@terreno/api 0.0.11 → 0.0.13

package/dist/notifiers/slackNotifier.js

@@ -78,26 +78,33 @@ var axios_1 = __importDefault(require("axios"));
 var errors_1 = require("../errors");
 var logger_1 = require("../logger");
 // Convenience method to send data to a Slack webhook.
+// If `url` is provided, it will be used directly instead of looking up from environment.
+// DEPRECATED: Looking up webhook URLs from the SLACK_WEBHOOKS environment variable by channel name
+// is deprecated and will be removed in a future version. Please pass the `url` parameter directly.
 function sendToSlack(text_1) {
     return __awaiter(this, arguments, void 0, function (text, _a) {
-        var slackWebhooksString, slackWebhooks, channel, slackWebhookUrl, formattedText, error_1;
+        var slackWebhookUrl, slackWebhooksString, slackWebhooks, channel, formattedText, error_1;
         var _b, _c, _d;
-        var _e = _a === void 0 ? {} : _a, slackChannel = _e.slackChannel, _f = _e.shouldThrow, shouldThrow = _f === void 0 ? false : _f, env = _e.env;
+        var _e = _a === void 0 ? {} : _a, slackChannel = _e.slackChannel, _f = _e.shouldThrow, shouldThrow = _f === void 0 ? false : _f, env = _e.env, url = _e.url;
         return __generator(this, function (_g) {
             switch (_g.label) {
                 case 0:
-                    slackWebhooksString = process.env.SLACK_WEBHOOKS;
-                    if (!slackWebhooksString) {
-                        logger_1.logger.debug("You must set SLACK_WEBHOOKS in the environment to use sendToSlack.");
-                        return [2 /*return*/];
-                    }
-                    slackWebhooks = JSON.parse(slackWebhooksString !== null && slackWebhooksString !== void 0 ? slackWebhooksString : "{}");
-                    channel = slackChannel !== null && slackChannel !== void 0 ? slackChannel : "default";
-                    slackWebhookUrl = (_b = slackWebhooks[channel]) !== null && _b !== void 0 ? _b : slackWebhooks.default;
+                    slackWebhookUrl = url;
                     if (!slackWebhookUrl) {
-                        Sentry.captureException(new Error("No webhook url set in env for ".concat(channel, ". Slack message not sent")));
-                        logger_1.logger.debug("No webhook url set in env for ".concat(channel, "."));
-                        return [2 /*return*/];
+                        logger_1.logger.debug("DEPRECATED: Looking up webhook URLs from SLACK_WEBHOOKS environment variable is deprecated and will be removed in a future version. Please pass the url parameter directly.");
+                        slackWebhooksString = process.env.SLACK_WEBHOOKS;
+                        if (!slackWebhooksString) {
+                            logger_1.logger.debug("You must set SLACK_WEBHOOKS in the environment to use sendToSlack.");
+                            return [2 /*return*/];
+                        }
+                        slackWebhooks = JSON.parse(slackWebhooksString !== null && slackWebhooksString !== void 0 ? slackWebhooksString : "{}");
+                        channel = slackChannel !== null && slackChannel !== void 0 ? slackChannel : "default";
+                        slackWebhookUrl = (_b = slackWebhooks[channel]) !== null && _b !== void 0 ? _b : slackWebhooks.default;
+                        if (!slackWebhookUrl) {
+                            Sentry.captureException(new Error("No webhook url set in env for ".concat(channel, ". Slack message not sent")));
+                            logger_1.logger.debug("No webhook url set in env for ".concat(channel, "."));
+                            return [2 /*return*/];
+                        }
                     }
                     formattedText = text;
                     if (env) {

package/dist/permissions.d.ts

@@ -23,4 +23,4 @@ export declare const Permissions: {
     IsOwnerOrReadOnly: (method: RESTMethod, user?: User, obj?: any) => boolean;
 };
 export declare function checkPermissions<T>(method: RESTMethod, permissions: PermissionMethod<T>[], user?: User, obj?: T): Promise<boolean>;
-export declare function permissionMiddleware<T>(baseModel: Model<T>, options: Pick<ModelRouterOptions<T>, "permissions" | "populatePaths" | "discriminatorKey">): (req: express.Request, _res: express.Response, next: NextFunction) => Promise<void>;
+export declare function permissionMiddleware<T>(model: Model<T>, options: Pick<ModelRouterOptions<T>, "permissions" | "populatePaths">): (req: express.Request, _res: express.Response, next: NextFunction) => Promise<void>;

package/dist/permissions.js

@@ -194,20 +194,20 @@ function checkPermissions(method, permissions, user, obj) {
 // Check the permissions for a given model and method. If the method is a read, update, or delete,
 // finds the relevant object, checks the permissions, and attaches the object to the request as
 // req.obj.
-function permissionMiddleware(baseModel, options) {
+function permissionMiddleware(model, options) {
     var _this = this;
     return function (req, _res, next) { return __awaiter(_this, void 0, void 0, function () {
-        var method, reqMethod, model, builtQuery, populatedQuery, data, error_1, hiddenDoc, error, reason, error, error_2;
-        var _a, _b, _c, _d;
-        return __generator(this, function (_e) {
-            switch (_e.label) {
+        var method, reqMethod, builtQuery, populatedQuery, data, error_1, hiddenDoc, error, reason, error, error_2;
+        var _a, _b;
+        return __generator(this, function (_c) {
+            switch (_c.label) {
                 case 0:
                     if (req.method === "OPTIONS") {
                         return [2 /*return*/, next()];
                     }
-                    _e.label = 1;
+                    _c.label = 1;
                 case 1:
-                    _e.trys.push([1, 10, , 11]);
+                    _c.trys.push([1, 10, , 11]);
                     method = void 0;
                     reqMethod = req.method.toLowerCase();
                     if (reqMethod === "post") {
@@ -233,11 +233,10 @@ function permissionMiddleware(baseModel, options) {
                             title: "Method ".concat(req.method, " not allowed"),
                         });
                     }
-                    model = (0, api_1.getModel)(baseModel, req.body, options);
                     return [4 /*yield*/, checkPermissions(method, options.permissions[method], req.user)];
                 case 2:
                     // All methods check for permissions.
-                    if (!(_e.sent())) {
+                    if (!(_c.sent())) {
                         throw new errors_1.APIError({
                             status: 405,
                             title: "Access to ".concat(method.toUpperCase(), " on ").concat(model.modelName, " ") +
@@ -250,34 +249,27 @@ function permissionMiddleware(baseModel, options) {
                     builtQuery = model.findById(req.params.id);
                     populatedQuery = (0, api_1.addPopulateToQuery)(builtQuery, options.populatePaths);
                     data = void 0;
-                    _e.label = 3;
+                    _c.label = 3;
                 case 3:
-                    _e.trys.push([3, 5, , 6]);
+                    _c.trys.push([3, 5, , 6]);
                     return [4 /*yield*/, populatedQuery.exec()];
                 case 4:
-                    data = _e.sent();
+                    data = _c.sent();
                     return [3 /*break*/, 6];
                 case 5:
-                    error_1 = _e.sent();
+                    error_1 = _c.sent();
                     throw new errors_1.APIError({
                         error: error_1,
                         status: 500,
                         title: "GET failed on ".concat(req.params.id),
                     });
                 case 6:
-                    if (!(!data || (["update", "delete"].includes(method) && (data === null || data === void 0 ? void 0 : data.__t) && !((_b = req.body) === null || _b === void 0 ? void 0 : _b.__t)))) return [3 /*break*/, 8];
-                    // For discriminated models, return 404 without checking hidden state
-                    if (["update", "delete"].includes(method) && (data === null || data === void 0 ? void 0 : data.__t) && !((_c = req.body) === null || _c === void 0 ? void 0 : _c.__t)) {
-                        throw new errors_1.APIError({
-                            status: 404,
-                            title: "Document ".concat(req.params.id, " not found for model ").concat(model.modelName),
-                        });
-                    }
+                    if (!!data) return [3 /*break*/, 8];
                     return [4 /*yield*/, model.collection.findOne({
                             _id: new mongoose_1.default.Types.ObjectId(req.params.id),
                         })];
                 case 7:
-                    hiddenDoc = _e.sent();
+                    hiddenDoc = _c.sent();
                     if (!hiddenDoc) {
                         Sentry.captureMessage("Document ".concat(req.params.id, " not found for model ").concat(model.modelName));
                         error = new errors_1.APIError({
@@ -312,16 +304,16 @@ function permissionMiddleware(baseModel, options) {
                     });
                 case 8: return [4 /*yield*/, checkPermissions(method, options.permissions[method], req.user, data)];
                 case 9:
-                    if (!(_e.sent())) {
+                    if (!(_c.sent())) {
                         throw new errors_1.APIError({
                             status: 403,
-                            title: "Access to GET on ".concat(model.modelName, ":").concat(req.params.id, " denied for ").concat((_d = req.user) === null || _d === void 0 ? void 0 : _d.id),
+                            title: "Access to GET on ".concat(model.modelName, ":").concat(req.params.id, " denied for ").concat((_b = req.user) === null || _b === void 0 ? void 0 : _b.id),
                         });
                     }
                     req.obj = data;
                     return [2 /*return*/, next()];
                 case 10:
-                    error_2 = _e.sent();
+                    error_2 = _c.sent();
                     logger_1.logger.error("Permissions error: ".concat(error_2 instanceof Error ? error_2.message : error_2));
                     return [2 /*return*/, next(error_2)];
                 case 11: return [2 /*return*/];

package/dist/permissions.test.js

@@ -411,3 +411,60 @@ var tests_1 = require("./tests");
         }); });
     });
 });
+(0, bun_test_1.describe)("permissions module", function () {
+    (0, bun_test_1.describe)("OwnerQueryFilter", function () {
+        (0, bun_test_1.it)("returns ownerId filter when user is provided", function () {
+            var user = { id: "user-123" };
+            var filter = (0, permissions_1.OwnerQueryFilter)(user);
+            (0, bun_test_1.expect)(filter).toEqual({ ownerId: "user-123" });
+        });
+        (0, bun_test_1.it)("returns null when user is undefined", function () {
+            var filter = (0, permissions_1.OwnerQueryFilter)(undefined);
+            (0, bun_test_1.expect)(filter).toBeNull();
+        });
+    });
+    (0, bun_test_1.describe)("Permissions.IsAuthenticatedOrReadOnly", function () {
+        (0, bun_test_1.it)("returns true for authenticated non-anonymous users", function () {
+            var user = { id: "user-123", isAnonymous: false };
+            (0, bun_test_1.expect)(permissions_1.Permissions.IsAuthenticatedOrReadOnly("create", user)).toBe(true);
+        });
+        (0, bun_test_1.it)("returns true for read methods when user is anonymous", function () {
+            var user = { id: "user-123", isAnonymous: true };
+            (0, bun_test_1.expect)(permissions_1.Permissions.IsAuthenticatedOrReadOnly("list", user)).toBe(true);
+            (0, bun_test_1.expect)(permissions_1.Permissions.IsAuthenticatedOrReadOnly("read", user)).toBe(true);
+        });
+        (0, bun_test_1.it)("returns false for write methods when user is anonymous", function () {
+            var user = { id: "user-123", isAnonymous: true };
+            (0, bun_test_1.expect)(permissions_1.Permissions.IsAuthenticatedOrReadOnly("create", user)).toBe(false);
+            (0, bun_test_1.expect)(permissions_1.Permissions.IsAuthenticatedOrReadOnly("update", user)).toBe(false);
+            (0, bun_test_1.expect)(permissions_1.Permissions.IsAuthenticatedOrReadOnly("delete", user)).toBe(false);
+        });
+    });
+    (0, bun_test_1.describe)("Permissions.IsOwnerOrReadOnly", function () {
+        (0, bun_test_1.it)("returns true when no object is provided", function () {
+            (0, bun_test_1.expect)(permissions_1.Permissions.IsOwnerOrReadOnly("update", { id: "user-123" }, undefined)).toBe(true);
+        });
+        (0, bun_test_1.it)("returns true for admin users", function () {
+            var user = { admin: true, id: "admin-123" };
+            var obj = { ownerId: "other-user" };
+            (0, bun_test_1.expect)(permissions_1.Permissions.IsOwnerOrReadOnly("update", user, obj)).toBe(true);
+        });
+        (0, bun_test_1.it)("returns true when user is owner", function () {
+            var user = { id: "user-123" };
+            var obj = { ownerId: "user-123" };
+            (0, bun_test_1.expect)(permissions_1.Permissions.IsOwnerOrReadOnly("update", user, obj)).toBe(true);
+        });
+        (0, bun_test_1.it)("returns true for read methods when not owner", function () {
+            var user = { id: "user-123" };
+            var obj = { ownerId: "other-user" };
+            (0, bun_test_1.expect)(permissions_1.Permissions.IsOwnerOrReadOnly("list", user, obj)).toBe(true);
+            (0, bun_test_1.expect)(permissions_1.Permissions.IsOwnerOrReadOnly("read", user, obj)).toBe(true);
+        });
+        (0, bun_test_1.it)("returns false for write methods when not owner", function () {
+            var user = { id: "user-123" };
+            var obj = { ownerId: "other-user" };
+            (0, bun_test_1.expect)(permissions_1.Permissions.IsOwnerOrReadOnly("update", user, obj)).toBe(false);
+            (0, bun_test_1.expect)(permissions_1.Permissions.IsOwnerOrReadOnly("delete", user, obj)).toBe(false);
+        });
+    });
+});

package/dist/populate.test.js

@@ -131,3 +131,55 @@ var tests_1 = require("./tests");
         });
     }); });
 });
+(0, bun_test_1.describe)("unpopulate edge cases", function () {
+    (0, bun_test_1.it)("throws error when path is empty", function () {
+        var doc = { name: "test" };
+        (0, bun_test_1.expect)(function () { return (0, populate_1.unpopulate)(doc, ""); }).toThrow("path is required");
+    });
+    (0, bun_test_1.it)("unpopulates single populated field", function () {
+        var doc = {
+            name: "test",
+            ownerId: { _id: "owner-123", email: "owner@test.com" },
+        };
+        var result = (0, populate_1.unpopulate)(doc, "ownerId");
+        (0, bun_test_1.expect)(result.ownerId).toBe("owner-123");
+    });
+    (0, bun_test_1.it)("unpopulates array of populated fields", function () {
+        var doc = {
+            items: [{ _id: "item-1", name: "Item 1" }, { _id: "item-2", name: "Item 2" }, "item-3"],
+            name: "test",
+        };
+        var result = (0, populate_1.unpopulate)(doc, "items");
+        (0, bun_test_1.expect)(result.items).toEqual(["item-1", "item-2", "item-3"]);
+    });
+    (0, bun_test_1.it)("handles nested paths", function () {
+        var doc = {
+            name: "test",
+            nested: {
+                items: [
+                    { _id: "item-1", name: "Item 1" },
+                    { _id: "item-2", name: "Item 2" },
+                ],
+            },
+        };
+        var result = (0, populate_1.unpopulate)(doc, "nested.items");
+        (0, bun_test_1.expect)(result.nested.items).toEqual(["item-1", "item-2"]);
+    });
+    (0, bun_test_1.it)("returns original doc when path does not exist", function () {
+        var doc = { name: "test" };
+        var result = (0, populate_1.unpopulate)(doc, "nonexistent");
+        (0, bun_test_1.expect)(result).toEqual(doc);
+    });
+    (0, bun_test_1.it)("handles nested array paths", function () {
+        var doc = {
+            containers: [
+                { items: [{ _id: "item-1" }, { _id: "item-2" }] },
+                { items: [{ _id: "item-3" }, { _id: "item-4" }] },
+            ],
+            name: "test",
+        };
+        var result = (0, populate_1.unpopulate)(doc, "containers.items");
+        (0, bun_test_1.expect)(result.containers[0].items).toEqual(["item-1", "item-2"]);
+        (0, bun_test_1.expect)(result.containers[1].items).toEqual(["item-3", "item-4"]);
+    });
+});

package/dist/tests.d.ts

@@ -46,54 +46,36 @@ export interface Food {
         likes: boolean;
     }[];
 }
-export declare const UserModel: mongoose.Model<User, {}, {}, {}, mongoose.Document<unknown, {}, User, {}, mongoose.DefaultSchemaOptions> & User & {
+export declare const UserModel: mongoose.Model<User, {}, {}, {}, mongoose.Document<unknown, {}, User, {}, {}> & User & {
     _id: mongoose.Types.ObjectId;
 } & {
     __v: number;
-} & {
-    id: string;
-}, any, User>;
-export declare const SuperUserModel: mongoose.Model<User & SuperUser, {}, {}, {
-    id: string;
-}, mongoose.Document<unknown, {}, User & SuperUser, {
-    id: string;
-}, mongoose.DefaultSchemaOptions> & Omit<User & SuperUser & {
+}, any>;
+export declare const SuperUserModel: mongoose.Model<User & SuperUser, {}, {}, {}, mongoose.Document<unknown, {}, User & SuperUser, {}, {}> & User & SuperUser & {
     _id: mongoose.Types.ObjectId;
 } & {
     __v: number;
-}, "id"> & {
-    id: string;
-}, any, User & SuperUser>;
-export declare const StaffUserModel: mongoose.Model<User & StaffUser, {}, {}, {
-    id: string;
-}, mongoose.Document<unknown, {}, User & StaffUser, {
-    id: string;
-}, mongoose.DefaultSchemaOptions> & Omit<User & StaffUser & {
+}, any>;
+export declare const StaffUserModel: mongoose.Model<User & StaffUser, {}, {}, {}, mongoose.Document<unknown, {}, User & StaffUser, {}, {}> & User & StaffUser & {
     _id: mongoose.Types.ObjectId;
 } & {
     __v: number;
-}, "id"> & {
-    id: string;
-}, any, User & StaffUser>;
+}, any>;
 export declare const FoodModel: Model<Food>;
 interface RequiredField {
     name: string;
     about?: string;
 }
-export declare const RequiredModel: mongoose.Model<RequiredField, {}, {}, {}, mongoose.Document<unknown, {}, RequiredField, {}, mongoose.DefaultSchemaOptions> & RequiredField & {
+export declare const RequiredModel: mongoose.Model<RequiredField, {}, {}, {}, mongoose.Document<unknown, {}, RequiredField, {}, {}> & RequiredField & {
     _id: mongoose.Types.ObjectId;
 } & {
     __v: number;
-} & {
-    id: string;
-}, any, RequiredField>;
+}, any>;
 export declare function getBaseServer(): Express;
 export declare function authAsUser(app: express.Application, type: "admin" | "notAdmin"): Promise<TestAgent>;
-export declare function setupDb(): Promise<(mongoose.Document<unknown, {}, User, {}, mongoose.DefaultSchemaOptions> & User & {
+export declare function setupDb(): Promise<(mongoose.Document<unknown, {}, User, {}, {}> & User & {
     _id: mongoose.Types.ObjectId;
 } & {
     __v: number;
-} & {
-    id: string;
 })[]>;
 export {};

package/dist/utils.test.js

@@ -1,14 +1,242 @@
 "use strict";
+var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, generator) {
+    function adopt(value) { return value instanceof P ? value : new P(function (resolve) { resolve(value); }); }
+    return new (P || (P = Promise))(function (resolve, reject) {
+        function fulfilled(value) { try { step(generator.next(value)); } catch (e) { reject(e); } }
+        function rejected(value) { try { step(generator["throw"](value)); } catch (e) { reject(e); } }
+        function step(result) { result.done ? resolve(result.value) : adopt(result.value).then(fulfilled, rejected); }
+        step((generator = generator.apply(thisArg, _arguments || [])).next());
+    });
+};
+var __generator = (this && this.__generator) || function (thisArg, body) {
+    var _ = { label: 0, sent: function() { if (t[0] & 1) throw t[1]; return t[1]; }, trys: [], ops: [] }, f, y, t, g = Object.create((typeof Iterator === "function" ? Iterator : Object).prototype);
+    return g.next = verb(0), g["throw"] = verb(1), g["return"] = verb(2), typeof Symbol === "function" && (g[Symbol.iterator] = function() { return this; }), g;
+    function verb(n) { return function (v) { return step([n, v]); }; }
+    function step(op) {
+        if (f) throw new TypeError("Generator is already executing.");
+        while (g && (g = 0, op[0] && (_ = 0)), _) try {
+            if (f = 1, y && (t = op[0] & 2 ? y["return"] : op[0] ? y["throw"] || ((t = y["return"]) && t.call(y), 0) : y.next) && !(t = t.call(y, op[1])).done) return t;
+            if (y = 0, t) op = [op[0] & 2, t.value];
+            switch (op[0]) {
+                case 0: case 1: t = op; break;
+                case 4: _.label++; return { value: op[1], done: false };
+                case 5: _.label++; y = op[1]; op = [0]; continue;
+                case 7: op = _.ops.pop(); _.trys.pop(); continue;
+                default:
+                    if (!(t = _.trys, t = t.length > 0 && t[t.length - 1]) && (op[0] === 6 || op[0] === 2)) { _ = 0; continue; }
+                    if (op[0] === 3 && (!t || (op[1] > t[0] && op[1] < t[3]))) { _.label = op[1]; break; }
+                    if (op[0] === 6 && _.label < t[1]) { _.label = t[1]; t = op; break; }
+                    if (t && _.label < t[2]) { _.label = t[2]; _.ops.push(op); break; }
+                    if (t[2]) _.ops.pop();
+                    _.trys.pop(); continue;
+            }
+            op = body.call(thisArg, _);
+        } catch (e) { op = [6, e]; y = 0; } finally { f = t = 0; }
+        if (op[0] & 5) throw op[1]; return { value: op[0] ? op[1] : void 0, done: true };
+    }
+};
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
 Object.defineProperty(exports, "__esModule", { value: true });
 var bun_test_1 = require("bun:test");
+var mongoose_1 = __importDefault(require("mongoose"));
 var utils_1 = require("./utils");
 (0, bun_test_1.describe)("utils", function () {
-    (0, bun_test_1.it)("checks valid ObjectIds", function () {
-        (0, bun_test_1.expect)((0, utils_1.isValidObjectId)("62c44da0003d9f8ee8cc925c")).toBe(true);
-        (0, bun_test_1.expect)((0, utils_1.isValidObjectId)("620000000000000000000000")).toBe(true);
-        // Mongoose's builtin "ObjectId.isValid" will falsely say this is an ObjectId.
-        (0, bun_test_1.expect)((0, utils_1.isValidObjectId)("1234567890ab")).toBe(false);
-        (0, bun_test_1.expect)((0, utils_1.isValidObjectId)("microsoft123")).toBe(false);
-        (0, bun_test_1.expect)((0, utils_1.isValidObjectId)("62c44da0003d9f8ee8cc925x")).toBe(false);
+    (0, bun_test_1.describe)("isValidObjectId", function () {
+        (0, bun_test_1.it)("checks valid ObjectIds", function () {
+            (0, bun_test_1.expect)((0, utils_1.isValidObjectId)("62c44da0003d9f8ee8cc925c")).toBe(true);
+            (0, bun_test_1.expect)((0, utils_1.isValidObjectId)("620000000000000000000000")).toBe(true);
+            // Mongoose's builtin "ObjectId.isValid" will falsely say this is an ObjectId.
+            (0, bun_test_1.expect)((0, utils_1.isValidObjectId)("1234567890ab")).toBe(false);
+            (0, bun_test_1.expect)((0, utils_1.isValidObjectId)("microsoft123")).toBe(false);
+            (0, bun_test_1.expect)((0, utils_1.isValidObjectId)("62c44da0003d9f8ee8cc925x")).toBe(false);
+        });
+    });
+    (0, bun_test_1.describe)("checkModelsStrict", function () {
+        (0, bun_test_1.it)("throws error when toObject.virtuals is not true", function () {
+            // Create a schema without toObject.virtuals
+            var testSchema = new mongoose_1.default.Schema({ name: String });
+            testSchema.set("strict", "throw");
+            // Not setting toObject.virtuals
+            if (mongoose_1.default.models.ToObjectTestModel) {
+                delete mongoose_1.default.models.ToObjectTestModel;
+            }
+            mongoose_1.default.model("ToObjectTestModel", testSchema);
+            try {
+                // This should throw because ToObjectTestModel doesn't have toObject.virtuals
+                (0, bun_test_1.expect)(function () { return (0, utils_1.checkModelsStrict)(); }).toThrow("toObject.virtuals not set to true");
+            }
+            finally {
+                delete mongoose_1.default.models.ToObjectTestModel;
+            }
+        });
+        (0, bun_test_1.it)("throws error when toJSON.virtuals is not true", function () {
+            // Create a schema with toObject.virtuals but without toJSON.virtuals
+            var testSchema = new mongoose_1.default.Schema({ name: String });
+            testSchema.set("toObject", { virtuals: true });
+            testSchema.set("strict", "throw");
+            // Not setting toJSON.virtuals
+            if (mongoose_1.default.models.ToJsonTestModel) {
+                delete mongoose_1.default.models.ToJsonTestModel;
+            }
+            mongoose_1.default.model("ToJsonTestModel", testSchema);
+            // Use spyOn to intercept modelNames and return only our test model
+            var spy = (0, bun_test_1.spyOn)(mongoose_1.default, "modelNames").mockReturnValue(["ToJsonTestModel"]);
+            try {
+                (0, bun_test_1.expect)(function () { return (0, utils_1.checkModelsStrict)(); }).toThrow("toJSON.virtuals not set to true");
+            }
+            finally {
+                spy.mockRestore();
+                delete mongoose_1.default.models.ToJsonTestModel;
+            }
+        });
+        (0, bun_test_1.it)("throws error when strict mode is not set to throw", function () {
+            // Create a schema with virtuals but without strict mode
+            var testSchema = new mongoose_1.default.Schema({ name: String });
+            testSchema.set("toObject", { virtuals: true });
+            testSchema.set("toJSON", { virtuals: true });
+            // Not setting strict to "throw"
+            if (mongoose_1.default.models.StrictTestModel) {
+                delete mongoose_1.default.models.StrictTestModel;
+            }
+            mongoose_1.default.model("StrictTestModel", testSchema);
+            var spy = (0, bun_test_1.spyOn)(mongoose_1.default, "modelNames").mockReturnValue(["StrictTestModel"]);
+            try {
+                (0, bun_test_1.expect)(function () { return (0, utils_1.checkModelsStrict)(); }).toThrow("is not set to strict mode");
+            }
+            finally {
+                spy.mockRestore();
+                delete mongoose_1.default.models.StrictTestModel;
+            }
+        });
+        (0, bun_test_1.it)("passes when all checks pass", function () {
+            // Create a properly configured schema
+            var testSchema = new mongoose_1.default.Schema({ name: String });
+            testSchema.set("toObject", { virtuals: true });
+            testSchema.set("toJSON", { virtuals: true });
+            testSchema.set("strict", "throw");
+            if (mongoose_1.default.models.GoodTestModel) {
+                delete mongoose_1.default.models.GoodTestModel;
+            }
+            mongoose_1.default.model("GoodTestModel", testSchema);
+            var spy = (0, bun_test_1.spyOn)(mongoose_1.default, "modelNames").mockReturnValue(["GoodTestModel"]);
+            try {
+                (0, bun_test_1.expect)(function () { return (0, utils_1.checkModelsStrict)(); }).not.toThrow();
+            }
+            finally {
+                spy.mockRestore();
+                delete mongoose_1.default.models.GoodTestModel;
+            }
+        });
+        (0, bun_test_1.it)("skips strict mode check for ignored models", function () {
+            // Create a properly configured model
+            var goodSchema = new mongoose_1.default.Schema({ name: String });
+            goodSchema.set("toObject", { virtuals: true });
+            goodSchema.set("toJSON", { virtuals: true });
+            goodSchema.set("strict", "throw");
+            if (mongoose_1.default.models.GoodModel) {
+                delete mongoose_1.default.models.GoodModel;
+            }
+            mongoose_1.default.model("GoodModel", goodSchema);
+            // Create a model without strict mode that we'll ignore
+            var badSchema = new mongoose_1.default.Schema({ name: String });
+            badSchema.set("toObject", { virtuals: true });
+            badSchema.set("toJSON", { virtuals: true });
+            // Not setting strict - should fail unless ignored
+            if (mongoose_1.default.models.IgnoredModel) {
+                delete mongoose_1.default.models.IgnoredModel;
+            }
+            mongoose_1.default.model("IgnoredModel", badSchema);
+            var spy = (0, bun_test_1.spyOn)(mongoose_1.default, "modelNames").mockReturnValue(["GoodModel", "IgnoredModel"]);
+            try {
+                // Without ignoring, should throw for IgnoredModel
+                (0, bun_test_1.expect)(function () { return (0, utils_1.checkModelsStrict)(); }).toThrow("is not set to strict mode");
+                // With ignoring IgnoredModel, should pass
+                (0, bun_test_1.expect)(function () { return (0, utils_1.checkModelsStrict)(["IgnoredModel"]); }).not.toThrow();
+            }
+            finally {
+                spy.mockRestore();
+                delete mongoose_1.default.models.GoodModel;
+                delete mongoose_1.default.models.IgnoredModel;
+            }
+        });
+        (0, bun_test_1.it)("handles multiple models and validates all", function () {
+            // Create three properly configured models
+            var schema1 = new mongoose_1.default.Schema({ name: String });
+            schema1.set("toObject", { virtuals: true });
+            schema1.set("toJSON", { virtuals: true });
+            schema1.set("strict", "throw");
+            var schema2 = new mongoose_1.default.Schema({ value: Number });
+            schema2.set("toObject", { virtuals: true });
+            schema2.set("toJSON", { virtuals: true });
+            schema2.set("strict", "throw");
+            var schema3 = new mongoose_1.default.Schema({ active: Boolean });
+            schema3.set("toObject", { virtuals: true });
+            schema3.set("toJSON", { virtuals: true });
+            schema3.set("strict", "throw");
+            if (mongoose_1.default.models.MultiModel1)
+                delete mongoose_1.default.models.MultiModel1;
+            if (mongoose_1.default.models.MultiModel2)
+                delete mongoose_1.default.models.MultiModel2;
+            if (mongoose_1.default.models.MultiModel3)
+                delete mongoose_1.default.models.MultiModel3;
+            mongoose_1.default.model("MultiModel1", schema1);
+            mongoose_1.default.model("MultiModel2", schema2);
+            mongoose_1.default.model("MultiModel3", schema3);
+            var spy = (0, bun_test_1.spyOn)(mongoose_1.default, "modelNames").mockReturnValue([
+                "MultiModel1",
+                "MultiModel2",
+                "MultiModel3",
+            ]);
+            try {
+                (0, bun_test_1.expect)(function () { return (0, utils_1.checkModelsStrict)(); }).not.toThrow();
+            }
+            finally {
+                spy.mockRestore();
+                delete mongoose_1.default.models.MultiModel1;
+                delete mongoose_1.default.models.MultiModel2;
+                delete mongoose_1.default.models.MultiModel3;
+            }
+        });
+        (0, bun_test_1.it)("handles empty model list", function () {
+            var spy = (0, bun_test_1.spyOn)(mongoose_1.default, "modelNames").mockReturnValue([]);
+            try {
+                (0, bun_test_1.expect)(function () { return (0, utils_1.checkModelsStrict)(); }).not.toThrow();
+            }
+            finally {
+                spy.mockRestore();
+            }
+        });
+    });
+    (0, bun_test_1.describe)("timeout", function () {
+        (0, bun_test_1.it)("resolves after specified time", function () { return __awaiter(void 0, void 0, void 0, function () {
+            var start, elapsed;
+            return __generator(this, function (_a) {
+                switch (_a.label) {
+                    case 0:
+                        start = Date.now();
+                        return [4 /*yield*/, (0, utils_1.timeout)(50)];
+                    case 1:
+                        _a.sent();
+                        elapsed = Date.now() - start;
+                        (0, bun_test_1.expect)(elapsed).toBeGreaterThanOrEqual(40);
+                        return [2 /*return*/];
+                }
+            });
+        }); });
+    });
+    (0, bun_test_1.describe)("isValidObjectId additional cases", function () {
+        (0, bun_test_1.it)("returns true for valid ObjectId strings", function () {
+            (0, bun_test_1.expect)((0, utils_1.isValidObjectId)("507f1f77bcf86cd799439011")).toBe(true);
+        });
+        (0, bun_test_1.it)("returns false for invalid ObjectId strings", function () {
+            (0, bun_test_1.expect)((0, utils_1.isValidObjectId)("invalid-id")).toBe(false);
+            (0, bun_test_1.expect)((0, utils_1.isValidObjectId)("12345")).toBe(false);
+            (0, bun_test_1.expect)((0, utils_1.isValidObjectId)("")).toBe(false);
+        });
+        (0, bun_test_1.it)("returns false for 12-character strings that are not valid ObjectIds", function () {
+            (0, bun_test_1.expect)((0, utils_1.isValidObjectId)("123456789012")).toBe(false);
+        });
     });
 });

package/package.json

@@ -64,7 +64,7 @@
   "main": "dist/index.js",
   "name": "@terreno/api",
   "peerDependencies": {
-    "mongoose": "^9.0.0"
+    "mongoose": "^8.0.0"
   },
   "repository": {
     "type": "git",
@@ -81,8 +81,9 @@
     "lint:fix": "biome check --write ./src",
     "lint:unsafefix": "biome check --fix --unsafe ./src",
     "test": "bun test --preload ./src/tests/bunSetup.ts",
+    "test:ci": "bun test --preload ./src/tests/bunSetup.ts",
     "updateSnapshot": "bun test --update-snapshots"
   },
   "types": "dist/index.d.ts",
-  "version": "0.0.11"
+  "version": "0.0.13"
 }