, "notAdmin")];
-                    case 1:
-                        agent = _a.sent();
-                        return [4 /*yield*/, agent.delete("/food/".concat(spinach._id)).expect(403)];
-                    case 2:
-                        res = _a.sent();
-                        (0, bun_test_1.expect)(res.body.title).toBe("Delete not allowed");
-                        (0, bun_test_1.expect)(res.body.detail).toBe("A body must be returned from preDelete");
-                        return [2 /*return*/];
-                }
-            });
-        }); });
-        (0, bun_test_1.it)("postCreate hook error is handled", function () { return __awaiter(void 0, void 0, void 0, function () {
-            var res;
-            return __generator(this, function (_a) {
-                switch (_a.label) {
-                    case 0:
-                        app.use("/food", (0, api_1.modelRouter)(tests_1.FoodModel, {
-                            allowAnonymous: true,
-                            permissions: {
-                                create: [permissions_1.Permissions.IsAny],
-                                delete: [permissions_1.Permissions.IsAny],
-                                list: [permissions_1.Permissions.IsAny],
-                                read: [permissions_1.Permissions.IsAny],
-                                update: [permissions_1.Permissions.IsAny],
-                            },
-                            postCreate: function () {
-                                throw new Error("postCreate failed");
-                            },
-                        }));
-                        server = (0, supertest_1.default)(app);
-                        return [4 /*yield*/, server.post("/food").send({ calories: 15, name: "Broccoli" }).expect(400)];
-                    case 1:
-                        res = _a.sent();
-                        (0, bun_test_1.expect)(res.body.title).toContain("postCreate hook error");
-                        return [2 /*return*/];
-                }
-            });
-        }); });
-        (0, bun_test_1.it)("postUpdate hook error is handled", function () { return __awaiter(void 0, void 0, void 0, function () {
-            var res;
-            return __generator(this, function (_a) {
-                switch (_a.label) {
-                    case 0:
-                        app.use("/food", (0, api_1.modelRouter)(tests_1.FoodModel, {
-                            allowAnonymous: true,
-                            permissions: {
-                                create: [permissions_1.Permissions.IsAny],
-                                delete: [permissions_1.Permissions.IsAny],
-                                list: [permissions_1.Permissions.IsAny],
-                                read: [permissions_1.Permissions.IsAny],
-                                update: [permissions_1.Permissions.IsAny],
-                            },
-                            postUpdate: function () {
-                                throw new Error("postUpdate failed");
-                            },
-                        }));
-                        server = (0, supertest_1.default)(app);
-                        return [4 /*yield*/, server.patch("/food/".concat(spinach._id)).send({ name: "Kale" }).expect(400)];
-                    case 1:
-                        res = _a.sent();
-                        (0, bun_test_1.expect)(res.body.title).toContain("postUpdate hook error");
-                        return [2 /*return*/];
-                }
-            });
-        }); });
-        (0, bun_test_1.it)("postDelete hook error is handled", function () { return __awaiter(void 0, void 0, void 0, function () {
-            var res;
-            return __generator(this, function (_a) {
-                switch (_a.label) {
-                    case 0:
-                        app.use("/food", (0, api_1.modelRouter)(tests_1.FoodModel, {
-                            allowAnonymous: true,
-                            permissions: {
-                                create: [permissions_1.Permissions.IsAny],
-                                delete: [permissions_1.Permissions.IsAny],
-                                list: [permissions_1.Permissions.IsAny],
-                                read: [permissions_1.Permissions.IsAny],
-                                update: [permissions_1.Permissions.IsAny],
-                            },
-                            postDelete: function () {
-                                throw new Error("postDelete failed");
-                            },
-                        }));
-                        server = (0, supertest_1.default)(app);
-                        return [4 /*yield*/, (0, tests_1.authAsUser)(app, "notAdmin")];
-                    case 1:
-                        agent = _a.sent();
-                        return [4 /*yield*/, agent.delete("/food/".concat(spinach._id)).expect(400)];
-                    case 2:
-                        res = _a.sent();
-                        (0, bun_test_1.expect)(res.body.title).toContain("postDelete hook error");
-                        return [2 /*return*/];
-                }
-            });
-        }); });
-        (0, bun_test_1.it)("responseHandler error in read is handled", function () { return __awaiter(void 0, void 0, void 0, function () {
-            var res;
-            return __generator(this, function (_a) {
-                switch (_a.label) {
-                    case 0:
-                        app.use("/food", (0, api_1.modelRouter)(tests_1.FoodModel, {
-                            allowAnonymous: true,
-                            permissions: {
-                                create: [permissions_1.Permissions.IsAny],
-                                delete: [permissions_1.Permissions.IsAny],
-                                list: [permissions_1.Permissions.IsAny],
-                                read: [permissions_1.Permissions.IsAny],
-                                update: [permissions_1.Permissions.IsAny],
-                            },
-                            responseHandler: function (_data, method) {
-                                if (method === "read") {
-                                    throw new Error("responseHandler read failed");
-                                }
-                                return {};
-                            },
-                        }));
-                        server = (0, supertest_1.default)(app);
-                        return [4 /*yield*/, server.get("/food/".concat(spinach._id)).expect(500)];
-                    case 1:
-                        res = _a.sent();
-                        (0, bun_test_1.expect)(res.body.title).toContain("responseHandler error");
-                        return [2 /*return*/];
-                }
-            });
-        }); });
-        (0, bun_test_1.it)("responseHandler error in create is handled", function () { return __awaiter(void 0, void 0, void 0, function () {
-            var res;
-            return __generator(this, function (_a) {
-                switch (_a.label) {
-                    case 0:
-                        app.use("/food", (0, api_1.modelRouter)(tests_1.FoodModel, {
-                            allowAnonymous: true,
-                            permissions: {
-                                create: [permissions_1.Permissions.IsAny],
-                                delete: [permissions_1.Permissions.IsAny],
-                                list: [permissions_1.Permissions.IsAny],
-                                read: [permissions_1.Permissions.IsAny],
-                                update: [permissions_1.Permissions.IsAny],
-                            },
-                            responseHandler: function (_data, method) {
-                                if (method === "create") {
-                                    throw new Error("responseHandler create failed");
-                                }
-                                return {};
-                            },
-                        }));
-                        server = (0, supertest_1.default)(app);
-                        return [4 /*yield*/, server.post("/food").send({ calories: 15, name: "Broccoli" }).expect(500)];
-                    case 1:
-                        res = _a.sent();
-                        (0, bun_test_1.expect)(res.body.title).toContain("responseHandler error");
-                        return [2 /*return*/];
-                }
-            });
-        }); });
-        (0, bun_test_1.it)("responseHandler error in update is handled", function () { return __awaiter(void 0, void 0, void 0, function () {
-            var res;
-            return __generator(this, function (_a) {
-                switch (_a.label) {
-                    case 0:
-                        app.use("/food", (0, api_1.modelRouter)(tests_1.FoodModel, {
-                            allowAnonymous: true,
-                            permissions: {
-                                create: [permissions_1.Permissions.IsAny],
-                                delete: [permissions_1.Permissions.IsAny],
-                                list: [permissions_1.Permissions.IsAny],
-                                read: [permissions_1.Permissions.IsAny],
-                                update: [permissions_1.Permissions.IsAny],
-                            },
-                            responseHandler: function (_data, method) {
-                                if (method === "update") {
-                                    throw new Error("responseHandler update failed");
-                                }
-                                return {};
-                            },
-                        }));
-                        server = (0, supertest_1.default)(app);
-                        return [4 /*yield*/, server.patch("/food/".concat(spinach._id)).send({ name: "Kale" }).expect(500)];
-                    case 1:
-                        res = _a.sent();
-                        (0, bun_test_1.expect)(res.body.title).toContain("responseHandler error");
-                        return [2 /*return*/];
-                }
-            });
-        }); });
-        (0, bun_test_1.it)("responseHandler error in list is handled", function () { return __awaiter(void 0, void 0, void 0, function () {
-            var res;
-            return __generator(this, function (_a) {
-                switch (_a.label) {
-                    case 0:
-                        app.use("/food", (0, api_1.modelRouter)(tests_1.FoodModel, {
-                            allowAnonymous: true,
-                            permissions: {
-                                create: [permissions_1.Permissions.IsAny],
-                                delete: [permissions_1.Permissions.IsAny],
-                                list: [permissions_1.Permissions.IsAny],
-                                read: [permissions_1.Permissions.IsAny],
-                                update: [permissions_1.Permissions.IsAny],
-                            },
-                            responseHandler: function (_data, method) {
-                                if (method === "list") {
-                                    throw new Error("responseHandler list failed");
-                                }
-                                return {};
-                            },
-                        }));
-                        server = (0, supertest_1.default)(app);
-                        return [4 /*yield*/, server.get("/food").expect(500)];
-                    case 1:
-                        res = _a.sent();
-                        (0, bun_test_1.expect)(res.body.title).toContain("responseHandler error");
-                        return [2 /*return*/];
-                }
-            });
-        }); });
-        (0, bun_test_1.it)("list with non-array responseHandler returns data directly", function () { return __awaiter(void 0, void 0, void 0, function () {
-            var res;
-            return __generator(this, function (_a) {
-                switch (_a.label) {
-                    case 0:
-                        app.use("/food", (0, api_1.modelRouter)(tests_1.FoodModel, {
-                            allowAnonymous: true,
-                            permissions: {
-                                create: [permissions_1.Permissions.IsAny],
-                                delete: [permissions_1.Permissions.IsAny],
-                                list: [permissions_1.Permissions.IsAny],
-                                read: [permissions_1.Permissions.IsAny],
-                                update: [permissions_1.Permissions.IsAny],
-                            },
-                            responseHandler: function (_data, method) {
-                                if (method === "list") {
-                                    return { custom: "response" };
-                                }
-                                return {};
-                            },
-                        }));
-                        server = (0, supertest_1.default)(app);
-                        return [4 /*yield*/, server.get("/food").expect(200)];
-                    case 1:
-                        res = _a.sent();
-                        (0, bun_test_1.expect)(res.body.data).toEqual({ custom: "response" });
-                        (0, bun_test_1.expect)(res.body.more).toBeUndefined();
-                        (0, bun_test_1.expect)(res.body.total).toBeUndefined();
-                        return [2 /*return*/];
-                }
-            });
-        }); });
-        (0, bun_test_1.it)("list with query sort param", function () { return __awaiter(void 0, void 0, void 0, function () {
-            var res;
-            return __generator(this, function (_a) {
-                switch (_a.label) {
-                    case 0: return [4 /*yield*/, tests_1.FoodModel.create({
-                            calories: 200,
-                            created: new Date("2021-12-04T00:00:20.000Z"),
-                            hidden: false,
-                            name: "Apple",
-                            ownerId: admin._id,
-                        })];
-                    case 1:
-                        _a.sent();
+                                }),
+                                tests_1.FoodModel.create({
+                                    calories: 1,
+                                    created: new Date("2022-12-03T00:00:20.000Z"),
+                                    hidden: false,
+                                    name: "Carrots",
+                                    ownerId: notAdmin._id,
+                                    source: {
+                                        name: "User",
+                                    },
+                                }),
+                            ])];
+                    case 2:
+                        _b = __read.apply(void 0, [_c.sent(), 1]), spinach = _b[0];
+                        app = (0, tests_1.getBaseServer)();
+                        (0, auth_1.setupAuth)(app, tests_1.UserModel);
+                        (0, auth_1.addAuthRoutes)(app, tests_1.UserModel);
                         app.use("/food", (0, api_1.modelRouter)(tests_1.FoodModel, {
                             allowAnonymous: true,
                             permissions: {
@@ -2272,135 +146,126 @@ var transformers_1 = require("./transformers");
                                 read: [permissions_1.Permissions.IsAny],
                                 update: [permissions_1.Permissions.IsAny],
                             },
-                            queryFields: ["name"],
+                            populatePaths: [{ fields: ["email"], path: "ownerId" }],
+                            sort: "-created",
                         }));
                         server = (0, supertest_1.default)(app);
-                        return [4 /*yield*/, server.get("/food?sort=name").expect(200)];
-                    case 2:
-                        res = _a.sent();
-                        (0, bun_test_1.expect)(res.body.data[0].name).toBe("Apple");
-                        (0, bun_test_1.expect)(res.body.data[1].name).toBe("Spinach");
-                        return [4 /*yield*/, server.get("/food?sort=-name").expect(200)];
+                        return [4 /*yield*/, (0, tests_1.authAsUser)(app, "notAdmin")];
                     case 3:
-                        // Sort by name descending
-                        res = _a.sent();
-                        (0, bun_test_1.expect)(res.body.data[0].name).toBe("Spinach");
-                        (0, bun_test_1.expect)(res.body.data[1].name).toBe("Apple");
+                        agent = _c.sent();
                         return [2 /*return*/];
                 }
             });
         }); });
-        (0, bun_test_1.it)("queryFilter error is handled", function () { return __awaiter(void 0, void 0, void 0, function () {
-            var res;
-            return __generator(this, function (_a) {
-                switch (_a.label) {
-                    case 0:
-                        app.use("/food", (0, api_1.modelRouter)(tests_1.FoodModel, {
-                            allowAnonymous: true,
-                            permissions: {
-                                create: [permissions_1.Permissions.IsAny],
-                                delete: [permissions_1.Permissions.IsAny],
-                                list: [permissions_1.Permissions.IsAny],
-                                read: [permissions_1.Permissions.IsAny],
-                                update: [permissions_1.Permissions.IsAny],
-                            },
-                            queryFilter: function () {
-                                throw new Error("queryFilter failed");
-                            },
-                        }));
-                        server = (0, supertest_1.default)(app);
-                        return [4 /*yield*/, server.get("/food").expect(400)];
+        (0, bun_test_1.it)("lists with populate", function () { return __awaiter(void 0, void 0, void 0, function () {
+            var res, _a, carrots, spin;
+            return __generator(this, function (_b) {
+                switch (_b.label) {
+                    case 0: return [4 /*yield*/, agent.get("/food").expect(200)];
                     case 1:
-                        res = _a.sent();
-                        (0, bun_test_1.expect)(res.body.title).toContain("Query filter error");
+                        res = _b.sent();
+                        (0, bun_test_1.expect)(res.body.data).toHaveLength(2);
+                        _a = __read(res.body.data, 2), carrots = _a[0], spin = _a[1];
+                        (0, bun_test_1.expect)(carrots.ownerId._id).toBe(notAdmin._id.toString());
+                        (0, bun_test_1.expect)(carrots.ownerId.email).toBe(notAdmin.email);
+                        (0, bun_test_1.expect)(carrots.ownerId.name).toBeUndefined();
+                        (0, bun_test_1.expect)(spin.ownerId._id).toBe(admin._id.toString());
+                        (0, bun_test_1.expect)(spin.ownerId.email).toBe(admin.email);
+                        (0, bun_test_1.expect)(spin.ownerId.name).toBeUndefined();
                         return [2 /*return*/];
                 }
             });
         }); });
-        (0, bun_test_1.it)("custom endpoints take priority", function () { return __awaiter(void 0, void 0, void 0, function () {
+        (0, bun_test_1.it)("reads with populate", function () { return __awaiter(void 0, void 0, void 0, function () {
             var res;
             return __generator(this, function (_a) {
                 switch (_a.label) {
-                    case 0:
-                        app.use("/food", (0, api_1.modelRouter)(tests_1.FoodModel, {
-                            allowAnonymous: true,
-                            endpoints: function (router) {
-                                router.get("/custom", function (_req, res) {
-                                    res.json({ custom: true });
-                                });
-                            },
-                            permissions: {
-                                create: [permissions_1.Permissions.IsAny],
-                                delete: [permissions_1.Permissions.IsAny],
-                                list: [permissions_1.Permissions.IsAny],
-                                read: [permissions_1.Permissions.IsAny],
-                                update: [permissions_1.Permissions.IsAny],
-                            },
-                        }));
-                        server = (0, supertest_1.default)(app);
-                        return [4 /*yield*/, server.get("/food/custom").expect(200)];
+                    case 0: return [4 /*yield*/, agent.get("/food/".concat(spinach._id)).expect(200)];
                     case 1:
                         res = _a.sent();
-                        (0, bun_test_1.expect)(res.body.custom).toBe(true);
+                        (0, bun_test_1.expect)(res.body.data.ownerId._id).toBe(admin._id.toString());
+                        (0, bun_test_1.expect)(res.body.data.ownerId.email).toBe(admin.email);
+                        (0, bun_test_1.expect)(res.body.data.ownerId.name).toBeUndefined();
                         return [2 /*return*/];
                 }
             });
         }); });
-        (0, bun_test_1.it)("disallowed query param returns 400", function () { return __awaiter(void 0, void 0, void 0, function () {
+        (0, bun_test_1.it)("creates with populate", function () { return __awaiter(void 0, void 0, void 0, function () {
             var res;
             return __generator(this, function (_a) {
                 switch (_a.label) {
-                    case 0:
-                        app.use("/food", (0, api_1.modelRouter)(tests_1.FoodModel, {
-                            allowAnonymous: true,
-                            permissions: {
-                                create: [permissions_1.Permissions.IsAny],
-                                delete: [permissions_1.Permissions.IsAny],
-                                list: [permissions_1.Permissions.IsAny],
-                                read: [permissions_1.Permissions.IsAny],
-                                update: [permissions_1.Permissions.IsAny],
-                            },
-                            queryFields: ["name"],
-                        }));
-                        server = (0, supertest_1.default)(app);
-                        return [4 /*yield*/, server.get("/food?calories=100").expect(400)];
+                    case 0: return [4 /*yield*/, server
+                            .post("/food")
+                            .send({
+                            calories: 15,
+                            name: "Broccoli",
+                            ownerId: admin._id,
+                        })
+                            .expect(201)];
                     case 1:
                         res = _a.sent();
-                        (0, bun_test_1.expect)(res.body.title).toContain("calories is not allowed as a query param");
+                        (0, bun_test_1.expect)(res.body.data.ownerId._id).toBe(admin._id.toString());
+                        (0, bun_test_1.expect)(res.body.data.ownerId.email).toBe(admin.email);
+                        (0, bun_test_1.expect)(res.body.data.ownerId.name).toBeUndefined();
                         return [2 /*return*/];
                 }
             });
         }); });
-        (0, bun_test_1.it)("queryFilter returning null returns empty array", function () { return __awaiter(void 0, void 0, void 0, function () {
+        (0, bun_test_1.it)("updates with populate", function () { return __awaiter(void 0, void 0, void 0, function () {
             var res;
             return __generator(this, function (_a) {
                 switch (_a.label) {
-                    case 0:
-                        app.use("/food", (0, api_1.modelRouter)(tests_1.FoodModel, {
-                            allowAnonymous: true,
-                            permissions: {
-                                create: [permissions_1.Permissions.IsAny],
-                                delete: [permissions_1.Permissions.IsAny],
-                                list: [permissions_1.Permissions.IsAny],
-                                read: [permissions_1.Permissions.IsAny],
-                                update: [permissions_1.Permissions.IsAny],
-                            },
-                            queryFilter: function () { return null; },
-                        }));
-                        server = (0, supertest_1.default)(app);
-                        return [4 /*yield*/, server.get("/food").expect(200)];
+                    case 0: return [4 /*yield*/, server
+                            .patch("/food/".concat(spinach._id))
+                            .send({
+                            name: "NotSpinach",
+                        })
+                            .expect(200)];
                     case 1:
                         res = _a.sent();
-                        (0, bun_test_1.expect)(res.body.data).toEqual([]);
+                        (0, bun_test_1.expect)(res.body.data.ownerId._id).toBe(admin._id.toString());
+                        (0, bun_test_1.expect)(res.body.data.ownerId.email).toBe(admin.email);
+                        (0, bun_test_1.expect)(res.body.data.ownerId.name).toBeUndefined();
                         return [2 /*return*/];
                 }
             });
         }); });
-        (0, bun_test_1.it)("preUpdate returning null throws error", function () { return __awaiter(void 0, void 0, void 0, function () {
-            var res;
-            return __generator(this, function (_a) {
-                switch (_a.label) {
-                    case 0:
+    });
+    (0, bun_test_1.describe)("responseHandler", function () {
+        var admin;
+        var agent;
+        var spinach;
+        (0, bun_test_1.beforeEach)(function () { return __awaiter(void 0, void 0, void 0, function () {
+            var _a, _b;
+            return __generator(this, function (_c) {
+                switch (_c.label) {
+                    case 0: return [4 /*yield*/, (0, tests_1.setupDb)()];
+                    case 1:
+                        _a = __read.apply(void 0, [_c.sent(), 1]), admin = _a[0];
+                        return [4 /*yield*/, Promise.all([
+                                tests_1.FoodModel.create({
+                                    calories: 1,
+                                    created: new Date("2021-12-03T00:00:20.000Z"),
+                                    hidden: false,
+                                    name: "Spinach",
+                                    ownerId: admin._id,
+                                    source: {
+                                        name: "Brand",
+                                    },
+                                }),
+                                tests_1.FoodModel.create({
+                                    calories: 100,
+                                    created: Date.now() - 10,
+                                    hidden: true,
+                                    name: "Apple",
+                                    ownerId: admin === null || admin === void 0 ? void 0 : admin._id,
+                                }),
+                            ])];
+                    case 2:
+                        _b = __read.apply(void 0, [_c.sent(), 1]), spinach = _b[0];
+                        app = (0, tests_1.getBaseServer)();
+                        (0, auth_1.setupAuth)(app, tests_1.UserModel);
+                        (0, auth_1.addAuthRoutes)(app, tests_1.UserModel);
                         app.use("/food", (0, api_1.modelRouter)(tests_1.FoodModel, {
                             allowAnonymous: true,
                             permissions: {
@@ -2410,76 +275,71 @@ var transformers_1 = require("./transformers");
                                 read: [permissions_1.Permissions.IsAny],
                                 update: [permissions_1.Permissions.IsAny],
                             },
-                            preUpdate: function () { return null; },
+                            responseHandler: function (data, method) {
+                                if (method === "list") {
+                                    return data.map(function (d) { return ({
+                                        foo: "bar",
+                                        id: d._id,
+                                    }); });
+                                }
+                                return {
+                                    foo: "bar",
+                                    id: data._id,
+                                };
+                            },
                         }));
                         server = (0, supertest_1.default)(app);
-                        return [4 /*yield*/, server.patch("/food/".concat(spinach._id)).send({ name: "Kale" }).expect(403)];
-                    case 1:
-                        res = _a.sent();
-                        (0, bun_test_1.expect)(res.body.title).toBe("Update not allowed");
+                        return [4 /*yield*/, (0, tests_1.authAsUser)(app, "notAdmin")];
+                    case 3:
+                        agent = _c.sent();
                         return [2 /*return*/];
                 }
             });
         }); });
-        (0, bun_test_1.it)("preDelete returning null throws error", function () { return __awaiter(void 0, void 0, void 0, function () {
+        (0, bun_test_1.it)("reads with serialize", function () { return __awaiter(void 0, void 0, void 0, function () {
             var res;
             return __generator(this, function (_a) {
                 switch (_a.label) {
-                    case 0:
-                        app.use("/food", (0, api_1.modelRouter)(tests_1.FoodModel, {
-                            allowAnonymous: true,
-                            permissions: {
-                                create: [permissions_1.Permissions.IsAny],
-                                delete: [permissions_1.Permissions.IsAny],
-                                list: [permissions_1.Permissions.IsAny],
-                                read: [permissions_1.Permissions.IsAny],
-                                update: [permissions_1.Permissions.IsAny],
-                            },
-                            preDelete: function () { return null; },
-                        }));
-                        server = (0, supertest_1.default)(app);
-                        return [4 /*yield*/, (0, tests_1.authAsUser)(app, "notAdmin")];
+                    case 0: return [4 /*yield*/, agent.get("/food/".concat(spinach._id)).expect(200)];
                     case 1:
-                        agent = _a.sent();
-                        return [4 /*yield*/, agent.delete("/food/".concat(spinach._id)).expect(403)];
-                    case 2:
                         res = _a.sent();
-                        (0, bun_test_1.expect)(res.body.title).toBe("Delete not allowed");
+                        (0, bun_test_1.expect)(res.body.data.ownerId).toBeUndefined();
+                        (0, bun_test_1.expect)(res.body.data.id).toBe(spinach._id.toString());
+                        (0, bun_test_1.expect)(res.body.data.foo).toBe("bar");
                         return [2 /*return*/];
                 }
             });
         }); });
-        (0, bun_test_1.it)("preCreate returning null throws error", function () { return __awaiter(void 0, void 0, void 0, function () {
+        (0, bun_test_1.it)("list with serialize", function () { return __awaiter(void 0, void 0, void 0, function () {
             var res;
             return __generator(this, function (_a) {
                 switch (_a.label) {
-                    case 0:
-                        app.use("/food", (0, api_1.modelRouter)(tests_1.FoodModel, {
-                            allowAnonymous: true,
-                            permissions: {
-                                create: [permissions_1.Permissions.IsAny],
-                                delete: [permissions_1.Permissions.IsAny],
-                                list: [permissions_1.Permissions.IsAny],
-                                read: [permissions_1.Permissions.IsAny],
-                                update: [permissions_1.Permissions.IsAny],
-                            },
-                            preCreate: function () { return null; },
-                        }));
-                        server = (0, supertest_1.default)(app);
-                        return [4 /*yield*/, server.post("/food").send({ calories: 15, name: "Broccoli" }).expect(403)];
+                    case 0: return [4 /*yield*/, agent.get("/food").expect(200)];
                     case 1:
                         res = _a.sent();
-                        (0, bun_test_1.expect)(res.body.title).toBe("Create not allowed");
+                        (0, bun_test_1.expect)(res.body.data[0].ownerId).toBeUndefined();
+                        (0, bun_test_1.expect)(res.body.data[1].ownerId).toBeUndefined();
+                        (0, bun_test_1.expect)(res.body.data[0].id).toBeDefined();
+                        (0, bun_test_1.expect)(res.body.data[0].foo).toBe("bar");
+                        (0, bun_test_1.expect)(res.body.data[1].id).toBeDefined();
+                        (0, bun_test_1.expect)(res.body.data[1].foo).toBe("bar");
                         return [2 /*return*/];
                 }
             });
         }); });
-        (0, bun_test_1.it)("preCreate error is handled", function () { return __awaiter(void 0, void 0, void 0, function () {
-            var res;
+    });
+    (0, bun_test_1.describe)("plugins", function () {
+        var agent;
+        (0, bun_test_1.beforeEach)(function () { return __awaiter(void 0, void 0, void 0, function () {
             return __generator(this, function (_a) {
                 switch (_a.label) {
-                    case 0:
-                        app.use("/food", (0, api_1.modelRouter)(tests_1.FoodModel, {
+                    case 0: return [4 /*yield*/, (0, tests_1.setupDb)()];
+                    case 1:
+                        _a.sent();
+                        app = (0, tests_1.getBaseServer)();
+                        (0, auth_1.setupAuth)(app, tests_1.UserModel);
+                        (0, auth_1.addAuthRoutes)(app, tests_1.UserModel);
+                        app.use("/users", (0, api_1.modelRouter)(tests_1.UserModel, {
                             allowAnonymous: true,
                             permissions: {
                                 create: [permissions_1.Permissions.IsAny],
@@ -2488,56 +348,34 @@ var transformers_1 = require("./transformers");
                                 read: [permissions_1.Permissions.IsAny],
                                 update: [permissions_1.Permissions.IsAny],
                             },
-                            preCreate: function () {
-                                throw new Error("preCreate failed");
-                            },
                         }));
                         server = (0, supertest_1.default)(app);
-                        return [4 /*yield*/, server.post("/food").send({ calories: 15, name: "Broccoli" }).expect(400)];
-                    case 1:
-                        res = _a.sent();
-                        (0, bun_test_1.expect)(res.body.title).toContain("preCreate hook error");
+                        return [4 /*yield*/, (0, tests_1.authAsUser)(app, "notAdmin")];
+                    case 2:
+                        agent = _a.sent();
                         return [2 /*return*/];
                 }
             });
         }); });
-        (0, bun_test_1.it)("preUpdate error is handled", function () { return __awaiter(void 0, void 0, void 0, function () {
+        (0, bun_test_1.it)("check that security fields are filtered", function () { return __awaiter(void 0, void 0, void 0, function () {
             var res;
             return __generator(this, function (_a) {
                 switch (_a.label) {
-                    case 0:
-                        app.use("/food", (0, api_1.modelRouter)(tests_1.FoodModel, {
-                            allowAnonymous: true,
-                            permissions: {
-                                create: [permissions_1.Permissions.IsAny],
-                                delete: [permissions_1.Permissions.IsAny],
-                                list: [permissions_1.Permissions.IsAny],
-                                read: [permissions_1.Permissions.IsAny],
-                                update: [permissions_1.Permissions.IsAny],
-                            },
-                            preUpdate: function () {
-                                throw new Error("preUpdate failed");
-                            },
-                        }));
-                        server = (0, supertest_1.default)(app);
-                        return [4 /*yield*/, server.patch("/food/".concat(spinach._id)).send({ name: "Kale" }).expect(400)];
+                    case 0: return [4 /*yield*/, agent.get("/users").expect(200)];
                     case 1:
                         res = _a.sent();
-                        (0, bun_test_1.expect)(res.body.title).toContain("preUpdate hook error");
+                        (0, bun_test_1.expect)(res.body.data[0].email).toBeDefined();
+                        (0, bun_test_1.expect)(res.body.data[0].token).toBeUndefined();
+                        (0, bun_test_1.expect)(res.body.data[0].hash).toBeUndefined();
+                        (0, bun_test_1.expect)(res.body.data[0].salt).toBeUndefined();
                         return [2 /*return*/];
                 }
             });
         }); });
-        (0, bun_test_1.it)("invalid array operation type returns 400", function () { return __awaiter(void 0, void 0, void 0, function () {
-            return __generator(this, function (_a) {
-                return [2 /*return*/];
-            });
-        }); });
     });
-    (0, bun_test_1.describe)("array operation errors", function () {
+    (0, bun_test_1.describe)("error handling", function () {
         var admin;
-        var apple;
-        var agent;
+        var spinach;
         (0, bun_test_1.beforeEach)(function () { return __awaiter(void 0, void 0, void 0, function () {
             var _a;
             return __generator(this, function (_b) {
@@ -2546,19 +384,17 @@ var transformers_1 = require("./transformers");
                     case 1:
                         _a = __read.apply(void 0, [_b.sent(), 1]), admin = _a[0];
                         return [4 /*yield*/, tests_1.FoodModel.create({
-                                calories: 100,
-                                categories: [
-                                    { name: "Fruit", show: true },
-                                    { name: "Popular", show: false },
-                                ],
-                                created: new Date("2021-12-03T00:00:30.000Z"),
+                                calories: 1,
+                                created: new Date("2021-12-03T00:00:20.000Z"),
                                 hidden: false,
-                                name: "Apple",
+                                name: "Spinach",
                                 ownerId: admin._id,
-                                tags: ["healthy", "cheap"],
+                                source: {
+                                    name: "Brand",
+                                },
                             })];
                     case 2:
-                        apple = _b.sent();
+                        spinach = _b.sent();
                         app = (0, tests_1.getBaseServer)();
                         (0, auth_1.setupAuth)(app, tests_1.UserModel);
                         (0, auth_1.addAuthRoutes)(app, tests_1.UserModel);
@@ -2566,7 +402,7 @@ var transformers_1 = require("./transformers");
                 }
             });
         }); });
-        (0, bun_test_1.it)("array operation preUpdate returning undefined throws error", function () { return __awaiter(void 0, void 0, void 0, function () {
+        (0, bun_test_1.it)("PUT returns 500 not supported", function () { return __awaiter(void 0, void 0, void 0, function () {
             var res;
             return __generator(this, function (_a) {
                 switch (_a.label) {
@@ -2574,28 +410,23 @@ var transformers_1 = require("./transformers");
                         app.use("/food", (0, api_1.modelRouter)(tests_1.FoodModel, {
                             allowAnonymous: true,
                             permissions: {
-                                create: [permissions_1.Permissions.IsAdmin],
-                                delete: [permissions_1.Permissions.IsAdmin],
-                                list: [permissions_1.Permissions.IsAdmin],
-                                read: [permissions_1.Permissions.IsAdmin],
-                                update: [permissions_1.Permissions.IsAdmin],
+                                create: [permissions_1.Permissions.IsAny],
+                                delete: [permissions_1.Permissions.IsAny],
+                                list: [permissions_1.Permissions.IsAny],
+                                read: [permissions_1.Permissions.IsAny],
+                                update: [permissions_1.Permissions.IsAny],
                             },
-                            preUpdate: function () { return undefined; },
                         }));
                         server = (0, supertest_1.default)(app);
-                        return [4 /*yield*/, (0, tests_1.authAsUser)(app, "admin")];
+                        return [4 /*yield*/, server.put("/food/".concat(spinach._id)).send({ name: "Kale" }).expect(500)];
                     case 1:
-                        agent = _a.sent();
-                        return [4 /*yield*/, agent.post("/food/".concat(apple._id, "/tags")).send({ tags: "organic" }).expect(403)];
-                    case 2:
                         res = _a.sent();
-                        (0, bun_test_1.expect)(res.body.title).toBe("Update not allowed");
-                        (0, bun_test_1.expect)(res.body.detail).toBe("A body must be returned from preUpdate");
+                        (0, bun_test_1.expect)(res.body.title).toBe("PUT is not supported.");
                         return [2 /*return*/];
                 }
             });
         }); });
-        (0, bun_test_1.it)("array operation preUpdate returning null throws error", function () { return __awaiter(void 0, void 0, void 0, function () {
+        (0, bun_test_1.it)("responseHandler error in read is handled", function () { return __awaiter(void 0, void 0, void 0, function () {
             var res;
             return __generator(this, function (_a) {
                 switch (_a.label) {
@@ -2603,27 +434,29 @@ var transformers_1 = require("./transformers");
                         app.use("/food", (0, api_1.modelRouter)(tests_1.FoodModel, {
                             allowAnonymous: true,
                             permissions: {
-                                create: [permissions_1.Permissions.IsAdmin],
-                                delete: [permissions_1.Permissions.IsAdmin],
-                                list: [permissions_1.Permissions.IsAdmin],
-                                read: [permissions_1.Permissions.IsAdmin],
-                                update: [permissions_1.Permissions.IsAdmin],
+                                create: [permissions_1.Permissions.IsAny],
+                                delete: [permissions_1.Permissions.IsAny],
+                                list: [permissions_1.Permissions.IsAny],
+                                read: [permissions_1.Permissions.IsAny],
+                                update: [permissions_1.Permissions.IsAny],
+                            },
+                            responseHandler: function (_data, method) {
+                                if (method === "read") {
+                                    throw new Error("responseHandler read failed");
+                                }
+                                return {};
                             },
-                            preUpdate: function () { return null; },
                         }));
                         server = (0, supertest_1.default)(app);
-                        return [4 /*yield*/, (0, tests_1.authAsUser)(app, "admin")];
+                        return [4 /*yield*/, server.get("/food/".concat(spinach._id)).expect(500)];
                     case 1:
-                        agent = _a.sent();
-                        return [4 /*yield*/, agent.post("/food/".concat(apple._id, "/tags")).send({ tags: "organic" }).expect(403)];
-                    case 2:
                         res = _a.sent();
-                        (0, bun_test_1.expect)(res.body.title).toBe("Update not allowed");
+                        (0, bun_test_1.expect)(res.body.title).toContain("responseHandler error");
                         return [2 /*return*/];
                 }
             });
         }); });
-        (0, bun_test_1.it)("array operation preUpdate error is handled", function () { return __awaiter(void 0, void 0, void 0, function () {
+        (0, bun_test_1.it)("responseHandler error in create is handled", function () { return __awaiter(void 0, void 0, void 0, function () {
             var res;
             return __generator(this, function (_a) {
                 switch (_a.label) {
@@ -2631,29 +464,29 @@ var transformers_1 = require("./transformers");
                         app.use("/food", (0, api_1.modelRouter)(tests_1.FoodModel, {
                             allowAnonymous: true,
                             permissions: {
-                                create: [permissions_1.Permissions.IsAdmin],
-                                delete: [permissions_1.Permissions.IsAdmin],
-                                list: [permissions_1.Permissions.IsAdmin],
-                                read: [permissions_1.Permissions.IsAdmin],
-                                update: [permissions_1.Permissions.IsAdmin],
+                                create: [permissions_1.Permissions.IsAny],
+                                delete: [permissions_1.Permissions.IsAny],
+                                list: [permissions_1.Permissions.IsAny],
+                                read: [permissions_1.Permissions.IsAny],
+                                update: [permissions_1.Permissions.IsAny],
                             },
-                            preUpdate: function () {
-                                throw new Error("preUpdate array failed");
+                            responseHandler: function (_data, method) {
+                                if (method === "create") {
+                                    throw new Error("responseHandler create failed");
+                                }
+                                return {};
                             },
                         }));
                         server = (0, supertest_1.default)(app);
-                        return [4 /*yield*/, (0, tests_1.authAsUser)(app, "admin")];
+                        return [4 /*yield*/, server.post("/food").send({ calories: 15, name: "Broccoli" }).expect(500)];
                     case 1:
-                        agent = _a.sent();
-                        return [4 /*yield*/, agent.post("/food/".concat(apple._id, "/tags")).send({ tags: "organic" }).expect(400)];
-                    case 2:
                         res = _a.sent();
-                        (0, bun_test_1.expect)(res.body.title).toContain("preUpdate hook error");
+                        (0, bun_test_1.expect)(res.body.title).toContain("responseHandler error");
                         return [2 /*return*/];
                 }
             });
         }); });
-        (0, bun_test_1.it)("array operation postUpdate error is handled", function () { return __awaiter(void 0, void 0, void 0, function () {
+        (0, bun_test_1.it)("responseHandler error in update is handled", function () { return __awaiter(void 0, void 0, void 0, function () {
             var res;
             return __generator(this, function (_a) {
                 switch (_a.label) {
@@ -2661,29 +494,29 @@ var transformers_1 = require("./transformers");
                         app.use("/food", (0, api_1.modelRouter)(tests_1.FoodModel, {
                             allowAnonymous: true,
                             permissions: {
-                                create: [permissions_1.Permissions.IsAdmin],
-                                delete: [permissions_1.Permissions.IsAdmin],
-                                list: [permissions_1.Permissions.IsAdmin],
-                                read: [permissions_1.Permissions.IsAdmin],
-                                update: [permissions_1.Permissions.IsAdmin],
+                                create: [permissions_1.Permissions.IsAny],
+                                delete: [permissions_1.Permissions.IsAny],
+                                list: [permissions_1.Permissions.IsAny],
+                                read: [permissions_1.Permissions.IsAny],
+                                update: [permissions_1.Permissions.IsAny],
                             },
-                            postUpdate: function () {
-                                throw new Error("postUpdate array failed");
+                            responseHandler: function (_data, method) {
+                                if (method === "update") {
+                                    throw new Error("responseHandler update failed");
+                                }
+                                return {};
                             },
                         }));
                         server = (0, supertest_1.default)(app);
-                        return [4 /*yield*/, (0, tests_1.authAsUser)(app, "admin")];
+                        return [4 /*yield*/, server.patch("/food/".concat(spinach._id)).send({ name: "Kale" }).expect(500)];
                     case 1:
-                        agent = _a.sent();
-                        return [4 /*yield*/, agent.post("/food/".concat(apple._id, "/tags")).send({ tags: "organic" }).expect(400)];
-                    case 2:
                         res = _a.sent();
-                        (0, bun_test_1.expect)(res.body.title).toContain("PATCH Post Update error");
+                        (0, bun_test_1.expect)(res.body.title).toContain("responseHandler error");
                         return [2 /*return*/];
                 }
             });
         }); });
-        (0, bun_test_1.it)("array operation denied without update permission", function () { return __awaiter(void 0, void 0, void 0, function () {
+        (0, bun_test_1.it)("responseHandler error in list is handled", function () { return __awaiter(void 0, void 0, void 0, function () {
             var res;
             return __generator(this, function (_a) {
                 switch (_a.label) {
@@ -2691,144 +524,100 @@ var transformers_1 = require("./transformers");
                         app.use("/food", (0, api_1.modelRouter)(tests_1.FoodModel, {
                             allowAnonymous: true,
                             permissions: {
-                                create: [permissions_1.Permissions.IsAdmin],
-                                delete: [permissions_1.Permissions.IsAdmin],
+                                create: [permissions_1.Permissions.IsAny],
+                                delete: [permissions_1.Permissions.IsAny],
                                 list: [permissions_1.Permissions.IsAny],
                                 read: [permissions_1.Permissions.IsAny],
-                                update: [permissions_1.Permissions.IsAdmin],
+                                update: [permissions_1.Permissions.IsAny],
                             },
-                        }));
-                        server = (0, supertest_1.default)(app);
-                        return [4 /*yield*/, (0, tests_1.authAsUser)(app, "notAdmin")];
-                    case 1:
-                        agent = _a.sent();
-                        return [4 /*yield*/, agent.post("/food/".concat(apple._id, "/tags")).send({ tags: "organic" }).expect(405)];
-                    case 2:
-                        res = _a.sent();
-                        (0, bun_test_1.expect)(res.body.title).toContain("Access to PATCH");
-                        return [2 /*return*/];
-                }
-            });
-        }); });
-        (0, bun_test_1.it)("array operation on non-existent document returns 404", function () { return __awaiter(void 0, void 0, void 0, function () {
-            var fakeId, res;
-            return __generator(this, function (_a) {
-                switch (_a.label) {
-                    case 0:
-                        app.use("/food", (0, api_1.modelRouter)(tests_1.FoodModel, {
-                            allowAnonymous: true,
-                            permissions: {
-                                create: [permissions_1.Permissions.IsAdmin],
-                                delete: [permissions_1.Permissions.IsAdmin],
-                                list: [permissions_1.Permissions.IsAdmin],
-                                read: [permissions_1.Permissions.IsAdmin],
-                                update: [permissions_1.Permissions.IsAdmin],
+                            responseHandler: function (_data, method) {
+                                if (method === "list") {
+                                    throw new Error("responseHandler list failed");
+                                }
+                                return {};
                             },
                         }));
                         server = (0, supertest_1.default)(app);
-                        return [4 /*yield*/, (0, tests_1.authAsUser)(app, "admin")];
+                        return [4 /*yield*/, server.get("/food").expect(500)];
                     case 1:
-                        agent = _a.sent();
-                        fakeId = "000000000000000000000000";
-                        return [4 /*yield*/, agent.post("/food/".concat(fakeId, "/tags")).send({ tags: "organic" }).expect(404)];
-                    case 2:
                         res = _a.sent();
-                        (0, bun_test_1.expect)(res.body.title).toContain("Could not find document to PATCH");
+                        (0, bun_test_1.expect)(res.body.title).toContain("responseHandler error");
                         return [2 /*return*/];
                 }
             });
         }); });
-        (0, bun_test_1.it)("array operation denied when user cannot update specific doc", function () { return __awaiter(void 0, void 0, void 0, function () {
+        (0, bun_test_1.it)("list with non-array responseHandler returns data directly", function () { return __awaiter(void 0, void 0, void 0, function () {
             var res;
             return __generator(this, function (_a) {
                 switch (_a.label) {
                     case 0:
-                        // Create food owned by admin, then try to update as notAdmin
                         app.use("/food", (0, api_1.modelRouter)(tests_1.FoodModel, {
                             allowAnonymous: true,
                             permissions: {
-                                create: [permissions_1.Permissions.IsAuthenticated],
-                                delete: [permissions_1.Permissions.IsAuthenticated],
-                                list: [permissions_1.Permissions.IsAuthenticated],
-                                read: [permissions_1.Permissions.IsAuthenticated],
-                                update: [permissions_1.Permissions.IsOwner],
+                                create: [permissions_1.Permissions.IsAny],
+                                delete: [permissions_1.Permissions.IsAny],
+                                list: [permissions_1.Permissions.IsAny],
+                                read: [permissions_1.Permissions.IsAny],
+                                update: [permissions_1.Permissions.IsAny],
+                            },
+                            responseHandler: function (_data, method) {
+                                if (method === "list") {
+                                    return { custom: "response" };
+                                }
+                                return {};
                             },
                         }));
                         server = (0, supertest_1.default)(app);
-                        return [4 /*yield*/, (0, tests_1.authAsUser)(app, "notAdmin")];
+                        return [4 /*yield*/, server.get("/food").expect(200)];
                     case 1:
-                        // Login as notAdmin and try to update admin's food (apple)
-                        agent = _a.sent();
-                        return [4 /*yield*/, agent.post("/food/".concat(apple._id, "/tags")).send({ tags: "organic" }).expect(403)];
-                    case 2:
                         res = _a.sent();
-                        (0, bun_test_1.expect)(res.body.title).toContain("Patch not allowed");
+                        (0, bun_test_1.expect)(res.body.data).toEqual({ custom: "response" });
+                        (0, bun_test_1.expect)(res.body.more).toBeUndefined();
+                        (0, bun_test_1.expect)(res.body.total).toBeUndefined();
                         return [2 /*return*/];
                 }
             });
         }); });
-        (0, bun_test_1.it)("array operation transform error is handled", function () { return __awaiter(void 0, void 0, void 0, function () {
+        (0, bun_test_1.it)("list with query sort param", function () { return __awaiter(void 0, void 0, void 0, function () {
             var res;
             return __generator(this, function (_a) {
                 switch (_a.label) {
-                    case 0:
+                    case 0: return [4 /*yield*/, tests_1.FoodModel.create({
+                            calories: 200,
+                            created: new Date("2021-12-04T00:00:20.000Z"),
+                            hidden: false,
+                            name: "Apple",
+                            ownerId: admin._id,
+                        })];
+                    case 1:
+                        _a.sent();
                         app.use("/food", (0, api_1.modelRouter)(tests_1.FoodModel, {
                             allowAnonymous: true,
                             permissions: {
-                                create: [permissions_1.Permissions.IsAdmin],
-                                delete: [permissions_1.Permissions.IsAdmin],
-                                list: [permissions_1.Permissions.IsAdmin],
-                                read: [permissions_1.Permissions.IsAdmin],
-                                update: [permissions_1.Permissions.IsAdmin],
+                                create: [permissions_1.Permissions.IsAny],
+                                delete: [permissions_1.Permissions.IsAny],
+                                list: [permissions_1.Permissions.IsAny],
+                                read: [permissions_1.Permissions.IsAny],
+                                update: [permissions_1.Permissions.IsAny],
                             },
-                            transformer: (0, transformers_1.AdminOwnerTransformer)({
-                                adminWriteFields: ["name"],
-                            }),
+                            queryFields: ["name"],
                         }));
                         server = (0, supertest_1.default)(app);
-                        return [4 /*yield*/, (0, tests_1.authAsUser)(app, "admin")];
-                    case 1:
-                        agent = _a.sent();
-                        return [4 /*yield*/, agent.post("/food/".concat(apple._id, "/tags")).send({ tags: "organic" }).expect(403)];
+                        return [4 /*yield*/, server.get("/food?sort=name").expect(200)];
                     case 2:
                         res = _a.sent();
-                        (0, bun_test_1.expect)(res.body.title).toContain("cannot write fields");
-                        return [2 /*return*/];
-                }
-            });
-        }); });
-    });
-    (0, bun_test_1.describe)("transformer errors", function () {
-        var admin;
-        var spinach;
-        var agent;
-        (0, bun_test_1.beforeEach)(function () { return __awaiter(void 0, void 0, void 0, function () {
-            var _a;
-            return __generator(this, function (_b) {
-                switch (_b.label) {
-                    case 0: return [4 /*yield*/, (0, tests_1.setupDb)()];
-                    case 1:
-                        _a = __read.apply(void 0, [_b.sent(), 1]), admin = _a[0];
-                        return [4 /*yield*/, tests_1.FoodModel.create({
-                                calories: 1,
-                                created: new Date("2021-12-03T00:00:20.000Z"),
-                                hidden: false,
-                                name: "Spinach",
-                                ownerId: admin._id,
-                                source: {
-                                    name: "Brand",
-                                },
-                            })];
-                    case 2:
-                        spinach = _b.sent();
-                        app = (0, tests_1.getBaseServer)();
-                        (0, auth_1.setupAuth)(app, tests_1.UserModel);
-                        (0, auth_1.addAuthRoutes)(app, tests_1.UserModel);
+                        (0, bun_test_1.expect)(res.body.data[0].name).toBe("Apple");
+                        (0, bun_test_1.expect)(res.body.data[1].name).toBe("Spinach");
+                        return [4 /*yield*/, server.get("/food?sort=-name").expect(200)];
+                    case 3:
+                        res = _a.sent();
+                        (0, bun_test_1.expect)(res.body.data[0].name).toBe("Spinach");
+                        (0, bun_test_1.expect)(res.body.data[1].name).toBe("Apple");
                         return [2 /*return*/];
                 }
             });
         }); });
-        (0, bun_test_1.it)("transform error in create is handled", function () { return __awaiter(void 0, void 0, void 0, function () {
+        (0, bun_test_1.it)("queryFilter error is handled", function () { return __awaiter(void 0, void 0, void 0, function () {
             var res;
             return __generator(this, function (_a) {
                 switch (_a.label) {
@@ -2842,27 +631,31 @@ var transformers_1 = require("./transformers");
                                 read: [permissions_1.Permissions.IsAny],
                                 update: [permissions_1.Permissions.IsAny],
                             },
-                            transformer: (0, transformers_1.AdminOwnerTransformer)({
-                                // Only allow 'name' to be written, so 'calories' will throw
-                                anonWriteFields: ["name"],
-                            }),
+                            queryFilter: function () {
+                                throw new Error("queryFilter failed");
+                            },
                         }));
                         server = (0, supertest_1.default)(app);
-                        return [4 /*yield*/, server.post("/food").send({ calories: 15, name: "Broccoli" }).expect(400)];
+                        return [4 /*yield*/, server.get("/food").expect(400)];
                     case 1:
                         res = _a.sent();
-                        (0, bun_test_1.expect)(res.body.title).toContain("cannot write fields");
+                        (0, bun_test_1.expect)(res.body.title).toContain("Query filter error");
                         return [2 /*return*/];
                 }
             });
         }); });
-        (0, bun_test_1.it)("transform error in patch is handled", function () { return __awaiter(void 0, void 0, void 0, function () {
+        (0, bun_test_1.it)("custom endpoints take priority", function () { return __awaiter(void 0, void 0, void 0, function () {
             var res;
             return __generator(this, function (_a) {
                 switch (_a.label) {
                     case 0:
                         app.use("/food", (0, api_1.modelRouter)(tests_1.FoodModel, {
                             allowAnonymous: true,
+                            endpoints: function (router) {
+                                router.get("/custom", function (_req, res) {
+                                    res.json({ custom: true });
+                                });
+                            },
                             permissions: {
                                 create: [permissions_1.Permissions.IsAny],
                                 delete: [permissions_1.Permissions.IsAny],
@@ -2870,28 +663,22 @@ var transformers_1 = require("./transformers");
                                 read: [permissions_1.Permissions.IsAny],
                                 update: [permissions_1.Permissions.IsAny],
                             },
-                            transformer: (0, transformers_1.AdminOwnerTransformer)({
-                                // Only allow 'name' to be written, so 'calories' will throw
-                                anonWriteFields: ["name"],
-                            }),
                         }));
                         server = (0, supertest_1.default)(app);
-                        return [4 /*yield*/, server.patch("/food/".concat(spinach._id)).send({ calories: 100 }).expect(403)];
+                        return [4 /*yield*/, server.get("/food/custom").expect(200)];
                     case 1:
                         res = _a.sent();
-                        (0, bun_test_1.expect)(res.body.title).toContain("cannot write fields");
+                        (0, bun_test_1.expect)(res.body.custom).toBe(true);
                         return [2 /*return*/];
                 }
             });
         }); });
-        (0, bun_test_1.it)("model.create validation error is handled", function () { return __awaiter(void 0, void 0, void 0, function () {
-            var RequiredModel, res;
+        (0, bun_test_1.it)("disallowed query param returns 400", function () { return __awaiter(void 0, void 0, void 0, function () {
+            var res;
             return __generator(this, function (_a) {
                 switch (_a.label) {
-                    case 0: return [4 /*yield*/, Promise.resolve().then(function () { return __importStar(require("./tests")); })];
-                    case 1:
-                        RequiredModel = (_a.sent()).RequiredModel;
-                        app.use("/required", (0, api_1.modelRouter)(RequiredModel, {
+                    case 0:
+                        app.use("/food", (0, api_1.modelRouter)(tests_1.FoodModel, {
                             allowAnonymous: true,
                             permissions: {
                                 create: [permissions_1.Permissions.IsAny],
@@ -2900,17 +687,18 @@ var transformers_1 = require("./transformers");
                                 read: [permissions_1.Permissions.IsAny],
                                 update: [permissions_1.Permissions.IsAny],
                             },
+                            queryFields: ["name"],
                         }));
                         server = (0, supertest_1.default)(app);
-                        return [4 /*yield*/, server.post("/required").send({ about: "test" }).expect(400)];
-                    case 2:
+                        return [4 /*yield*/, server.get("/food?calories=100").expect(400)];
+                    case 1:
                         res = _a.sent();
-                        (0, bun_test_1.expect)(res.body.title).toContain("Required");
+                        (0, bun_test_1.expect)(res.body.title).toContain("calories is not allowed as a query param");
                         return [2 /*return*/];
                 }
             });
         }); });
-        (0, bun_test_1.it)("preDelete hook throwing APIError is re-thrown", function () { return __awaiter(void 0, void 0, void 0, function () {
+        (0, bun_test_1.it)("queryFilter returning null returns empty array", function () { return __awaiter(void 0, void 0, void 0, function () {
             var res;
             return __generator(this, function (_a) {
                 switch (_a.label) {
@@ -2924,30 +712,21 @@ var transformers_1 = require("./transformers");
                                 read: [permissions_1.Permissions.IsAny],
                                 update: [permissions_1.Permissions.IsAny],
                             },
-                            preDelete: function () {
-                                throw new errors_1.APIError({
-                                    disableExternalErrorTracking: true,
-                                    status: 400,
-                                    title: "Custom preDelete APIError",
-                                });
-                            },
+                            queryFilter: function () { return null; },
                         }));
                         server = (0, supertest_1.default)(app);
-                        return [4 /*yield*/, (0, tests_1.authAsUser)(app, "notAdmin")];
+                        return [4 /*yield*/, server.get("/food").expect(200)];
                     case 1:
-                        agent = _a.sent();
-                        return [4 /*yield*/, agent.delete("/food/".concat(spinach._id)).expect(400)];
-                    case 2:
                         res = _a.sent();
-                        (0, bun_test_1.expect)(res.body.title).toBe("Custom preDelete APIError");
-                        (0, bun_test_1.expect)(res.body.disableExternalErrorTracking).toBe(true);
+                        (0, bun_test_1.expect)(res.body.data).toEqual([]);
                         return [2 /*return*/];
                 }
             });
         }); });
     });
-    (0, bun_test_1.describe)("special query params", function () {
+    (0, bun_test_1.describe)("transformer errors", function () {
         var admin;
+        var spinach;
         (0, bun_test_1.beforeEach)(function () { return __awaiter(void 0, void 0, void 0, function () {
             var _a;
             return __generator(this, function (_b) {
@@ -2961,9 +740,12 @@ var transformers_1 = require("./transformers");
                                 hidden: false,
                                 name: "Spinach",
                                 ownerId: admin._id,
+                                source: {
+                                    name: "Brand",
+                                },
                             })];
                     case 2:
-                        _b.sent();
+                        spinach = _b.sent();
                         app = (0, tests_1.getBaseServer)();
                         (0, auth_1.setupAuth)(app, tests_1.UserModel);
                         (0, auth_1.addAuthRoutes)(app, tests_1.UserModel);
@@ -2971,7 +753,7 @@ var transformers_1 = require("./transformers");
                 }
             });
         }); });
-        (0, bun_test_1.it)("period query param is stripped from query", function () { return __awaiter(void 0, void 0, void 0, function () {
+        (0, bun_test_1.it)("transform error in create is handled", function () { return __awaiter(void 0, void 0, void 0, function () {
             var res;
             return __generator(this, function (_a) {
                 switch (_a.label) {
@@ -2985,68 +767,24 @@ var transformers_1 = require("./transformers");
                                 read: [permissions_1.Permissions.IsAny],
                                 update: [permissions_1.Permissions.IsAny],
                             },
-                            queryFields: ["name", "period"],
-                            queryFilter: function (_user, query) {
-                                // Simulate a queryFilter that accepts and processes period
-                                if (query === null || query === void 0 ? void 0 : query.period) {
-                                    // Period is processed but shouldn't be passed to mongo
-                                    return query;
-                                }
-                                return query !== null && query !== void 0 ? query : {};
-                            },
+                            transformer: (0, transformers_1.AdminOwnerTransformer)({
+                                anonWriteFields: ["name"],
+                            }),
                         }));
                         server = (0, supertest_1.default)(app);
-                        return [4 /*yield*/, server.get("/food?period=weekly").expect(200)];
-                    case 1:
-                        res = _a.sent();
-                        (0, bun_test_1.expect)(res.body.data).toBeDefined();
-                        return [2 /*return*/];
-                }
-            });
-        }); });
-        (0, bun_test_1.it)("query with false value", function () { return __awaiter(void 0, void 0, void 0, function () {
-            var res;
-            return __generator(this, function (_a) {
-                switch (_a.label) {
-                    case 0: 
-                    // Create a food that is hidden
-                    return [4 /*yield*/, tests_1.FoodModel.create({
-                            calories: 50,
-                            created: new Date("2021-12-04T00:00:20.000Z"),
-                            hidden: true,
-                            name: "HiddenFood",
-                            ownerId: admin._id,
-                        })];
+                        return [4 /*yield*/, server.post("/food").send({ calories: 15, name: "Broccoli" }).expect(400)];
                     case 1:
-                        // Create a food that is hidden
-                        _a.sent();
-                        app.use("/food", (0, api_1.modelRouter)(tests_1.FoodModel, {
-                            allowAnonymous: true,
-                            permissions: {
-                                create: [permissions_1.Permissions.IsAny],
-                                delete: [permissions_1.Permissions.IsAny],
-                                list: [permissions_1.Permissions.IsAny],
-                                read: [permissions_1.Permissions.IsAny],
-                                update: [permissions_1.Permissions.IsAny],
-                            },
-                            queryFields: ["name", "hidden"],
-                        }));
-                        server = (0, supertest_1.default)(app);
-                        return [4 /*yield*/, server.get("/food?hidden=false").expect(200)];
-                    case 2:
                         res = _a.sent();
-                        (0, bun_test_1.expect)(res.body.data.every(function (f) { return f.hidden === false; })).toBe(true);
+                        (0, bun_test_1.expect)(res.body.title).toContain("cannot write fields");
                         return [2 /*return*/];
                 }
             });
         }); });
-        (0, bun_test_1.it)("$search query triggers special handling code path", function () { return __awaiter(void 0, void 0, void 0, function () {
+        (0, bun_test_1.it)("transform error in patch is handled", function () { return __awaiter(void 0, void 0, void 0, function () {
             var res;
             return __generator(this, function (_a) {
                 switch (_a.label) {
                     case 0:
-                        // The $search code path just accesses the collection but doesn't do anything with it
-                        // This test verifies the code path is exercised
                         app.use("/food", (0, api_1.modelRouter)(tests_1.FoodModel, {
                             allowAnonymous: true,
                             permissions: {
@@ -3056,26 +794,25 @@ var transformers_1 = require("./transformers");
                                 read: [permissions_1.Permissions.IsAny],
                                 update: [permissions_1.Permissions.IsAny],
                             },
-                            // Need to include $search in queryFields for it to pass validation
-                            queryFields: ["name", "$search"],
+                            transformer: (0, transformers_1.AdminOwnerTransformer)({
+                                anonWriteFields: ["name"],
+                            }),
                         }));
                         server = (0, supertest_1.default)(app);
-                        return [4 /*yield*/, server.get("/food?$search=test")];
+                        return [4 /*yield*/, server.patch("/food/".concat(spinach._id)).send({ calories: 100 }).expect(403)];
                     case 1:
                         res = _a.sent();
-                        // May return 500 because $search is passed to Mongo which doesn't support it without Atlas
-                        // The important thing is we've exercised the code path
-                        (0, bun_test_1.expect)(res.status === 200 || res.status === 500).toBe(true);
+                        (0, bun_test_1.expect)(res.body.title).toContain("cannot write fields");
                         return [2 /*return*/];
                 }
             });
         }); });
-        (0, bun_test_1.it)("$autocomplete query triggers special handling code path", function () { return __awaiter(void 0, void 0, void 0, function () {
+        (0, bun_test_1.it)("model.create validation error is handled", function () { return __awaiter(void 0, void 0, void 0, function () {
             var res;
             return __generator(this, function (_a) {
                 switch (_a.label) {
                     case 0:
-                        app.use("/food", (0, api_1.modelRouter)(tests_1.FoodModel, {
+                        app.use("/required", (0, api_1.modelRouter)(tests_1.RequiredModel, {
                             allowAnonymous: true,
                             permissions: {
                                 create: [permissions_1.Permissions.IsAny],
@@ -3084,13 +821,12 @@ var transformers_1 = require("./transformers");
                                 read: [permissions_1.Permissions.IsAny],
                                 update: [permissions_1.Permissions.IsAny],
                             },
-                            queryFields: ["name", "$autocomplete"],
                         }));
                         server = (0, supertest_1.default)(app);
-                        return [4 /*yield*/, server.get("/food?$autocomplete=test")];
+                        return [4 /*yield*/, server.post("/required").send({ about: "test" }).expect(400)];
                     case 1:
                         res = _a.sent();
-                        (0, bun_test_1.expect)(res.status === 200 || res.status === 500).toBe(true);
+                        (0, bun_test_1.expect)(res.body.title).toContain("Required");
                         return [2 /*return*/];
                 }
             });
@@ -3137,7 +873,6 @@ var transformers_1 = require("./transformers");
                             { fields: ["email"], path: "ownerId" },
                             { fields: ["name"], path: "eatenBy" },
                         ]);
-                        // The result should be a query with populate applied
                         (0, bun_test_1.expect)(result).toBeDefined();
                         return [2 /*return*/];
                 }
@@ -3166,9 +901,6 @@ var transformers_1 = require("./transformers");
             return __generator(this, function (_a) {
                 switch (_a.label) {
                     case 0:
-                        // UserModel has the isDisabledPlugin which adds a 'disabled' field,
-                        // but we need to test the 'deleted' field check.
-                        // Let's use a model that has the deleted field.
                         app.use("/users", (0, api_1.modelRouter)(tests_1.UserModel, {
                             allowAnonymous: true,
                             permissions: {
@@ -3226,7 +958,6 @@ var transformers_1 = require("./transformers");
             return __generator(this, function (_a) {
                 switch (_a.label) {
                     case 0:
-                        // Test that valid populate works in create flow
                         app.use("/food", (0, api_1.modelRouter)(tests_1.FoodModel, {
                             allowAnonymous: true,
                             permissions: {
@@ -3246,7 +977,6 @@ var transformers_1 = require("./transformers");
                     case 1:
                         res = _a.sent();
                         (0, bun_test_1.expect)(res.body.data.name).toBe("Broccoli");
-                        // Verify populate worked - ownerId should be an object with email
                         (0, bun_test_1.expect)(res.body.data.ownerId.email).toBe(admin.email);
                         return [2 /*return*/];
                 }
@@ -3287,7 +1017,6 @@ var transformers_1 = require("./transformers");
             return __generator(this, function (_a) {
                 switch (_a.label) {
                     case 0:
-                        // The FoodModel has strict: "throw" which will cause validation errors for unknown fields
                         app.use("/food", (0, api_1.modelRouter)(tests_1.FoodModel, {
                             allowAnonymous: true,
                             permissions: {
@@ -3330,7 +1059,6 @@ var transformers_1 = require("./transformers");
             return __generator(this, function (_a) {
                 switch (_a.label) {
                     case 0:
-                        // Create a transformer that returns undefined
                         app.use("/food", (0, api_1.modelRouter)(tests_1.FoodModel, {
                             allowAnonymous: true,
                             permissions: {
@@ -3389,10 +1117,8 @@ var transformers_1 = require("./transformers");
                         catch (_b) {
                             SoftDeleteModel = mongoose.model("SoftDeleteTest", softDeleteSchema);
                         }
-                        // Clean up any existing documents
                         return [4 /*yield*/, SoftDeleteModel.deleteMany({})];
                     case 2:
-                        // Clean up any existing documents
                         _a.sent();
                         return [4 /*yield*/, SoftDeleteModel.create({ name: "TestItem" })];
                     case 3:
@@ -3411,615 +1137,17 @@ var transformers_1 = require("./transformers");
                         return [4 /*yield*/, (0, tests_1.authAsUser)(app, "notAdmin")];
                     case 4:
                         agent = _a.sent();
-                        // Delete should soft delete (set deleted: true) instead of hard delete
                         return [4 /*yield*/, agent.delete("/softdelete/".concat(testDoc._id)).expect(204)];
                     case 5:
-                        // Delete should soft delete (set deleted: true) instead of hard delete
                         _a.sent();
                         return [4 /*yield*/, SoftDeleteModel.findById(testDoc._id)];
                     case 6:
                         softDeleted = _a.sent();
                         (0, bun_test_1.expect)(softDeleted).not.toBeNull();
                         (0, bun_test_1.expect)(softDeleted === null || softDeleted === void 0 ? void 0 : softDeleted.deleted).toBe(true);
-                        // Clean up
                         return [4 /*yield*/, SoftDeleteModel.deleteMany({})];
                     case 7:
-                        // Clean up
-                        _a.sent();
-                        return [2 /*return*/];
-                }
-            });
-        }); });
-    });
-    (0, bun_test_1.describe)("array operation with undefined preUpdate return", function () {
-        var admin;
-        var apple;
-        var agent;
-        (0, bun_test_1.beforeEach)(function () { return __awaiter(void 0, void 0, void 0, function () {
-            var _a;
-            return __generator(this, function (_b) {
-                switch (_b.label) {
-                    case 0: return [4 /*yield*/, (0, tests_1.setupDb)()];
-                    case 1:
-                        _a = __read.apply(void 0, [_b.sent(), 1]), admin = _a[0];
-                        return [4 /*yield*/, tests_1.FoodModel.create({
-                                calories: 100,
-                                categories: [
-                                    { name: "Fruit", show: true },
-                                    { name: "Popular", show: false },
-                                ],
-                                created: new Date("2021-12-03T00:00:30.000Z"),
-                                hidden: false,
-                                name: "Apple",
-                                ownerId: admin._id,
-                                tags: ["healthy", "cheap"],
-                            })];
-                    case 2:
-                        apple = _b.sent();
-                        app = (0, tests_1.getBaseServer)();
-                        (0, auth_1.setupAuth)(app, tests_1.UserModel);
-                        (0, auth_1.addAuthRoutes)(app, tests_1.UserModel);
-                        return [2 /*return*/];
-                }
-            });
-        }); });
-        (0, bun_test_1.it)("array operation preUpdate returning undefined for array POST throws error", function () { return __awaiter(void 0, void 0, void 0, function () {
-            var res;
-            return __generator(this, function (_a) {
-                switch (_a.label) {
-                    case 0:
-                        app.use("/food", (0, api_1.modelRouter)(tests_1.FoodModel, {
-                            allowAnonymous: true,
-                            permissions: {
-                                create: [permissions_1.Permissions.IsAdmin],
-                                delete: [permissions_1.Permissions.IsAdmin],
-                                list: [permissions_1.Permissions.IsAdmin],
-                                read: [permissions_1.Permissions.IsAdmin],
-                                update: [permissions_1.Permissions.IsAdmin],
-                            },
-                            preUpdate: function () { return undefined; },
-                        }));
-                        server = (0, supertest_1.default)(app);
-                        return [4 /*yield*/, (0, tests_1.authAsUser)(app, "admin")];
-                    case 1:
-                        agent = _a.sent();
-                        return [4 /*yield*/, agent.post("/food/".concat(apple._id, "/tags")).send({ tags: "organic" }).expect(403)];
-                    case 2:
-                        res = _a.sent();
-                        (0, bun_test_1.expect)(res.body.title).toBe("Update not allowed");
-                        (0, bun_test_1.expect)(res.body.detail).toBe("A body must be returned from preUpdate");
-                        return [2 /*return*/];
-                }
-            });
-        }); });
-        (0, bun_test_1.it)("array operation preUpdate returning null for array PATCH throws error", function () { return __awaiter(void 0, void 0, void 0, function () {
-            var res;
-            return __generator(this, function (_a) {
-                switch (_a.label) {
-                    case 0:
-                        app.use("/food", (0, api_1.modelRouter)(tests_1.FoodModel, {
-                            allowAnonymous: true,
-                            permissions: {
-                                create: [permissions_1.Permissions.IsAdmin],
-                                delete: [permissions_1.Permissions.IsAdmin],
-                                list: [permissions_1.Permissions.IsAdmin],
-                                read: [permissions_1.Permissions.IsAdmin],
-                                update: [permissions_1.Permissions.IsAdmin],
-                            },
-                            preUpdate: function () { return null; },
-                        }));
-                        server = (0, supertest_1.default)(app);
-                        return [4 /*yield*/, (0, tests_1.authAsUser)(app, "admin")];
-                    case 1:
-                        agent = _a.sent();
-                        return [4 /*yield*/, agent
-                                .patch("/food/".concat(apple._id, "/tags/healthy"))
-                                .send({ tags: "unhealthy" })
-                                .expect(403)];
-                    case 2:
-                        res = _a.sent();
-                        (0, bun_test_1.expect)(res.body.title).toBe("Update not allowed");
-                        return [2 /*return*/];
-                }
-            });
-        }); });
-        (0, bun_test_1.it)("array operation preUpdate error for array DELETE is handled", function () { return __awaiter(void 0, void 0, void 0, function () {
-            var res;
-            return __generator(this, function (_a) {
-                switch (_a.label) {
-                    case 0:
-                        app.use("/food", (0, api_1.modelRouter)(tests_1.FoodModel, {
-                            allowAnonymous: true,
-                            permissions: {
-                                create: [permissions_1.Permissions.IsAdmin],
-                                delete: [permissions_1.Permissions.IsAdmin],
-                                list: [permissions_1.Permissions.IsAdmin],
-                                read: [permissions_1.Permissions.IsAdmin],
-                                update: [permissions_1.Permissions.IsAdmin],
-                            },
-                            preUpdate: function () {
-                                throw new Error("preUpdate error during delete");
-                            },
-                        }));
-                        server = (0, supertest_1.default)(app);
-                        return [4 /*yield*/, (0, tests_1.authAsUser)(app, "admin")];
-                    case 1:
-                        agent = _a.sent();
-                        return [4 /*yield*/, agent.delete("/food/".concat(apple._id, "/tags/healthy")).expect(400)];
-                    case 2:
-                        res = _a.sent();
-                        (0, bun_test_1.expect)(res.body.title).toContain("preUpdate hook error");
-                        return [2 /*return*/];
-                }
-            });
-        }); });
-    });
-});
-(0, bun_test_1.describe)("errors module", function () {
-    (0, bun_test_1.describe)("APIError", function () {
-        (0, bun_test_1.it)("sets default status to 500 when not provided", function () {
-            var error = new errors_1.APIError({ title: "Test error" });
-            (0, bun_test_1.expect)(error.status).toBe(500);
-        });
-        (0, bun_test_1.it)("sets status to 500 for invalid status codes below 400", function () {
-            var error = new errors_1.APIError({ status: 200, title: "Test error" });
-            (0, bun_test_1.expect)(error.status).toBe(500);
-        });
-        (0, bun_test_1.it)("sets status to 500 for invalid status codes above 599", function () {
-            var error = new errors_1.APIError({ status: 600, title: "Test error" });
-            (0, bun_test_1.expect)(error.status).toBe(500);
-        });
-        (0, bun_test_1.it)("includes error stack in message when error is provided", function () {
-            var originalError = new Error("Original error");
-            var apiError = new errors_1.APIError({
-                error: originalError,
-                title: "Wrapped error",
-            });
-            (0, bun_test_1.expect)(apiError.message).toContain("Wrapped error");
-            (0, bun_test_1.expect)(originalError.stack).toBeDefined();
-            (0, bun_test_1.expect)(apiError.message).toContain(originalError.stack);
-        });
-        (0, bun_test_1.it)("includes detail in message when provided", function () {
-            var error = new errors_1.APIError({
-                detail: "More details here",
-                title: "Test error",
-            });
-            (0, bun_test_1.expect)(error.message).toContain("Test error");
-            (0, bun_test_1.expect)(error.message).toContain("More details here");
-        });
-        (0, bun_test_1.it)("sets fields in meta when provided", function () {
-            var _a;
-            var error = new errors_1.APIError({
-                fields: { email: "Invalid email format" },
-                title: "Validation error",
-            });
-            (0, bun_test_1.expect)((_a = error.meta) === null || _a === void 0 ? void 0 : _a.fields).toEqual({ email: "Invalid email format" });
-        });
-    });
-    (0, bun_test_1.describe)("errorsPlugin", function () {
-        (0, bun_test_1.it)("adds apiErrors field to schema", function () { return __awaiter(void 0, void 0, void 0, function () {
-            var mongoose, errorsPlugin, testSchema;
-            return __generator(this, function (_a) {
-                switch (_a.label) {
-                    case 0: return [4 /*yield*/, Promise.resolve().then(function () { return __importStar(require("mongoose")); })];
-                    case 1:
-                        mongoose = _a.sent();
-                        return [4 /*yield*/, Promise.resolve().then(function () { return __importStar(require("./errors")); })];
-                    case 2:
-                        errorsPlugin = (_a.sent()).errorsPlugin;
-                        testSchema = new mongoose.Schema({ name: String });
-                        errorsPlugin(testSchema);
-                        (0, bun_test_1.expect)(testSchema.path("apiErrors")).toBeDefined();
-                        return [2 /*return*/];
-                }
-            });
-        }); });
-    });
-    (0, bun_test_1.describe)("isAPIError", function () {
-        (0, bun_test_1.it)("returns true for APIError instances", function () {
-            var isAPIError = require("./errors").isAPIError;
-            var error = new errors_1.APIError({ title: "Test" });
-            (0, bun_test_1.expect)(isAPIError(error)).toBe(true);
-        });
-        (0, bun_test_1.it)("returns false for regular Error instances", function () {
-            var isAPIError = require("./errors").isAPIError;
-            var error = new Error("Test");
-            (0, bun_test_1.expect)(isAPIError(error)).toBe(false);
-        });
-    });
-    (0, bun_test_1.describe)("getDisableExternalErrorTracking", function () {
-        (0, bun_test_1.it)("returns undefined for non-objects", function () {
-            var getDisableExternalErrorTracking = require("./errors").getDisableExternalErrorTracking;
-            (0, bun_test_1.expect)(getDisableExternalErrorTracking(null)).toBeUndefined();
-            (0, bun_test_1.expect)(getDisableExternalErrorTracking("string")).toBeUndefined();
-        });
-        (0, bun_test_1.it)("returns value from APIError", function () {
-            var getDisableExternalErrorTracking = require("./errors").getDisableExternalErrorTracking;
-            var error = new errors_1.APIError({ disableExternalErrorTracking: true, title: "Test" });
-            (0, bun_test_1.expect)(getDisableExternalErrorTracking(error)).toBe(true);
-        });
-        (0, bun_test_1.it)("returns value from plain object with property", function () {
-            var getDisableExternalErrorTracking = require("./errors").getDisableExternalErrorTracking;
-            var obj = { disableExternalErrorTracking: true };
-            (0, bun_test_1.expect)(getDisableExternalErrorTracking(obj)).toBe(true);
-        });
-    });
-    (0, bun_test_1.describe)("getAPIErrorBody", function () {
-        (0, bun_test_1.it)("includes all non-undefined fields", function () {
-            var getAPIErrorBody = require("./errors").getAPIErrorBody;
-            var error = new errors_1.APIError({
-                code: "TEST_CODE",
-                detail: "Test detail",
-                id: "error-123",
-                links: { about: "http://example.com" },
-                meta: { extra: "data" },
-                source: { parameter: "id" },
-                status: 400,
-                title: "Test error",
-            });
-            var body = getAPIErrorBody(error);
-            (0, bun_test_1.expect)(body.title).toBe("Test error");
-            (0, bun_test_1.expect)(body.status).toBe(400);
-            (0, bun_test_1.expect)(body.code).toBe("TEST_CODE");
-            (0, bun_test_1.expect)(body.detail).toBe("Test detail");
-            (0, bun_test_1.expect)(body.id).toBe("error-123");
-            (0, bun_test_1.expect)(body.links).toEqual({ about: "http://example.com" });
-            (0, bun_test_1.expect)(body.source).toEqual({ parameter: "id" });
-            (0, bun_test_1.expect)(body.meta).toEqual({ extra: "data" });
-        });
-    });
-    (0, bun_test_1.describe)("apiUnauthorizedMiddleware", function () {
-        (0, bun_test_1.it)("returns 401 for Unauthorized errors", function () {
-            var apiUnauthorizedMiddleware = require("./errors").apiUnauthorizedMiddleware;
-            var err = new Error("Unauthorized");
-            var res = {
-                json: function (data) {
-                    this.body = data;
-                    return this;
-                },
-                send: function () {
-                    return this;
-                },
-                status: function (code) {
-                    this.statusCode = code;
-                    return this;
-                },
-            };
-            var next = function () { };
-            apiUnauthorizedMiddleware(err, {}, res, next);
-            (0, bun_test_1.expect)(res.statusCode).toBe(401);
-            (0, bun_test_1.expect)(res.body.title).toBe("Unauthorized");
-        });
-        (0, bun_test_1.it)("calls next for non-Unauthorized errors", function () {
-            var apiUnauthorizedMiddleware = require("./errors").apiUnauthorizedMiddleware;
-            var err = new Error("Some other error");
-            var nextCalled = false;
-            var next = function () {
-                nextCalled = true;
-            };
-            apiUnauthorizedMiddleware(err, {}, {}, next);
-            (0, bun_test_1.expect)(nextCalled).toBe(true);
-        });
-    });
-});
-(0, bun_test_1.describe)("permissions module", function () {
-    (0, bun_test_1.describe)("OwnerQueryFilter", function () {
-        (0, bun_test_1.it)("returns ownerId filter when user is provided", function () {
-            var OwnerQueryFilter = require("./permissions").OwnerQueryFilter;
-            var user = { id: "user-123" };
-            var filter = OwnerQueryFilter(user);
-            (0, bun_test_1.expect)(filter).toEqual({ ownerId: "user-123" });
-        });
-        (0, bun_test_1.it)("returns null when user is undefined", function () {
-            var OwnerQueryFilter = require("./permissions").OwnerQueryFilter;
-            var filter = OwnerQueryFilter(undefined);
-            (0, bun_test_1.expect)(filter).toBeNull();
-        });
-    });
-    (0, bun_test_1.describe)("Permissions.IsAuthenticatedOrReadOnly", function () {
-        (0, bun_test_1.it)("returns true for authenticated non-anonymous users", function () {
-            var Permissions = require("./permissions").Permissions;
-            var user = { id: "user-123", isAnonymous: false };
-            (0, bun_test_1.expect)(Permissions.IsAuthenticatedOrReadOnly("create", user)).toBe(true);
-        });
-        (0, bun_test_1.it)("returns true for read methods when user is anonymous", function () {
-            var Permissions = require("./permissions").Permissions;
-            var user = { id: "user-123", isAnonymous: true };
-            (0, bun_test_1.expect)(Permissions.IsAuthenticatedOrReadOnly("list", user)).toBe(true);
-            (0, bun_test_1.expect)(Permissions.IsAuthenticatedOrReadOnly("read", user)).toBe(true);
-        });
-        (0, bun_test_1.it)("returns false for write methods when user is anonymous", function () {
-            var Permissions = require("./permissions").Permissions;
-            var user = { id: "user-123", isAnonymous: true };
-            (0, bun_test_1.expect)(Permissions.IsAuthenticatedOrReadOnly("create", user)).toBe(false);
-            (0, bun_test_1.expect)(Permissions.IsAuthenticatedOrReadOnly("update", user)).toBe(false);
-            (0, bun_test_1.expect)(Permissions.IsAuthenticatedOrReadOnly("delete", user)).toBe(false);
-        });
-    });
-    (0, bun_test_1.describe)("Permissions.IsOwnerOrReadOnly", function () {
-        (0, bun_test_1.it)("returns true when no object is provided", function () {
-            var Permissions = require("./permissions").Permissions;
-            (0, bun_test_1.expect)(Permissions.IsOwnerOrReadOnly("update", { id: "user-123" }, undefined)).toBe(true);
-        });
-        (0, bun_test_1.it)("returns true for admin users", function () {
-            var Permissions = require("./permissions").Permissions;
-            var user = { admin: true, id: "admin-123" };
-            var obj = { ownerId: "other-user" };
-            (0, bun_test_1.expect)(Permissions.IsOwnerOrReadOnly("update", user, obj)).toBe(true);
-        });
-        (0, bun_test_1.it)("returns true when user is owner", function () {
-            var Permissions = require("./permissions").Permissions;
-            var user = { id: "user-123" };
-            var obj = { ownerId: "user-123" };
-            (0, bun_test_1.expect)(Permissions.IsOwnerOrReadOnly("update", user, obj)).toBe(true);
-        });
-        (0, bun_test_1.it)("returns true for read methods when not owner", function () {
-            var Permissions = require("./permissions").Permissions;
-            var user = { id: "user-123" };
-            var obj = { ownerId: "other-user" };
-            (0, bun_test_1.expect)(Permissions.IsOwnerOrReadOnly("list", user, obj)).toBe(true);
-            (0, bun_test_1.expect)(Permissions.IsOwnerOrReadOnly("read", user, obj)).toBe(true);
-        });
-        (0, bun_test_1.it)("returns false for write methods when not owner", function () {
-            var Permissions = require("./permissions").Permissions;
-            var user = { id: "user-123" };
-            var obj = { ownerId: "other-user" };
-            (0, bun_test_1.expect)(Permissions.IsOwnerOrReadOnly("update", user, obj)).toBe(false);
-            (0, bun_test_1.expect)(Permissions.IsOwnerOrReadOnly("delete", user, obj)).toBe(false);
-        });
-    });
-});
-(0, bun_test_1.describe)("utils module", function () {
-    (0, bun_test_1.describe)("isValidObjectId", function () {
-        (0, bun_test_1.it)("returns true for valid ObjectId strings", function () {
-            var isValidObjectId = require("./utils").isValidObjectId;
-            (0, bun_test_1.expect)(isValidObjectId("507f1f77bcf86cd799439011")).toBe(true);
-        });
-        (0, bun_test_1.it)("returns false for invalid ObjectId strings", function () {
-            var isValidObjectId = require("./utils").isValidObjectId;
-            (0, bun_test_1.expect)(isValidObjectId("invalid-id")).toBe(false);
-            (0, bun_test_1.expect)(isValidObjectId("12345")).toBe(false);
-            (0, bun_test_1.expect)(isValidObjectId("")).toBe(false);
-        });
-        (0, bun_test_1.it)("returns false for 12-character strings that are not valid ObjectIds", function () {
-            var isValidObjectId = require("./utils").isValidObjectId;
-            // mongoose's native isValid returns true for any 12-char string
-            // but our implementation should return false since toString won't match
-            (0, bun_test_1.expect)(isValidObjectId("123456789012")).toBe(false);
-        });
-    });
-    (0, bun_test_1.describe)("timeout", function () {
-        (0, bun_test_1.it)("resolves after specified time", function () { return __awaiter(void 0, void 0, void 0, function () {
-            var timeout, start, elapsed;
-            return __generator(this, function (_a) {
-                switch (_a.label) {
-                    case 0:
-                        timeout = require("./utils").timeout;
-                        start = Date.now();
-                        return [4 /*yield*/, timeout(50)];
-                    case 1:
                         _a.sent();
-                        elapsed = Date.now() - start;
-                        (0, bun_test_1.expect)(elapsed).toBeGreaterThanOrEqual(40);
-                        return [2 /*return*/];
-                }
-            });
-        }); });
-    });
-    // Note: Comprehensive checkModelsStrict tests are in utils.test.ts with mocked mongoose
-});
-(0, bun_test_1.describe)("populate module", function () {
-    (0, bun_test_1.describe)("unpopulate", function () {
-        (0, bun_test_1.it)("throws error when path is empty", function () { return __awaiter(void 0, void 0, void 0, function () {
-            var unpopulate, doc;
-            return __generator(this, function (_a) {
-                switch (_a.label) {
-                    case 0: return [4 /*yield*/, Promise.resolve().then(function () { return __importStar(require("./populate")); })];
-                    case 1:
-                        unpopulate = (_a.sent()).unpopulate;
-                        doc = { name: "test" };
-                        (0, bun_test_1.expect)(function () { return unpopulate(doc, ""); }).toThrow("path is required");
-                        return [2 /*return*/];
-                }
-            });
-        }); });
-        (0, bun_test_1.it)("unpopulates single populated field", function () { return __awaiter(void 0, void 0, void 0, function () {
-            var unpopulate, doc, result;
-            return __generator(this, function (_a) {
-                switch (_a.label) {
-                    case 0: return [4 /*yield*/, Promise.resolve().then(function () { return __importStar(require("./populate")); })];
-                    case 1:
-                        unpopulate = (_a.sent()).unpopulate;
-                        doc = {
-                            name: "test",
-                            ownerId: { _id: "owner-123", email: "owner@test.com" },
-                        };
-                        result = unpopulate(doc, "ownerId");
-                        (0, bun_test_1.expect)(result.ownerId).toBe("owner-123");
-                        return [2 /*return*/];
-                }
-            });
-        }); });
-        (0, bun_test_1.it)("unpopulates array of populated fields", function () { return __awaiter(void 0, void 0, void 0, function () {
-            var unpopulate, doc, result;
-            return __generator(this, function (_a) {
-                switch (_a.label) {
-                    case 0: return [4 /*yield*/, Promise.resolve().then(function () { return __importStar(require("./populate")); })];
-                    case 1:
-                        unpopulate = (_a.sent()).unpopulate;
-                        doc = {
-                            items: [{ _id: "item-1", name: "Item 1" }, { _id: "item-2", name: "Item 2" }, "item-3"],
-                            name: "test",
-                        };
-                        result = unpopulate(doc, "items");
-                        (0, bun_test_1.expect)(result.items).toEqual(["item-1", "item-2", "item-3"]);
-                        return [2 /*return*/];
-                }
-            });
-        }); });
-        (0, bun_test_1.it)("handles nested paths", function () { return __awaiter(void 0, void 0, void 0, function () {
-            var unpopulate, doc, result;
-            return __generator(this, function (_a) {
-                switch (_a.label) {
-                    case 0: return [4 /*yield*/, Promise.resolve().then(function () { return __importStar(require("./populate")); })];
-                    case 1:
-                        unpopulate = (_a.sent()).unpopulate;
-                        doc = {
-                            name: "test",
-                            nested: {
-                                items: [
-                                    { _id: "item-1", name: "Item 1" },
-                                    { _id: "item-2", name: "Item 2" },
-                                ],
-                            },
-                        };
-                        result = unpopulate(doc, "nested.items");
-                        (0, bun_test_1.expect)(result.nested.items).toEqual(["item-1", "item-2"]);
-                        return [2 /*return*/];
-                }
-            });
-        }); });
-        (0, bun_test_1.it)("returns original doc when path does not exist", function () { return __awaiter(void 0, void 0, void 0, function () {
-            var unpopulate, doc, result;
-            return __generator(this, function (_a) {
-                switch (_a.label) {
-                    case 0: return [4 /*yield*/, Promise.resolve().then(function () { return __importStar(require("./populate")); })];
-                    case 1:
-                        unpopulate = (_a.sent()).unpopulate;
-                        doc = { name: "test" };
-                        result = unpopulate(doc, "nonexistent");
-                        (0, bun_test_1.expect)(result).toEqual(doc);
-                        return [2 /*return*/];
-                }
-            });
-        }); });
-        (0, bun_test_1.it)("handles nested array paths", function () { return __awaiter(void 0, void 0, void 0, function () {
-            var unpopulate, doc, result;
-            return __generator(this, function (_a) {
-                switch (_a.label) {
-                    case 0: return [4 /*yield*/, Promise.resolve().then(function () { return __importStar(require("./populate")); })];
-                    case 1:
-                        unpopulate = (_a.sent()).unpopulate;
-                        doc = {
-                            containers: [
-                                { items: [{ _id: "item-1" }, { _id: "item-2" }] },
-                                { items: [{ _id: "item-3" }, { _id: "item-4" }] },
-                            ],
-                            name: "test",
-                        };
-                        result = unpopulate(doc, "containers.items");
-                        (0, bun_test_1.expect)(result.containers[0].items).toEqual(["item-1", "item-2"]);
-                        (0, bun_test_1.expect)(result.containers[1].items).toEqual(["item-3", "item-4"]);
-                        return [2 /*return*/];
-                }
-            });
-        }); });
-    });
-});
-(0, bun_test_1.describe)("auth module edge cases", function () {
-    (0, bun_test_1.describe)("generateTokens", function () {
-        (0, bun_test_1.it)("returns null tokens when user is missing", function () { return __awaiter(void 0, void 0, void 0, function () {
-            var generateTokens, result;
-            return __generator(this, function (_a) {
-                switch (_a.label) {
-                    case 0: return [4 /*yield*/, Promise.resolve().then(function () { return __importStar(require("./auth")); })];
-                    case 1:
-                        generateTokens = (_a.sent()).generateTokens;
-                        return [4 /*yield*/, generateTokens(null)];
-                    case 2:
-                        result = _a.sent();
-                        (0, bun_test_1.expect)(result.token).toBeNull();
-                        (0, bun_test_1.expect)(result.refreshToken).toBeNull();
-                        return [2 /*return*/];
-                }
-            });
-        }); });
-        (0, bun_test_1.it)("returns null tokens when user has no _id", function () { return __awaiter(void 0, void 0, void 0, function () {
-            var generateTokens, result;
-            return __generator(this, function (_a) {
-                switch (_a.label) {
-                    case 0: return [4 /*yield*/, Promise.resolve().then(function () { return __importStar(require("./auth")); })];
-                    case 1:
-                        generateTokens = (_a.sent()).generateTokens;
-                        return [4 /*yield*/, generateTokens({ email: "test@test.com" })];
-                    case 2:
-                        result = _a.sent();
-                        (0, bun_test_1.expect)(result.token).toBeNull();
-                        (0, bun_test_1.expect)(result.refreshToken).toBeNull();
-                        return [2 /*return*/];
-                }
-            });
-        }); });
-        (0, bun_test_1.it)("includes custom payload from generateJWTPayload option", function () { return __awaiter(void 0, void 0, void 0, function () {
-            var generateTokens, jwt, user, result, decoded;
-            return __generator(this, function (_a) {
-                switch (_a.label) {
-                    case 0: return [4 /*yield*/, Promise.resolve().then(function () { return __importStar(require("./auth")); })];
-                    case 1:
-                        generateTokens = (_a.sent()).generateTokens;
-                        return [4 /*yield*/, Promise.resolve().then(function () { return __importStar(require("jsonwebtoken")); })];
-                    case 2:
-                        jwt = _a.sent();
-                        user = { _id: "user-123" };
-                        return [4 /*yield*/, generateTokens(user, {
-                                generateJWTPayload: function (u) { return ({ customField: "customValue", userId: u._id }); },
-                            })];
-                    case 3:
-                        result = _a.sent();
-                        (0, bun_test_1.expect)(result.token).toBeDefined();
-                        decoded = jwt.decode(result.token);
-                        (0, bun_test_1.expect)(decoded.customField).toBe("customValue");
-                        (0, bun_test_1.expect)(decoded.id).toBe("user-123");
-                        return [2 /*return*/];
-                }
-            });
-        }); });
-        (0, bun_test_1.it)("uses custom token expiration from generateTokenExpiration option", function () { return __awaiter(void 0, void 0, void 0, function () {
-            var generateTokens, jwt, user, result, decoded, expectedExp;
-            return __generator(this, function (_a) {
-                switch (_a.label) {
-                    case 0: return [4 /*yield*/, Promise.resolve().then(function () { return __importStar(require("./auth")); })];
-                    case 1:
-                        generateTokens = (_a.sent()).generateTokens;
-                        return [4 /*yield*/, Promise.resolve().then(function () { return __importStar(require("jsonwebtoken")); })];
-                    case 2:
-                        jwt = _a.sent();
-                        user = { _id: "user-123" };
-                        return [4 /*yield*/, generateTokens(user, {
-                                generateTokenExpiration: function () { return "1h"; },
-                            })];
-                    case 3:
-                        result = _a.sent();
-                        (0, bun_test_1.expect)(result.token).toBeDefined();
-                        decoded = jwt.decode(result.token);
-                        expectedExp = Math.floor(Date.now() / 1000) + 3600;
-                        (0, bun_test_1.expect)(decoded.exp).toBeGreaterThan(expectedExp - 5);
-                        (0, bun_test_1.expect)(decoded.exp).toBeLessThan(expectedExp + 5);
-                        return [2 /*return*/];
-                }
-            });
-        }); });
-        (0, bun_test_1.it)("uses custom refresh token expiration from generateRefreshTokenExpiration option", function () { return __awaiter(void 0, void 0, void 0, function () {
-            var generateTokens, jwt, user, result, decoded, expectedExp;
-            return __generator(this, function (_a) {
-                switch (_a.label) {
-                    case 0: return [4 /*yield*/, Promise.resolve().then(function () { return __importStar(require("./auth")); })];
-                    case 1:
-                        generateTokens = (_a.sent()).generateTokens;
-                        return [4 /*yield*/, Promise.resolve().then(function () { return __importStar(require("jsonwebtoken")); })];
-                    case 2:
-                        jwt = _a.sent();
-                        user = { _id: "user-123" };
-                        return [4 /*yield*/, generateTokens(user, {
-                                generateRefreshTokenExpiration: function () { return "7d"; },
-                            })];
-                    case 3:
-                        result = _a.sent();
-                        (0, bun_test_1.expect)(result.refreshToken).toBeDefined();
-                        decoded = jwt.decode(result.refreshToken);
-                        expectedExp = Math.floor(Date.now() / 1000) + 7 * 24 * 3600;
-                        (0, bun_test_1.expect)(decoded.exp).toBeGreaterThan(expectedExp - 10);
-                        (0, bun_test_1.expect)(decoded.exp).toBeLessThan(expectedExp + 10);
                         return [2 /*return*/];
                 }
             });