@terreno/api 0.0.17 → 0.1.0

package/dist/api.test.js

@@ -728,6 +728,7 @@ var transformers_1 = require("./transformers");
     (0, bun_test_1.describe)("transformer errors", function () {
         var admin;
         var spinach;
+        var agent;
         (0, bun_test_1.beforeEach)(function () { return __awaiter(void 0, void 0, void 0, function () {
             var _a;
             return __generator(this, function (_b) {
@@ -832,6 +833,41 @@ var transformers_1 = require("./transformers");
                 }
             });
         }); });
+        (0, bun_test_1.it)("preDelete hook throwing APIError is re-thrown", function () { return __awaiter(void 0, void 0, void 0, function () {
+            var res;
+            return __generator(this, function (_a) {
+                switch (_a.label) {
+                    case 0:
+                        app.use("/food", (0, api_1.modelRouter)(tests_1.FoodModel, {
+                            allowAnonymous: true,
+                            permissions: {
+                                create: [permissions_1.Permissions.IsAny],
+                                delete: [permissions_1.Permissions.IsAny],
+                                list: [permissions_1.Permissions.IsAny],
+                                read: [permissions_1.Permissions.IsAny],
+                                update: [permissions_1.Permissions.IsAny],
+                            },
+                            preDelete: function () {
+                                throw new errors_1.APIError({
+                                    disableExternalErrorTracking: true,
+                                    status: 400,
+                                    title: "Custom preDelete APIError",
+                                });
+                            },
+                        }));
+                        server = (0, supertest_1.default)(app);
+                        return [4 /*yield*/, (0, tests_1.authAsUser)(app, "notAdmin")];
+                    case 1:
+                        agent = _a.sent();
+                        return [4 /*yield*/, agent.delete("/food/".concat(spinach._id)).expect(400)];
+                    case 2:
+                        res = _a.sent();
+                        (0, bun_test_1.expect)(res.body.title).toBe("Custom preDelete APIError");
+                        (0, bun_test_1.expect)(res.body.disableExternalErrorTracking).toBe(true);
+                        return [2 /*return*/];
+                }
+            });
+        }); });
     });
     (0, bun_test_1.describe)("addPopulateToQuery", function () {
         (0, bun_test_1.it)("returns query unchanged with no populate paths", function () { return __awaiter(void 0, void 0, void 0, function () {
@@ -1109,8 +1145,12 @@ var transformers_1 = require("./transformers");
                     case 1:
                         mongoose = _a.sent();
                         softDeleteSchema = new mongoose.Schema({
-                            deleted: { default: false, type: Boolean },
-                            name: String,
+                            deleted: {
+                                default: false,
+                                description: "Whether this item has been soft deleted",
+                                type: Boolean,
+                            },
+                            name: { description: "The name of the item", type: String },
                         });
                         try {
                             SoftDeleteModel = mongoose.model("SoftDeleteTest");
@@ -1192,10 +1232,8 @@ var transformers_1 = require("./transformers");
             });
         }); });
     });
-    (0, bun_test_1.describe)("transformer errors", function () {
+    (0, bun_test_1.describe)("special query params", function () {
         var admin;
-        var spinach;
-        var agent;
         (0, bun_test_1.beforeEach)(function () { return __awaiter(void 0, void 0, void 0, function () {
             var _a;
             return __generator(this, function (_b) {
@@ -1209,12 +1247,9 @@ var transformers_1 = require("./transformers");
                                 hidden: false,
                                 name: "Spinach",
                                 ownerId: admin._id,
-                                source: {
-                                    name: "Brand",
-                                },
                             })];
                     case 2:
-                        spinach = _b.sent();
+                        _b.sent();
                         app = (0, tests_1.getBaseServer)();
                         (0, auth_1.setupAuth)(app, tests_1.UserModel);
                         (0, auth_1.addAuthRoutes)(app, tests_1.UserModel);
@@ -1222,7 +1257,7 @@ var transformers_1 = require("./transformers");
                 }
             });
         }); });
-        (0, bun_test_1.it)("transform error in create is handled", function () { return __awaiter(void 0, void 0, void 0, function () {
+        (0, bun_test_1.it)("period query param is stripped from query", function () { return __awaiter(void 0, void 0, void 0, function () {
             var res;
             return __generator(this, function (_a) {
                 switch (_a.label) {
@@ -1236,25 +1271,41 @@ var transformers_1 = require("./transformers");
                                 read: [permissions_1.Permissions.IsAny],
                                 update: [permissions_1.Permissions.IsAny],
                             },
-                            transformer: (0, transformers_1.AdminOwnerTransformer)({
-                                // Only allow 'name' to be written, so 'calories' will throw
-                                anonWriteFields: ["name"],
-                            }),
+                            queryFields: ["name", "period"],
+                            queryFilter: function (_user, query) {
+                                // Simulate a queryFilter that accepts and processes period
+                                if (query === null || query === void 0 ? void 0 : query.period) {
+                                    // Period is processed but shouldn't be passed to mongo
+                                    return query;
+                                }
+                                return query !== null && query !== void 0 ? query : {};
+                            },
                         }));
                         server = (0, supertest_1.default)(app);
-                        return [4 /*yield*/, server.post("/food").send({ calories: 15, name: "Broccoli" }).expect(400)];
+                        return [4 /*yield*/, server.get("/food?period=weekly").expect(200)];
                     case 1:
                         res = _a.sent();
-                        (0, bun_test_1.expect)(res.body.title).toContain("cannot write fields");
+                        (0, bun_test_1.expect)(res.body.data).toBeDefined();
                         return [2 /*return*/];
                 }
             });
         }); });
-        (0, bun_test_1.it)("transform error in patch is handled", function () { return __awaiter(void 0, void 0, void 0, function () {
+        (0, bun_test_1.it)("query with false value", function () { return __awaiter(void 0, void 0, void 0, function () {
             var res;
             return __generator(this, function (_a) {
                 switch (_a.label) {
-                    case 0:
+                    case 0: 
+                    // Create a food that is hidden
+                    return [4 /*yield*/, tests_1.FoodModel.create({
+                            calories: 50,
+                            created: new Date("2021-12-04T00:00:20.000Z"),
+                            hidden: true,
+                            name: "HiddenFood",
+                            ownerId: admin._id,
+                        })];
+                    case 1:
+                        // Create a food that is hidden
+                        _a.sent();
                         app.use("/food", (0, api_1.modelRouter)(tests_1.FoodModel, {
                             allowAnonymous: true,
                             permissions: {
@@ -1264,28 +1315,25 @@ var transformers_1 = require("./transformers");
                                 read: [permissions_1.Permissions.IsAny],
                                 update: [permissions_1.Permissions.IsAny],
                             },
-                            transformer: (0, transformers_1.AdminOwnerTransformer)({
-                                // Only allow 'name' to be written, so 'calories' will throw
-                                anonWriteFields: ["name"],
-                            }),
+                            queryFields: ["name", "hidden"],
                         }));
                         server = (0, supertest_1.default)(app);
-                        return [4 /*yield*/, server.patch("/food/".concat(spinach._id)).send({ calories: 100 }).expect(403)];
-                    case 1:
+                        return [4 /*yield*/, server.get("/food?hidden=false").expect(200)];
+                    case 2:
                         res = _a.sent();
-                        (0, bun_test_1.expect)(res.body.title).toContain("cannot write fields");
+                        (0, bun_test_1.expect)(res.body.data.every(function (f) { return f.hidden === false; })).toBe(true);
                         return [2 /*return*/];
                 }
             });
         }); });
-        (0, bun_test_1.it)("model.create validation error is handled", function () { return __awaiter(void 0, void 0, void 0, function () {
-            var RequiredModel, res;
+        (0, bun_test_1.it)("$search query triggers special handling code path", function () { return __awaiter(void 0, void 0, void 0, function () {
+            var res;
             return __generator(this, function (_a) {
                 switch (_a.label) {
-                    case 0: return [4 /*yield*/, Promise.resolve().then(function () { return __importStar(require("./tests")); })];
-                    case 1:
-                        RequiredModel = (_a.sent()).RequiredModel;
-                        app.use("/required", (0, api_1.modelRouter)(RequiredModel, {
+                    case 0:
+                        // The $search code path just accesses the collection but doesn't do anything with it
+                        // This test verifies the code path is exercised
+                        app.use("/food", (0, api_1.modelRouter)(tests_1.FoodModel, {
                             allowAnonymous: true,
                             permissions: {
                                 create: [permissions_1.Permissions.IsAny],
@@ -1294,17 +1342,21 @@ var transformers_1 = require("./transformers");
                                 read: [permissions_1.Permissions.IsAny],
                                 update: [permissions_1.Permissions.IsAny],
                             },
+                            // Need to include $search in queryFields for it to pass validation
+                            queryFields: ["name", "$search"],
                         }));
                         server = (0, supertest_1.default)(app);
-                        return [4 /*yield*/, server.post("/required").send({ about: "test" }).expect(400)];
-                    case 2:
+                        return [4 /*yield*/, server.get("/food?$search=test")];
+                    case 1:
                         res = _a.sent();
-                        (0, bun_test_1.expect)(res.body.title).toContain("Required");
+                        // May return 500 because $search is passed to Mongo which doesn't support it without Atlas
+                        // The important thing is we've exercised the code path
+                        (0, bun_test_1.expect)(res.status === 200 || res.status === 500).toBe(true);
                         return [2 /*return*/];
                 }
             });
         }); });
-        (0, bun_test_1.it)("preDelete hook throwing APIError is re-thrown", function () { return __awaiter(void 0, void 0, void 0, function () {
+        (0, bun_test_1.it)("$autocomplete query triggers special handling code path", function () { return __awaiter(void 0, void 0, void 0, function () {
             var res;
             return __generator(this, function (_a) {
                 switch (_a.label) {
@@ -1318,30 +1370,22 @@ var transformers_1 = require("./transformers");
                                 read: [permissions_1.Permissions.IsAny],
                                 update: [permissions_1.Permissions.IsAny],
                             },
-                            preDelete: function () {
-                                throw new errors_1.APIError({
-                                    disableExternalErrorTracking: true,
-                                    status: 400,
-                                    title: "Custom preDelete APIError",
-                                });
-                            },
+                            queryFields: ["name", "$autocomplete"],
                         }));
                         server = (0, supertest_1.default)(app);
-                        return [4 /*yield*/, (0, tests_1.authAsUser)(app, "notAdmin")];
+                        return [4 /*yield*/, server.get("/food?$autocomplete=test")];
                     case 1:
-                        agent = _a.sent();
-                        return [4 /*yield*/, agent.delete("/food/".concat(spinach._id)).expect(400)];
-                    case 2:
                         res = _a.sent();
-                        (0, bun_test_1.expect)(res.body.title).toBe("Custom preDelete APIError");
-                        (0, bun_test_1.expect)(res.body.disableExternalErrorTracking).toBe(true);
+                        (0, bun_test_1.expect)(res.status === 200 || res.status === 500).toBe(true);
                         return [2 /*return*/];
                 }
             });
         }); });
     });
-    (0, bun_test_1.describe)("special query params", function () {
+    (0, bun_test_1.describe)("array operation with undefined preUpdate return", function () {
         var admin;
+        var apple;
+        var agent;
         (0, bun_test_1.beforeEach)(function () { return __awaiter(void 0, void 0, void 0, function () {
             var _a;
             return __generator(this, function (_b) {
@@ -1350,14 +1394,19 @@ var transformers_1 = require("./transformers");
                     case 1:
                         _a = __read.apply(void 0, [_b.sent(), 1]), admin = _a[0];
                         return [4 /*yield*/, tests_1.FoodModel.create({
-                                calories: 1,
-                                created: new Date("2021-12-03T00:00:20.000Z"),
+                                calories: 100,
+                                categories: [
+                                    { name: "Fruit", show: true },
+                                    { name: "Popular", show: false },
+                                ],
+                                created: new Date("2021-12-03T00:00:30.000Z"),
                                 hidden: false,
-                                name: "Spinach",
+                                name: "Apple",
                                 ownerId: admin._id,
+                                tags: ["healthy", "cheap"],
                             })];
                     case 2:
-                        _b.sent();
+                        apple = _b.sent();
                         app = (0, tests_1.getBaseServer)();
                         (0, auth_1.setupAuth)(app, tests_1.UserModel);
                         (0, auth_1.addAuthRoutes)(app, tests_1.UserModel);
@@ -1365,7 +1414,7 @@ var transformers_1 = require("./transformers");
                 }
             });
         }); });
-        (0, bun_test_1.it)("period query param is stripped from query", function () { return __awaiter(void 0, void 0, void 0, function () {
+        (0, bun_test_1.it)("array operation preUpdate returning undefined for array POST throws error", function () { return __awaiter(void 0, void 0, void 0, function () {
             var res;
             return __generator(this, function (_a) {
                 switch (_a.label) {
@@ -1373,98 +1422,89 @@ var transformers_1 = require("./transformers");
                         app.use("/food", (0, api_1.modelRouter)(tests_1.FoodModel, {
                             allowAnonymous: true,
                             permissions: {
-                                create: [permissions_1.Permissions.IsAny],
-                                delete: [permissions_1.Permissions.IsAny],
-                                list: [permissions_1.Permissions.IsAny],
-                                read: [permissions_1.Permissions.IsAny],
-                                update: [permissions_1.Permissions.IsAny],
-                            },
-                            queryFields: ["name", "period"],
-                            queryFilter: function (_user, query) {
-                                // Simulate a queryFilter that accepts and processes period
-                                if (query === null || query === void 0 ? void 0 : query.period) {
-                                    // Period is processed but shouldn't be passed to mongo
-                                    return query;
-                                }
-                                return query !== null && query !== void 0 ? query : {};
+                                create: [permissions_1.Permissions.IsAdmin],
+                                delete: [permissions_1.Permissions.IsAdmin],
+                                list: [permissions_1.Permissions.IsAdmin],
+                                read: [permissions_1.Permissions.IsAdmin],
+                                update: [permissions_1.Permissions.IsAdmin],
                             },
+                            preUpdate: function () { return undefined; },
                         }));
                         server = (0, supertest_1.default)(app);
-                        return [4 /*yield*/, server.get("/food?period=weekly").expect(200)];
+                        return [4 /*yield*/, (0, tests_1.authAsUser)(app, "admin")];
                     case 1:
+                        agent = _a.sent();
+                        return [4 /*yield*/, agent.post("/food/".concat(apple._id, "/tags")).send({ tags: "organic" }).expect(403)];
+                    case 2:
                         res = _a.sent();
-                        (0, bun_test_1.expect)(res.body.data).toBeDefined();
+                        (0, bun_test_1.expect)(res.body.title).toBe("Update not allowed");
+                        (0, bun_test_1.expect)(res.body.detail).toBe("A body must be returned from preUpdate");
                         return [2 /*return*/];
                 }
             });
         }); });
-        (0, bun_test_1.it)("query with false value", function () { return __awaiter(void 0, void 0, void 0, function () {
+        (0, bun_test_1.it)("array operation preUpdate returning null for array PATCH throws error", function () { return __awaiter(void 0, void 0, void 0, function () {
             var res;
             return __generator(this, function (_a) {
                 switch (_a.label) {
-                    case 0: 
-                    // Create a food that is hidden
-                    return [4 /*yield*/, tests_1.FoodModel.create({
-                            calories: 50,
-                            created: new Date("2021-12-04T00:00:20.000Z"),
-                            hidden: true,
-                            name: "HiddenFood",
-                            ownerId: admin._id,
-                        })];
-                    case 1:
-                        // Create a food that is hidden
-                        _a.sent();
+                    case 0:
                         app.use("/food", (0, api_1.modelRouter)(tests_1.FoodModel, {
                             allowAnonymous: true,
                             permissions: {
-                                create: [permissions_1.Permissions.IsAny],
-                                delete: [permissions_1.Permissions.IsAny],
-                                list: [permissions_1.Permissions.IsAny],
-                                read: [permissions_1.Permissions.IsAny],
-                                update: [permissions_1.Permissions.IsAny],
+                                create: [permissions_1.Permissions.IsAdmin],
+                                delete: [permissions_1.Permissions.IsAdmin],
+                                list: [permissions_1.Permissions.IsAdmin],
+                                read: [permissions_1.Permissions.IsAdmin],
+                                update: [permissions_1.Permissions.IsAdmin],
                             },
-                            queryFields: ["name", "hidden"],
+                            preUpdate: function () { return null; },
                         }));
                         server = (0, supertest_1.default)(app);
-                        return [4 /*yield*/, server.get("/food?hidden=false").expect(200)];
+                        return [4 /*yield*/, (0, tests_1.authAsUser)(app, "admin")];
+                    case 1:
+                        agent = _a.sent();
+                        return [4 /*yield*/, agent
+                                .patch("/food/".concat(apple._id, "/tags/healthy"))
+                                .send({ tags: "unhealthy" })
+                                .expect(403)];
                     case 2:
                         res = _a.sent();
-                        (0, bun_test_1.expect)(res.body.data.every(function (f) { return f.hidden === false; })).toBe(true);
+                        (0, bun_test_1.expect)(res.body.title).toBe("Update not allowed");
                         return [2 /*return*/];
                 }
             });
         }); });
-        (0, bun_test_1.it)("$search query triggers special handling code path", function () { return __awaiter(void 0, void 0, void 0, function () {
+        (0, bun_test_1.it)("array operation preUpdate error for array DELETE is handled", function () { return __awaiter(void 0, void 0, void 0, function () {
             var res;
             return __generator(this, function (_a) {
                 switch (_a.label) {
                     case 0:
-                        // The $search code path just accesses the collection but doesn't do anything with it
-                        // This test verifies the code path is exercised
                         app.use("/food", (0, api_1.modelRouter)(tests_1.FoodModel, {
                             allowAnonymous: true,
                             permissions: {
-                                create: [permissions_1.Permissions.IsAny],
-                                delete: [permissions_1.Permissions.IsAny],
-                                list: [permissions_1.Permissions.IsAny],
-                                read: [permissions_1.Permissions.IsAny],
-                                update: [permissions_1.Permissions.IsAny],
+                                create: [permissions_1.Permissions.IsAdmin],
+                                delete: [permissions_1.Permissions.IsAdmin],
+                                list: [permissions_1.Permissions.IsAdmin],
+                                read: [permissions_1.Permissions.IsAdmin],
+                                update: [permissions_1.Permissions.IsAdmin],
+                            },
+                            preUpdate: function () {
+                                throw new Error("preUpdate error during delete");
                             },
-                            // Need to include $search in queryFields for it to pass validation
-                            queryFields: ["name", "$search"],
                         }));
                         server = (0, supertest_1.default)(app);
-                        return [4 /*yield*/, server.get("/food?$search=test")];
+                        return [4 /*yield*/, (0, tests_1.authAsUser)(app, "admin")];
                     case 1:
+                        agent = _a.sent();
+                        return [4 /*yield*/, agent.delete("/food/".concat(apple._id, "/tags/healthy")).expect(400)];
+                    case 2:
                         res = _a.sent();
-                        // May return 500 because $search is passed to Mongo which doesn't support it without Atlas
-                        // The important thing is we've exercised the code path
-                        (0, bun_test_1.expect)(res.status === 200 || res.status === 500).toBe(true);
+                        (0, bun_test_1.expect)(res.body.title).toContain("preUpdate hook error");
                         return [2 /*return*/];
                 }
             });
         }); });
-        (0, bun_test_1.it)("$autocomplete query triggers special handling code path", function () { return __awaiter(void 0, void 0, void 0, function () {
+        (0, bun_test_1.it)("array operation postUpdate error is handled", function () { return __awaiter(void 0, void 0, void 0, function () {
             var res;
             return __generator(this, function (_a) {
                 switch (_a.label) {
@@ -1472,391 +1512,57 @@ var transformers_1 = require("./transformers");
                         app.use("/food", (0, api_1.modelRouter)(tests_1.FoodModel, {
                             allowAnonymous: true,
                             permissions: {
-                                create: [permissions_1.Permissions.IsAny],
-                                delete: [permissions_1.Permissions.IsAny],
-                                list: [permissions_1.Permissions.IsAny],
-                                read: [permissions_1.Permissions.IsAny],
-                                update: [permissions_1.Permissions.IsAny],
+                                create: [permissions_1.Permissions.IsAdmin],
+                                delete: [permissions_1.Permissions.IsAdmin],
+                                list: [permissions_1.Permissions.IsAdmin],
+                                read: [permissions_1.Permissions.IsAdmin],
+                                update: [permissions_1.Permissions.IsAdmin],
                             },
-                            queryFields: ["name", "$autocomplete"],
-                        }));
-                        server = (0, supertest_1.default)(app);
-                        return [4 /*yield*/, server.get("/food?$autocomplete=test")];
-                    case 1:
-                        res = _a.sent();
-                        (0, bun_test_1.expect)(res.status === 200 || res.status === 500).toBe(true);
-                        return [2 /*return*/];
-                }
-            });
-        }); });
-    });
-    (0, bun_test_1.describe)("addPopulateToQuery", function () {
-        (0, bun_test_1.it)("returns query unchanged with no populate paths", function () { return __awaiter(void 0, void 0, void 0, function () {
-            var query, result;
-            return __generator(this, function (_a) {
-                switch (_a.label) {
-                    case 0: return [4 /*yield*/, (0, tests_1.setupDb)()];
-                    case 1:
-                        _a.sent();
-                        query = tests_1.FoodModel.find({});
-                        result = (0, api_1.addPopulateToQuery)(query, undefined);
-                        (0, bun_test_1.expect)(result).toBe(query);
-                        return [2 /*return*/];
-                }
-            });
-        }); });
-        (0, bun_test_1.it)("returns query unchanged with empty populate paths", function () { return __awaiter(void 0, void 0, void 0, function () {
-            var query, result;
-            return __generator(this, function (_a) {
-                switch (_a.label) {
-                    case 0: return [4 /*yield*/, (0, tests_1.setupDb)()];
-                    case 1:
-                        _a.sent();
-                        query = tests_1.FoodModel.find({});
-                        result = (0, api_1.addPopulateToQuery)(query, []);
-                        (0, bun_test_1.expect)(result).toBe(query);
-                        return [2 /*return*/];
-                }
-            });
-        }); });
-        (0, bun_test_1.it)("applies multiple populate paths", function () { return __awaiter(void 0, void 0, void 0, function () {
-            var query, result;
-            return __generator(this, function (_a) {
-                switch (_a.label) {
-                    case 0: return [4 /*yield*/, (0, tests_1.setupDb)()];
-                    case 1:
-                        _a.sent();
-                        query = tests_1.FoodModel.find({});
-                        result = (0, api_1.addPopulateToQuery)(query, [
-                            { fields: ["email"], path: "ownerId" },
-                            { fields: ["name"], path: "eatenBy" },
-                        ]);
-                        // The result should be a query with populate applied
-                        (0, bun_test_1.expect)(result).toBeDefined();
-                        return [2 /*return*/];
-                }
-            });
-        }); });
-    });
-    (0, bun_test_1.describe)("soft delete with isDeleted plugin", function () {
-        var admin;
-        var agent;
-        (0, bun_test_1.beforeEach)(function () { return __awaiter(void 0, void 0, void 0, function () {
-            var _a;
-            return __generator(this, function (_b) {
-                switch (_b.label) {
-                    case 0: return [4 /*yield*/, (0, tests_1.setupDb)()];
-                    case 1:
-                        _a = __read.apply(void 0, [_b.sent(), 1]), admin = _a[0];
-                        app = (0, tests_1.getBaseServer)();
-                        (0, auth_1.setupAuth)(app, tests_1.UserModel);
-                        (0, auth_1.addAuthRoutes)(app, tests_1.UserModel);
-                        return [2 /*return*/];
-                }
-            });
-        }); });
-        (0, bun_test_1.it)("soft deletes user with deleted field", function () { return __awaiter(void 0, void 0, void 0, function () {
-            var res, deletedUser;
-            return __generator(this, function (_a) {
-                switch (_a.label) {
-                    case 0:
-                        // UserModel has the isDisabledPlugin which adds a 'disabled' field,
-                        // but we need to test the 'deleted' field check.
-                        // Let's use a model that has the deleted field.
-                        app.use("/users", (0, api_1.modelRouter)(tests_1.UserModel, {
-                            allowAnonymous: true,
-                            permissions: {
-                                create: [permissions_1.Permissions.IsAny],
-                                delete: [permissions_1.Permissions.IsAny],
-                                list: [permissions_1.Permissions.IsAny],
-                                read: [permissions_1.Permissions.IsAny],
-                                update: [permissions_1.Permissions.IsAny],
+                            postUpdate: function () {
+                                throw new Error("postUpdate array failed");
                             },
                         }));
                         server = (0, supertest_1.default)(app);
-                        return [4 /*yield*/, (0, tests_1.authAsUser)(app, "notAdmin")];
+                        return [4 /*yield*/, (0, tests_1.authAsUser)(app, "admin")];
                     case 1:
                         agent = _a.sent();
-                        return [4 /*yield*/, agent.delete("/users/".concat(admin._id)).expect(204)];
+                        return [4 /*yield*/, agent.post("/food/".concat(apple._id, "/tags")).send({ tags: "organic" }).expect(400)];
                     case 2:
                         res = _a.sent();
-                        (0, bun_test_1.expect)(res.body).toEqual({});
-                        return [4 /*yield*/, tests_1.UserModel.findById(admin._id)];
-                    case 3:
-                        deletedUser = _a.sent();
-                        (0, bun_test_1.expect)(deletedUser).toBeNull();
-                        return [2 /*return*/];
-                }
-            });
-        }); });
-    });
-    (0, bun_test_1.describe)("populate in create", function () {
-        var admin;
-        (0, bun_test_1.beforeEach)(function () { return __awaiter(void 0, void 0, void 0, function () {
-            var _a;
-            return __generator(this, function (_b) {
-                switch (_b.label) {
-                    case 0: return [4 /*yield*/, (0, tests_1.setupDb)()];
-                    case 1:
-                        _a = __read.apply(void 0, [_b.sent(), 1]), admin = _a[0];
-                        return [4 /*yield*/, tests_1.FoodModel.create({
-                                calories: 1,
-                                created: new Date("2021-12-03T00:00:20.000Z"),
-                                hidden: false,
-                                name: "Spinach",
-                                ownerId: admin._id,
-                            })];
-                    case 2:
-                        _b.sent();
-                        app = (0, tests_1.getBaseServer)();
-                        (0, auth_1.setupAuth)(app, tests_1.UserModel);
-                        (0, auth_1.addAuthRoutes)(app, tests_1.UserModel);
-                        return [2 /*return*/];
-                }
-            });
-        }); });
-        (0, bun_test_1.it)("handles populate with valid path in create", function () { return __awaiter(void 0, void 0, void 0, function () {
-            var res;
-            return __generator(this, function (_a) {
-                switch (_a.label) {
-                    case 0:
-                        // Test that valid populate works in create flow
-                        app.use("/food", (0, api_1.modelRouter)(tests_1.FoodModel, {
-                            allowAnonymous: true,
-                            permissions: {
-                                create: [permissions_1.Permissions.IsAny],
-                                delete: [permissions_1.Permissions.IsAny],
-                                list: [permissions_1.Permissions.IsAny],
-                                read: [permissions_1.Permissions.IsAny],
-                                update: [permissions_1.Permissions.IsAny],
-                            },
-                            populatePaths: [{ fields: ["email"], path: "ownerId" }],
-                        }));
-                        server = (0, supertest_1.default)(app);
-                        return [4 /*yield*/, server
-                                .post("/food")
-                                .send({ calories: 15, name: "Broccoli", ownerId: admin._id })
-                                .expect(201)];
-                    case 1:
-                        res = _a.sent();
-                        (0, bun_test_1.expect)(res.body.data.name).toBe("Broccoli");
-                        // Verify populate worked - ownerId should be an object with email
-                        (0, bun_test_1.expect)(res.body.data.ownerId.email).toBe(admin.email);
-                        return [2 /*return*/];
-                }
-            });
-        }); });
-    });
-    (0, bun_test_1.describe)("save error handling", function () {
-        var admin;
-        var spinach;
-        (0, bun_test_1.beforeEach)(function () { return __awaiter(void 0, void 0, void 0, function () {
-            var _a;
-            return __generator(this, function (_b) {
-                switch (_b.label) {
-                    case 0: return [4 /*yield*/, (0, tests_1.setupDb)()];
-                    case 1:
-                        _a = __read.apply(void 0, [_b.sent(), 1]), admin = _a[0];
-                        return [4 /*yield*/, tests_1.FoodModel.create({
-                                calories: 1,
-                                created: new Date("2021-12-03T00:00:20.000Z"),
-                                hidden: false,
-                                name: "Spinach",
-                                ownerId: admin._id,
-                                source: {
-                                    name: "Brand",
-                                },
-                            })];
-                    case 2:
-                        spinach = _b.sent();
-                        app = (0, tests_1.getBaseServer)();
-                        (0, auth_1.setupAuth)(app, tests_1.UserModel);
-                        (0, auth_1.addAuthRoutes)(app, tests_1.UserModel);
-                        return [2 /*return*/];
-                }
-            });
-        }); });
-        (0, bun_test_1.it)("handles patch save error with validation failure", function () { return __awaiter(void 0, void 0, void 0, function () {
-            var res;
-            return __generator(this, function (_a) {
-                switch (_a.label) {
-                    case 0:
-                        // The FoodModel has strict: "throw" which will cause validation errors for unknown fields
-                        app.use("/food", (0, api_1.modelRouter)(tests_1.FoodModel, {
-                            allowAnonymous: true,
-                            permissions: {
-                                create: [permissions_1.Permissions.IsAny],
-                                delete: [permissions_1.Permissions.IsAny],
-                                list: [permissions_1.Permissions.IsAny],
-                                read: [permissions_1.Permissions.IsAny],
-                                update: [permissions_1.Permissions.IsAny],
-                            },
-                        }));
-                        server = (0, supertest_1.default)(app);
-                        return [4 /*yield*/, server
-                                .patch("/food/".concat(spinach._id))
-                                .send({ invalidField: "value" })
-                                .expect(400)];
-                    case 1:
-                        res = _a.sent();
-                        (0, bun_test_1.expect)(res.body.title).toContain("preUpdate hook save error");
+                        (0, bun_test_1.expect)(res.body.title).toContain("PATCH Post Update error");
                         return [2 /*return*/];
                 }
             });
         }); });
-    });
-    (0, bun_test_1.describe)("body undefined after transform without preCreate", function () {
-        (0, bun_test_1.beforeEach)(function () { return __awaiter(void 0, void 0, void 0, function () {
-            return __generator(this, function (_a) {
-                switch (_a.label) {
-                    case 0: return [4 /*yield*/, (0, tests_1.setupDb)()];
-                    case 1:
-                        _a.sent();
-                        app = (0, tests_1.getBaseServer)();
-                        (0, auth_1.setupAuth)(app, tests_1.UserModel);
-                        (0, auth_1.addAuthRoutes)(app, tests_1.UserModel);
-                        return [2 /*return*/];
-                }
-            });
-        }); });
-        (0, bun_test_1.it)("handles undefined body after transform when no preCreate", function () { return __awaiter(void 0, void 0, void 0, function () {
+        (0, bun_test_1.it)("array operation denied without update permission", function () { return __awaiter(void 0, void 0, void 0, function () {
             var res;
             return __generator(this, function (_a) {
                 switch (_a.label) {
                     case 0:
-                        // Create a transformer that returns undefined
                         app.use("/food", (0, api_1.modelRouter)(tests_1.FoodModel, {
                             allowAnonymous: true,
                             permissions: {
-                                create: [permissions_1.Permissions.IsAny],
-                                delete: [permissions_1.Permissions.IsAny],
-                                list: [permissions_1.Permissions.IsAny],
-                                read: [permissions_1.Permissions.IsAny],
-                                update: [permissions_1.Permissions.IsAny],
-                            },
-                            transformer: {
-                                transform: function () { return undefined; },
-                            },
-                        }));
-                        server = (0, supertest_1.default)(app);
-                        return [4 /*yield*/, server.post("/food").send({ calories: 15, name: "Broccoli" }).expect(400)];
-                    case 1:
-                        res = _a.sent();
-                        (0, bun_test_1.expect)(res.body.title).toBe("Invalid request body");
-                        (0, bun_test_1.expect)(res.body.detail).toBe("Body is undefined");
-                        return [2 /*return*/];
-                }
-            });
-        }); });
-    });
-    (0, bun_test_1.describe)("soft delete with deleted field", function () {
-        var agent;
-        (0, bun_test_1.beforeEach)(function () { return __awaiter(void 0, void 0, void 0, function () {
-            return __generator(this, function (_a) {
-                switch (_a.label) {
-                    case 0: return [4 /*yield*/, (0, tests_1.setupDb)()];
-                    case 1:
-                        _a.sent();
-                        app = (0, tests_1.getBaseServer)();
-                        (0, auth_1.setupAuth)(app, tests_1.UserModel);
-                        (0, auth_1.addAuthRoutes)(app, tests_1.UserModel);
-                        return [2 /*return*/];
-                }
-            });
-        }); });
-        (0, bun_test_1.it)("soft deletes document with deleted field using isDeletedPlugin", function () { return __awaiter(void 0, void 0, void 0, function () {
-            var mongoose, softDeleteSchema, SoftDeleteModel, testDoc, softDeleted;
-            return __generator(this, function (_a) {
-                switch (_a.label) {
-                    case 0: return [4 /*yield*/, Promise.resolve().then(function () { return __importStar(require("mongoose")); })];
-                    case 1:
-                        mongoose = _a.sent();
-                        softDeleteSchema = new mongoose.Schema({
-                            deleted: { default: false, type: Boolean },
-                            name: String,
-                        });
-                        try {
-                            SoftDeleteModel = mongoose.model("SoftDeleteTest");
-                        }
-                        catch (_b) {
-                            SoftDeleteModel = mongoose.model("SoftDeleteTest", softDeleteSchema);
-                        }
-                        // Clean up any existing documents
-                        return [4 /*yield*/, SoftDeleteModel.deleteMany({})];
-                    case 2:
-                        // Clean up any existing documents
-                        _a.sent();
-                        return [4 /*yield*/, SoftDeleteModel.create({ name: "TestItem" })];
-                    case 3:
-                        testDoc = _a.sent();
-                        app.use("/softdelete", (0, api_1.modelRouter)(SoftDeleteModel, {
-                            allowAnonymous: true,
-                            permissions: {
-                                create: [permissions_1.Permissions.IsAny],
-                                delete: [permissions_1.Permissions.IsAny],
+                                create: [permissions_1.Permissions.IsAdmin],
+                                delete: [permissions_1.Permissions.IsAdmin],
                                 list: [permissions_1.Permissions.IsAny],
                                 read: [permissions_1.Permissions.IsAny],
-                                update: [permissions_1.Permissions.IsAny],
+                                update: [permissions_1.Permissions.IsAdmin],
                             },
                         }));
                         server = (0, supertest_1.default)(app);
                         return [4 /*yield*/, (0, tests_1.authAsUser)(app, "notAdmin")];
-                    case 4:
-                        agent = _a.sent();
-                        // Delete should soft delete (set deleted: true) instead of hard delete
-                        return [4 /*yield*/, agent.delete("/softdelete/".concat(testDoc._id)).expect(204)];
-                    case 5:
-                        // Delete should soft delete (set deleted: true) instead of hard delete
-                        _a.sent();
-                        return [4 /*yield*/, SoftDeleteModel.findById(testDoc._id)];
-                    case 6:
-                        softDeleted = _a.sent();
-                        (0, bun_test_1.expect)(softDeleted).not.toBeNull();
-                        (0, bun_test_1.expect)(softDeleted === null || softDeleted === void 0 ? void 0 : softDeleted.deleted).toBe(true);
-                        // Clean up
-                        return [4 /*yield*/, SoftDeleteModel.deleteMany({})];
-                    case 7:
-                        // Clean up
-                        _a.sent();
-                        return [2 /*return*/];
-                }
-            });
-        }); });
-    });
-    (0, bun_test_1.describe)("array operation with undefined preUpdate return", function () {
-        var admin;
-        var apple;
-        var agent;
-        (0, bun_test_1.beforeEach)(function () { return __awaiter(void 0, void 0, void 0, function () {
-            var _a;
-            return __generator(this, function (_b) {
-                switch (_b.label) {
-                    case 0: return [4 /*yield*/, (0, tests_1.setupDb)()];
                     case 1:
-                        _a = __read.apply(void 0, [_b.sent(), 1]), admin = _a[0];
-                        return [4 /*yield*/, tests_1.FoodModel.create({
-                                calories: 100,
-                                categories: [
-                                    { name: "Fruit", show: true },
-                                    { name: "Popular", show: false },
-                                ],
-                                created: new Date("2021-12-03T00:00:30.000Z"),
-                                hidden: false,
-                                name: "Apple",
-                                ownerId: admin._id,
-                                tags: ["healthy", "cheap"],
-                            })];
+                        agent = _a.sent();
+                        return [4 /*yield*/, agent.post("/food/".concat(apple._id, "/tags")).send({ tags: "organic" }).expect(405)];
                     case 2:
-                        apple = _b.sent();
-                        app = (0, tests_1.getBaseServer)();
-                        (0, auth_1.setupAuth)(app, tests_1.UserModel);
-                        (0, auth_1.addAuthRoutes)(app, tests_1.UserModel);
+                        res = _a.sent();
+                        (0, bun_test_1.expect)(res.body.title).toContain("Access to PATCH");
                         return [2 /*return*/];
                 }
             });
         }); });
-        (0, bun_test_1.it)("array operation preUpdate returning undefined for array POST throws error", function () { return __awaiter(void 0, void 0, void 0, function () {
-            var res;
+        (0, bun_test_1.it)("array operation on non-existent document returns 404", function () { return __awaiter(void 0, void 0, void 0, function () {
+            var fakeId, res;
             return __generator(this, function (_a) {
                 switch (_a.label) {
                     case 0:
@@ -1869,53 +1575,50 @@ var transformers_1 = require("./transformers");
                                 read: [permissions_1.Permissions.IsAdmin],
                                 update: [permissions_1.Permissions.IsAdmin],
                             },
-                            preUpdate: function () { return undefined; },
                         }));
                         server = (0, supertest_1.default)(app);
                         return [4 /*yield*/, (0, tests_1.authAsUser)(app, "admin")];
                     case 1:
                         agent = _a.sent();
-                        return [4 /*yield*/, agent.post("/food/".concat(apple._id, "/tags")).send({ tags: "organic" }).expect(403)];
+                        fakeId = "000000000000000000000000";
+                        return [4 /*yield*/, agent.post("/food/".concat(fakeId, "/tags")).send({ tags: "organic" }).expect(404)];
                     case 2:
                         res = _a.sent();
-                        (0, bun_test_1.expect)(res.body.title).toBe("Update not allowed");
-                        (0, bun_test_1.expect)(res.body.detail).toBe("A body must be returned from preUpdate");
+                        (0, bun_test_1.expect)(res.body.title).toContain("Could not find document to PATCH");
                         return [2 /*return*/];
                 }
             });
         }); });
-        (0, bun_test_1.it)("array operation preUpdate returning null for array PATCH throws error", function () { return __awaiter(void 0, void 0, void 0, function () {
+        (0, bun_test_1.it)("array operation denied when user cannot update specific doc", function () { return __awaiter(void 0, void 0, void 0, function () {
             var res;
             return __generator(this, function (_a) {
                 switch (_a.label) {
                     case 0:
+                        // Create food owned by admin, then try to update as notAdmin
                         app.use("/food", (0, api_1.modelRouter)(tests_1.FoodModel, {
                             allowAnonymous: true,
                             permissions: {
-                                create: [permissions_1.Permissions.IsAdmin],
-                                delete: [permissions_1.Permissions.IsAdmin],
-                                list: [permissions_1.Permissions.IsAdmin],
-                                read: [permissions_1.Permissions.IsAdmin],
-                                update: [permissions_1.Permissions.IsAdmin],
+                                create: [permissions_1.Permissions.IsAuthenticated],
+                                delete: [permissions_1.Permissions.IsAuthenticated],
+                                list: [permissions_1.Permissions.IsAuthenticated],
+                                read: [permissions_1.Permissions.IsAuthenticated],
+                                update: [permissions_1.Permissions.IsOwner],
                             },
-                            preUpdate: function () { return null; },
                         }));
                         server = (0, supertest_1.default)(app);
-                        return [4 /*yield*/, (0, tests_1.authAsUser)(app, "admin")];
+                        return [4 /*yield*/, (0, tests_1.authAsUser)(app, "notAdmin")];
                     case 1:
+                        // Login as notAdmin and try to update admin's food (apple)
                         agent = _a.sent();
-                        return [4 /*yield*/, agent
-                                .patch("/food/".concat(apple._id, "/tags/healthy"))
-                                .send({ tags: "unhealthy" })
-                                .expect(403)];
+                        return [4 /*yield*/, agent.post("/food/".concat(apple._id, "/tags")).send({ tags: "organic" }).expect(403)];
                     case 2:
                         res = _a.sent();
-                        (0, bun_test_1.expect)(res.body.title).toBe("Update not allowed");
+                        (0, bun_test_1.expect)(res.body.title).toContain("Patch not allowed");
                         return [2 /*return*/];
                 }
             });
         }); });
-        (0, bun_test_1.it)("array operation preUpdate error for array DELETE is handled", function () { return __awaiter(void 0, void 0, void 0, function () {
+        (0, bun_test_1.it)("array operation transform error is handled", function () { return __awaiter(void 0, void 0, void 0, function () {
             var res;
             return __generator(this, function (_a) {
                 switch (_a.label) {
@@ -1929,18 +1632,18 @@ var transformers_1 = require("./transformers");
                                 read: [permissions_1.Permissions.IsAdmin],
                                 update: [permissions_1.Permissions.IsAdmin],
                             },
-                            preUpdate: function () {
-                                throw new Error("preUpdate error during delete");
-                            },
+                            transformer: (0, transformers_1.AdminOwnerTransformer)({
+                                adminWriteFields: ["name"],
+                            }),
                         }));
                         server = (0, supertest_1.default)(app);
                         return [4 /*yield*/, (0, tests_1.authAsUser)(app, "admin")];
                     case 1:
                         agent = _a.sent();
-                        return [4 /*yield*/, agent.delete("/food/".concat(apple._id, "/tags/healthy")).expect(400)];
+                        return [4 /*yield*/, agent.post("/food/".concat(apple._id, "/tags")).send({ tags: "organic" }).expect(403)];
                     case 2:
                         res = _a.sent();
-                        (0, bun_test_1.expect)(res.body.title).toContain("preUpdate hook error");
+                        (0, bun_test_1.expect)(res.body.title).toContain("cannot write fields");
                         return [2 /*return*/];
                 }
             });
@@ -1949,7 +1652,7 @@ var transformers_1 = require("./transformers");
     (0, bun_test_1.describe)("transformer errors", function () {
         var admin;
         var spinach;
-        var _agent;
+        var agent;
         (0, bun_test_1.beforeEach)(function () { return __awaiter(void 0, void 0, void 0, function () {
             var _a;
             return __generator(this, function (_b) {
@@ -2058,6 +1761,41 @@ var transformers_1 = require("./transformers");
                 }
             });
         }); });
+        (0, bun_test_1.it)("preDelete hook throwing APIError is re-thrown", function () { return __awaiter(void 0, void 0, void 0, function () {
+            var res;
+            return __generator(this, function (_a) {
+                switch (_a.label) {
+                    case 0:
+                        app.use("/food", (0, api_1.modelRouter)(tests_1.FoodModel, {
+                            allowAnonymous: true,
+                            permissions: {
+                                create: [permissions_1.Permissions.IsAny],
+                                delete: [permissions_1.Permissions.IsAny],
+                                list: [permissions_1.Permissions.IsAny],
+                                read: [permissions_1.Permissions.IsAny],
+                                update: [permissions_1.Permissions.IsAny],
+                            },
+                            preDelete: function () {
+                                throw new errors_1.APIError({
+                                    disableExternalErrorTracking: true,
+                                    status: 400,
+                                    title: "Custom preDelete APIError",
+                                });
+                            },
+                        }));
+                        server = (0, supertest_1.default)(app);
+                        return [4 /*yield*/, (0, tests_1.authAsUser)(app, "notAdmin")];
+                    case 1:
+                        agent = _a.sent();
+                        return [4 /*yield*/, agent.delete("/food/".concat(spinach._id)).expect(400)];
+                    case 2:
+                        res = _a.sent();
+                        (0, bun_test_1.expect)(res.body.title).toBe("Custom preDelete APIError");
+                        (0, bun_test_1.expect)(res.body.disableExternalErrorTracking).toBe(true);
+                        return [2 /*return*/];
+                }
+            });
+        }); });
     });
     (0, bun_test_1.describe)("special query params", function () {
         var admin;