@terreno/api 0.13.0 → 0.13.1

package/dist/consentApp.d.ts

@@ -5,7 +5,7 @@
  * Provides admin CRUD for consent forms, read-only access to responses, and user-facing
  * endpoints for fetching pending consents and submitting responses.
  */
-import type express from "express";
+import { type Application } from "express";
 import type { User } from "./auth";
 import type { TerrenoPlugin } from "./terrenoPlugin";
 import type { ConsentFormDocument } from "./types/consentForm";
@@ -29,5 +29,5 @@ export interface ConsentAppOptions {
 export declare class ConsentApp implements TerrenoPlugin {
     private options;
     constructor(options?: ConsentAppOptions);
-    register(app: express.Application): void;
+    register(app: Application): void;
 }

package/dist/consentApp.js

@@ -55,6 +55,7 @@ var __values = (this && this.__values) || function(o) {
 };
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.ConsentApp = void 0;
+var express_1 = require("express");
 var luxon_1 = require("luxon");
 var api_1 = require("./api");
 var auth_1 = require("./auth");
@@ -203,7 +204,7 @@ var ConsentApp = /** @class */ (function () {
             ],
         }));
         // User-facing consent endpoints
-        var router = require("express").Router();
+        var router = (0, express_1.Router)();
         // GET /consents/pending - fetch pending consent forms for the current user
         router.get("/pending", (0, auth_1.authenticateMiddleware)(), (0, api_1.asyncHandler)(function (req, res) { return __awaiter(_this, void 0, void 0, function () {
             var user, activeForms, resolvedForms, existingResponses, respondedFormVersions, existingResponses_1, existingResponses_1_1, response, formId, respondedFormIds, respondedForms, formVersionByFormId, respondedForms_1, respondedForms_1_1, form, pendingForms, filteredOutByResolverCount, filteredOutByResponsesCount;

package/dist/githubAuth.test.js

@@ -77,10 +77,30 @@ var mongoose_1 = __importStar(require("mongoose"));
 var passport_1 = __importDefault(require("passport"));
 var passport_local_mongoose_1 = __importDefault(require("passport-local-mongoose"));
 var supertest_1 = __importDefault(require("supertest"));
+var auth_1 = require("./auth");
 var expressServer_1 = require("./expressServer");
 var githubAuth_1 = require("./githubAuth");
 var logger_1 = require("./logger");
 var plugins_1 = require("./plugins");
+var fakeGithubOutcome = { type: "redirect", url: "http://github.com/mock" };
+var installFakeGithubStrategy = function () {
+    var strategy = {
+        authenticate: function () {
+            var _a, _b;
+            if (fakeGithubOutcome.type === "success") {
+                this.success(fakeGithubOutcome.user);
+                return;
+            }
+            if (fakeGithubOutcome.type === "fail") {
+                this.fail((_a = fakeGithubOutcome.challenge) !== null && _a !== void 0 ? _a : { message: "auth failed" });
+                return;
+            }
+            this.redirect((_b = fakeGithubOutcome.url) !== null && _b !== void 0 ? _b : "http://github.com/mock");
+        },
+        name: "github",
+    };
+    passport_1.default.use("github", strategy);
+};
 // Create schema for GitHub-enabled user
 var testUserSchema = new mongoose_1.Schema({
     admin: { default: false, description: "Whether the user has admin privileges", type: Boolean },
@@ -729,3 +749,392 @@ var invokeGitHubVerify = function (req, accessToken, refreshToken, profile) {
         });
     }); });
 });
+(0, bun_test_1.describe)("GitHub callback handler (fake strategy)", function () {
+    var app;
+    var agent;
+    (0, bun_test_1.beforeEach)(function () { return __awaiter(void 0, void 0, void 0, function () {
+        function addRoutes(router) {
+            router.get("/test", function (_req, res) { return res.json({ ok: true }); });
+        }
+        return __generator(this, function (_a) {
+            switch (_a.label) {
+                case 0:
+                    (0, bun_test_1.setSystemTime)();
+                    return [4 /*yield*/, connectDb()];
+                case 1:
+                    _a.sent();
+                    return [4 /*yield*/, GitHubTestUserModel.deleteMany({})];
+                case 2:
+                    _a.sent();
+                    app = (0, expressServer_1.setupServer)({
+                        addMiddleware: function (a) {
+                            // The handler reads (req as unknown as {session?: {returnTo?: string}}).session?.returnTo.
+                            // setupServer does not install express-session, so prime a fake session from a request
+                            // header for tests.
+                            a.use(function (req, _res, next) {
+                                var headerReturnTo = req.headers["x-mock-return-to"];
+                                if (typeof headerReturnTo === "string") {
+                                    req.session = { returnTo: headerReturnTo };
+                                }
+                                next();
+                            });
+                        },
+                        addRoutes: addRoutes,
+                        githubAuth: {
+                            allowAccountLinking: true,
+                            callbackURL: "http://localhost:9000/auth/github/callback",
+                            clientId: "test-client-id",
+                            clientSecret: "test-client-secret",
+                        },
+                        skipListen: true,
+                        userModel: GitHubTestUserModel,
+                    });
+                    // Swap the github strategy with our fake after setupServer registered it.
+                    installFakeGithubStrategy();
+                    agent = supertest_1.default.agent(app);
+                    return [2 /*return*/];
+            }
+        });
+    }); });
+    (0, bun_test_1.afterEach)(function () {
+        (0, bun_test_1.setSystemTime)();
+        fakeGithubOutcome = { type: "redirect", url: "http://github.com/mock" };
+    });
+    (0, bun_test_1.it)("GET /auth/github/callback returns JSON tokens on success", function () { return __awaiter(void 0, void 0, void 0, function () {
+        var user, res;
+        return __generator(this, function (_a) {
+            switch (_a.label) {
+                case 0: return [4 /*yield*/, GitHubTestUserModel.create({
+                        email: "cb@example.com",
+                        githubId: "cb-gh-1",
+                        name: "CB User",
+                    })];
+                case 1:
+                    user = _a.sent();
+                    fakeGithubOutcome = { type: "success", user: user };
+                    return [4 /*yield*/, agent.get("/auth/github/callback").expect(200)];
+                case 2:
+                    res = _a.sent();
+                    (0, bun_test_1.expect)(res.body.data.token).toBeDefined();
+                    (0, bun_test_1.expect)(res.body.data.refreshToken).toBeDefined();
+                    (0, bun_test_1.expect)(res.body.data.userId).toBeDefined();
+                    return [2 /*return*/];
+            }
+        });
+    }); });
+    (0, bun_test_1.it)("GET /auth/github/callback redirects to returnTo with tokens when session.returnTo is set", function () { return __awaiter(void 0, void 0, void 0, function () {
+        var user, res;
+        return __generator(this, function (_a) {
+            switch (_a.label) {
+                case 0: return [4 /*yield*/, GitHubTestUserModel.create({
+                        email: "cb2@example.com",
+                        githubId: "cb-gh-2",
+                        name: "CB User 2",
+                    })];
+                case 1:
+                    user = _a.sent();
+                    fakeGithubOutcome = { type: "success", user: user };
+                    return [4 /*yield*/, agent
+                            .get("/auth/github/callback")
+                            .set("x-mock-return-to", "https://example.com/cb")
+                            .expect(302)];
+                case 2:
+                    res = _a.sent();
+                    (0, bun_test_1.expect)(res.headers.location).toContain("https://example.com/cb");
+                    (0, bun_test_1.expect)(res.headers.location).toContain("token=");
+                    (0, bun_test_1.expect)(res.headers.location).toContain("refreshToken=");
+                    (0, bun_test_1.expect)(res.headers.location).toContain("userId=");
+                    return [2 /*return*/];
+            }
+        });
+    }); });
+    (0, bun_test_1.it)("GET /auth/github/callback redirects on failure", function () { return __awaiter(void 0, void 0, void 0, function () {
+        var res;
+        return __generator(this, function (_a) {
+            switch (_a.label) {
+                case 0:
+                    fakeGithubOutcome = { challenge: { message: "denied" }, type: "fail" };
+                    return [4 /*yield*/, agent.get("/auth/github/callback").expect(302)];
+                case 1:
+                    res = _a.sent();
+                    (0, bun_test_1.expect)(res.headers.location).toContain("/auth/github/failure");
+                    return [2 /*return*/];
+            }
+        });
+    }); });
+    (0, bun_test_1.it)("GET /auth/github/callback returns 500 when token generation fails", function () { return __awaiter(void 0, void 0, void 0, function () {
+        var user, savedSecret, res;
+        return __generator(this, function (_a) {
+            switch (_a.label) {
+                case 0: return [4 /*yield*/, GitHubTestUserModel.create({
+                        email: "cb3@example.com",
+                        githubId: "cb-gh-3",
+                        name: "CB User 3",
+                    })];
+                case 1:
+                    user = _a.sent();
+                    fakeGithubOutcome = { type: "success", user: user };
+                    savedSecret = process.env.TOKEN_SECRET;
+                    process.env.TOKEN_SECRET = "";
+                    _a.label = 2;
+                case 2:
+                    _a.trys.push([2, , 4, 5]);
+                    return [4 /*yield*/, agent.get("/auth/github/callback").expect(500)];
+                case 3:
+                    res = _a.sent();
+                    (0, bun_test_1.expect)(res.body.message).toBe("Authentication failed");
+                    return [3 /*break*/, 5];
+                case 4:
+                    process.env.TOKEN_SECRET = savedSecret;
+                    return [7 /*endfinally*/];
+                case 5: return [2 /*return*/];
+            }
+        });
+    }); });
+});
+(0, bun_test_1.describe)("GET /auth/github/link with JWT (fake strategy)", function () {
+    var app;
+    var agent;
+    (0, bun_test_1.beforeEach)(function () { return __awaiter(void 0, void 0, void 0, function () {
+        function addRoutes(router) {
+            router.get("/test", function (_req, res) { return res.json({ ok: true }); });
+        }
+        return __generator(this, function (_a) {
+            switch (_a.label) {
+                case 0:
+                    (0, bun_test_1.setSystemTime)();
+                    return [4 /*yield*/, connectDb()];
+                case 1:
+                    _a.sent();
+                    return [4 /*yield*/, GitHubTestUserModel.deleteMany({})];
+                case 2:
+                    _a.sent();
+                    app = (0, expressServer_1.setupServer)({
+                        addRoutes: addRoutes,
+                        githubAuth: {
+                            allowAccountLinking: true,
+                            callbackURL: "http://localhost:9000/auth/github/callback",
+                            clientId: "test-client-id",
+                            clientSecret: "test-client-secret",
+                        },
+                        skipListen: true,
+                        userModel: GitHubTestUserModel,
+                    });
+                    installFakeGithubStrategy();
+                    agent = supertest_1.default.agent(app);
+                    return [2 /*return*/];
+            }
+        });
+    }); });
+    (0, bun_test_1.afterEach)(function () {
+        (0, bun_test_1.setSystemTime)();
+        fakeGithubOutcome = { type: "redirect", url: "http://github.com/mock" };
+    });
+    (0, bun_test_1.it)("GET /auth/github/link forwards to GitHub auth when JWT is valid", function () { return __awaiter(void 0, void 0, void 0, function () {
+        var user, loginRes, res;
+        return __generator(this, function (_a) {
+            switch (_a.label) {
+                case 0: return [4 /*yield*/, GitHubTestUserModel.create({
+                        email: "linkjwt@example.com",
+                        name: "Link JWT User",
+                    })];
+                case 1:
+                    user = _a.sent();
+                    return [4 /*yield*/, user.setPassword("password123")];
+                case 2:
+                    _a.sent();
+                    return [4 /*yield*/, user.save()];
+                case 3:
+                    _a.sent();
+                    return [4 /*yield*/, agent
+                            .post("/auth/login")
+                            .send({ email: "linkjwt@example.com", password: "password123" })
+                            .expect(200)];
+                case 4:
+                    loginRes = _a.sent();
+                    fakeGithubOutcome = { type: "redirect", url: "http://github.com/auth" };
+                    return [4 /*yield*/, agent
+                            .get("/auth/github/link")
+                            .set("authorization", "Bearer ".concat(loginRes.body.data.token))
+                            .expect(302)];
+                case 5:
+                    res = _a.sent();
+                    (0, bun_test_1.expect)(res.headers.location).toBe("http://github.com/auth");
+                    return [2 /*return*/];
+            }
+        });
+    }); });
+});
+(0, bun_test_1.describe)("DELETE /auth/github/unlink edge cases", function () {
+    var app;
+    var agent;
+    (0, bun_test_1.beforeEach)(function () { return __awaiter(void 0, void 0, void 0, function () {
+        function addRoutes(router) {
+            router.get("/test", function (_req, res) { return res.json({ ok: true }); });
+        }
+        return __generator(this, function (_a) {
+            switch (_a.label) {
+                case 0:
+                    (0, bun_test_1.setSystemTime)();
+                    return [4 /*yield*/, connectDb()];
+                case 1:
+                    _a.sent();
+                    return [4 /*yield*/, GitHubTestUserModel.deleteMany({})];
+                case 2:
+                    _a.sent();
+                    app = (0, expressServer_1.setupServer)({
+                        addRoutes: addRoutes,
+                        githubAuth: {
+                            allowAccountLinking: true,
+                            callbackURL: "http://localhost:9000/auth/github/callback",
+                            clientId: "test-client-id",
+                            clientSecret: "test-client-secret",
+                        },
+                        skipListen: true,
+                        userModel: GitHubTestUserModel,
+                    });
+                    installFakeGithubStrategy();
+                    agent = supertest_1.default.agent(app);
+                    return [2 /*return*/];
+            }
+        });
+    }); });
+    (0, bun_test_1.afterEach)(function () {
+        (0, bun_test_1.setSystemTime)();
+    });
+    (0, bun_test_1.it)("returns 400 when user has no password (no other auth method)", function () { return __awaiter(void 0, void 0, void 0, function () {
+        var user, token, res;
+        return __generator(this, function (_a) {
+            switch (_a.label) {
+                case 0: return [4 /*yield*/, GitHubTestUserModel.create({
+                        email: "ghonly@example.com",
+                        githubId: "ghonly-1",
+                        githubUsername: "ghonly",
+                    })];
+                case 1:
+                    user = _a.sent();
+                    return [4 /*yield*/, (0, auth_1.generateTokens)({ _id: user._id })];
+                case 2:
+                    token = (_a.sent()).token;
+                    return [4 /*yield*/, agent
+                            .delete("/auth/github/unlink")
+                            .set("authorization", "Bearer ".concat(token))
+                            .expect(400)];
+                case 3:
+                    res = _a.sent();
+                    (0, bun_test_1.expect)(res.body.message).toContain("Cannot unlink GitHub account");
+                    return [2 /*return*/];
+            }
+        });
+    }); });
+    (0, bun_test_1.it)("returns 500 when save throws during unlink", function () { return __awaiter(void 0, void 0, void 0, function () {
+        var user, loginRes, mockableModel, originalFindById, res;
+        return __generator(this, function (_a) {
+            switch (_a.label) {
+                case 0: return [4 /*yield*/, GitHubTestUserModel.create({
+                        email: "savefail@example.com",
+                        githubId: "savefail-1",
+                    })];
+                case 1:
+                    user = _a.sent();
+                    return [4 /*yield*/, user.setPassword("password123")];
+                case 2:
+                    _a.sent();
+                    return [4 /*yield*/, user.save()];
+                case 3:
+                    _a.sent();
+                    return [4 /*yield*/, agent
+                            .post("/auth/login")
+                            .send({ email: "savefail@example.com", password: "password123" })
+                            .expect(200)];
+                case 4:
+                    loginRes = _a.sent();
+                    mockableModel = GitHubTestUserModel;
+                    originalFindById = mockableModel.findById;
+                    mockableModel.findById = function () { return ({
+                        select: function () { return __awaiter(void 0, void 0, void 0, function () {
+                            return __generator(this, function (_a) {
+                                return [2 /*return*/, ({
+                                        hash: "x",
+                                        salt: "y",
+                                        save: function () { return __awaiter(void 0, void 0, void 0, function () {
+                                            return __generator(this, function (_a) {
+                                                throw new Error("boom");
+                                            });
+                                        }); },
+                                        setPassword: function () { return __awaiter(void 0, void 0, void 0, function () { return __generator(this, function (_a) {
+                                            return [2 /*return*/, undefined];
+                                        }); }); },
+                                    })];
+                            });
+                        }); },
+                    }); };
+                    _a.label = 5;
+                case 5:
+                    _a.trys.push([5, , 7, 8]);
+                    return [4 /*yield*/, agent
+                            .delete("/auth/github/unlink")
+                            .set("authorization", "Bearer ".concat(loginRes.body.data.token))
+                            .expect(500)];
+                case 6:
+                    res = _a.sent();
+                    (0, bun_test_1.expect)(res.body.message).toBe("Failed to unlink GitHub account");
+                    return [3 /*break*/, 8];
+                case 7:
+                    mockableModel.findById = originalFindById;
+                    return [7 /*endfinally*/];
+                case 8: return [2 /*return*/];
+            }
+        });
+    }); });
+});
+(0, bun_test_1.describe)("GitHub strategy verify callback edge cases", function () {
+    var testApp = { get: function () { }, use: function () { } };
+    (0, bun_test_1.beforeEach)(function () { return __awaiter(void 0, void 0, void 0, function () {
+        return __generator(this, function (_a) {
+            switch (_a.label) {
+                case 0: return [4 /*yield*/, connectDb()];
+                case 1:
+                    _a.sent();
+                    return [4 /*yield*/, GitHubTestUserModel.deleteMany({})];
+                case 2:
+                    _a.sent();
+                    return [2 /*return*/];
+            }
+        });
+    }); });
+    (0, bun_test_1.it)("returns 404 when linking a user whose record disappears", function () { return __awaiter(void 0, void 0, void 0, function () {
+        var existingUser, req, result;
+        var _a;
+        return __generator(this, function (_b) {
+            switch (_b.label) {
+                case 0: return [4 /*yield*/, GitHubTestUserModel.create({
+                        email: "gone@example.com",
+                    })];
+                case 1:
+                    existingUser = _b.sent();
+                    (0, githubAuth_1.setupGitHubAuth)(testApp, GitHubTestUserModel, {
+                        allowAccountLinking: true,
+                        callbackURL: "http://localhost:9000/auth/github/callback",
+                        clientId: "id",
+                        clientSecret: "secret",
+                    });
+                    // Delete user before verify runs to hit the 404 path.
+                    return [4 /*yield*/, GitHubTestUserModel.deleteOne({ _id: existingUser._id })];
+                case 2:
+                    // Delete user before verify runs to hit the 404 path.
+                    _b.sent();
+                    req = { user: existingUser };
+                    return [4 /*yield*/, invokeGitHubVerify(req, "access", "refresh", {
+                            id: "gh-missing-1",
+                            username: "missing",
+                        })];
+                case 3:
+                    result = _b.sent();
+                    (0, bun_test_1.expect)(result.err).toBeDefined();
+                    (0, bun_test_1.expect)((_a = result.err) === null || _a === void 0 ? void 0 : _a.status).toBe(404);
+                    return [2 /*return*/];
+            }
+        });
+    }); });
+});

package/dist/models/consentForm.js

@@ -6,15 +6,14 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.ConsentForm = void 0;
 var mongoose_1 = __importDefault(require("mongoose"));
 var plugins_1 = require("../plugins");
-var consentFormTypeMap = {
-    agreement: "agreement",
-    custom: "custom",
-    hipaa: "hipaa",
-    privacy: "privacy",
-    research: "research",
-    terms: "terms",
-};
-var consentFormTypeValues = Object.values(consentFormTypeMap);
+var consentFormTypeValues = [
+    "agreement",
+    "privacy",
+    "hipaa",
+    "research",
+    "terms",
+    "custom",
+];
 var consentFormSchema = new mongoose_1.default.Schema({
     active: {
         default: false,

package/dist/notifiers/slackNotifier.d.ts

@@ -1,6 +1,6 @@
-export declare function sendToSlack(text: string, { slackChannel, shouldThrow, env, url, }?: {
+export declare const sendToSlack: (text: string, { slackChannel, shouldThrow, env, url, }?: {
     slackChannel?: string;
     shouldThrow?: boolean;
     env?: string;
     url?: string;
-}): Promise<void>;
+}) => Promise<void>;

package/dist/notifiers/slackNotifier.js

@@ -68,11 +68,36 @@ var __generator = (this && this.__generator) || function (thisArg, body) {
         if (op[0] & 5) throw op[1]; return { value: op[0] ? op[1] : void 0, done: true };
     }
 };
+var __read = (this && this.__read) || function (o, n) {
+    var m = typeof Symbol === "function" && o[Symbol.iterator];
+    if (!m) return o;
+    var i = m.call(o), r, ar = [], e;
+    try {
+        while ((n === void 0 || n-- > 0) && !(r = i.next()).done) ar.push(r.value);
+    }
+    catch (error) { e = { error: error }; }
+    finally {
+        try {
+            if (r && !r.done && (m = i["return"])) m.call(i);
+        }
+        finally { if (e) throw e.error; }
+    }
+    return ar;
+};
+var __spreadArray = (this && this.__spreadArray) || function (to, from, pack) {
+    if (pack || arguments.length === 2) for (var i = 0, l = from.length, ar; i < l; i++) {
+        if (ar || !(i in from)) {
+            if (!ar) ar = Array.prototype.slice.call(from, 0, i);
+            ar[i] = from[i];
+        }
+    }
+    return to.concat(ar || Array.prototype.slice.call(from));
+};
 var __importDefault = (this && this.__importDefault) || function (mod) {
     return (mod && mod.__esModule) ? mod : { "default": mod };
 };
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.sendToSlack = sendToSlack;
+exports.sendToSlack = void 0;
 var Sentry = __importStar(require("@sentry/bun"));
 var axios_1 = __importDefault(require("axios"));
 var errors_1 = require("../errors");
@@ -81,9 +106,13 @@ var logger_1 = require("../logger");
 // If `url` is provided, it will be used directly instead of looking up from environment.
 // DEPRECATED: Looking up webhook URLs from the SLACK_WEBHOOKS environment variable by channel name
 // is deprecated and will be removed in a future version. Please pass the `url` parameter directly.
-function sendToSlack(text_1) {
-    return __awaiter(this, arguments, void 0, function (text, _a) {
-        var slackWebhookUrl, slackWebhooksString, slackWebhooks, channel, formattedText, error_1;
+var sendToSlack = function (text_1) {
+    var args_1 = [];
+    for (var _i = 1; _i < arguments.length; _i++) {
+        args_1[_i - 1] = arguments[_i];
+    }
+    return __awaiter(void 0, __spreadArray([text_1], __read(args_1), false), void 0, function (text, _a) {
+        var slackWebhookUrl, slackWebhooksString, slackWebhooks, channel, formattedText, error_1, errorObj;
         var _b, _c, _d;
         var _e = _a === void 0 ? {} : _a, slackChannel = _e.slackChannel, _f = _e.shouldThrow, shouldThrow = _f === void 0 ? false : _f, env = _e.env, url = _e.url;
         return __generator(this, function (_g) {
@@ -121,12 +150,13 @@ function sendToSlack(text_1) {
                     return [3 /*break*/, 4];
                 case 3:
                     error_1 = _g.sent();
-                    logger_1.logger.error("Error posting to slack: ".concat((_c = error_1.text) !== null && _c !== void 0 ? _c : error_1.message));
+                    errorObj = error_1;
+                    logger_1.logger.error("Error posting to slack: ".concat((_c = errorObj.text) !== null && _c !== void 0 ? _c : errorObj.message));
                     Sentry.captureException(error_1);
                     if (shouldThrow) {
                         throw new errors_1.APIError({
                             status: 500,
-                            title: "Error posting to slack: ".concat((_d = error_1.text) !== null && _d !== void 0 ? _d : error_1.message),
+                            title: "Error posting to slack: ".concat((_d = errorObj.text) !== null && _d !== void 0 ? _d : errorObj.message),
                         });
                     }
                     return [3 /*break*/, 4];
@@ -134,4 +164,5 @@ function sendToSlack(text_1) {
             }
         });
     });
-}
+};
+exports.sendToSlack = sendToSlack;

package/dist/plugins.d.ts

@@ -69,10 +69,10 @@ export interface FindExactlyOnePlugin<T> {
     findExactlyOne(query: Record<string, any>, errorArgs?: Partial<APIErrorConstructor>): Promise<Document & T>;
 }
 export declare class DateOnly extends SchemaType {
-    constructor(key: string, options: SchemaTypeOptions<any>);
+    constructor(key: string, options: SchemaTypeOptions<Date>);
     handleSingle(val: any): Date | undefined;
     $conditionalHandlers: any;
     castForQuery($conditional: any, val: any, context: any): Date | undefined;
-    cast(val: any): Date | undefined;
-    get(val: any): this;
+    cast(val: unknown): Date | undefined;
+    get(val: unknown): this;
 }

package/dist/plugins.js

@@ -154,13 +154,13 @@ var createdUpdatedPlugin = function (schema) {
         }
         // If we aren't specifying created, use now.
         if (!this.created) {
-            this.created = new Date();
+            this.created = luxon_1.DateTime.now().toJSDate();
         }
         // All writes change the updated time.
-        this.updated = new Date();
+        this.updated = luxon_1.DateTime.now().toJSDate();
     });
     schema.pre(/save|updateOne|insertMany/, function () {
-        void this.updateOne({}, { $set: { updated: new Date() } });
+        void this.updateOne({}, { $set: { updated: luxon_1.DateTime.now().toJSDate() } });
     });
 };
 exports.createdUpdatedPlugin = createdUpdatedPlugin;
@@ -313,6 +313,7 @@ var DateOnly = /** @class */ (function (_super) {
     // When using $gt, $gte, $lt, $lte, etc, we need to cast the value to a Date
     DateOnly.prototype.castForQuery = function ($conditional, val, context) {
         if ($conditional == null) {
+            // noExplicitAny: applySetters is an internal Mongoose SchemaType method not in public type definitions
             return this.applySetters(val, context);
         }
         var handler = this.$conditionalHandlers[$conditional];
@@ -345,10 +346,13 @@ var DateOnly = /** @class */ (function (_super) {
         throw new mongoose_1.Error.CastError("DateOnly", val, this.path, new Error("Value is not a valid date"));
     };
     DateOnly.prototype.get = function (val) {
-        return (val instanceof Date ? luxon_1.DateTime.fromJSDate(val).startOf("day").toJSDate() : val);
+        return (val instanceof Date
+            ? luxon_1.DateTime.fromJSDate(val).startOf("day").toJSDate()
+            : val);
     };
     return DateOnly;
 }(mongoose_1.SchemaType));
 exports.DateOnly = DateOnly;
 // Register DateOnly with Mongoose's Schema.Types
+// noExplicitAny: DateOnly is a custom SchemaType not declared in Mongoose's Schema.Types interface
 mongoose_1.default.Schema.Types.DateOnly = DateOnly;

package/dist/populate.test.js

@@ -92,6 +92,7 @@ var tests_1 = require("./tests");
 (0, bun_test_1.describe)("populate functions", function () {
     var admin;
     var notAdmin;
+    // noExplicitAny: typing as HydratedDocument<Food> causes cascading errors on populated field access patterns (e.g. populated.ownerId.name)
     var spinach;
     (0, bun_test_1.beforeEach)(function () { return __awaiter(void 0, void 0, void 0, function () {
         var _a, _b;
@@ -228,7 +229,9 @@ var tests_1 = require("./tests");
     });
     (0, bun_test_1.it)("replaces Mixed fields with only description", function () {
         var schema = new mongoose_1.Schema({ data: { description: "any data", type: mongoose_1.Schema.Types.Mixed } });
-        var properties = { data: { description: "any data", type: "object" } };
+        var properties = {
+            data: { description: "any data", type: "object" },
+        };
         (0, populate_1.fixMixedFields)(schema, properties);
         (0, bun_test_1.expect)(properties.data).toEqual({ description: "any data" });
     });
@@ -338,6 +341,7 @@ var tests_1 = require("./tests");
             populatePaths: [{ fields: ["__proto__.polluted"], path: "ownerId" }],
         });
         (0, bun_test_1.expect)(result.properties).toBeDefined();
+        // noExplicitAny: testing that prototype pollution did not add a 'polluted' property to Object.prototype
         (0, bun_test_1.expect)(Object.prototype.polluted).toBeUndefined();
         var ownerProps = result.properties.ownerId.properties;
         (0, bun_test_1.expect)(ownerProps).toBeDefined();

package/dist/secretProviders.js

@@ -168,7 +168,10 @@ var GcpSecretProvider = /** @class */ (function () {
                     case 4:
                         SecretManagerServiceClient = (_b = mod.SecretManagerServiceClient) !== null && _b !== void 0 ? _b : (_c = mod.default) === null || _c === void 0 ? void 0 : _c.SecretManagerServiceClient;
                         if (!SecretManagerServiceClient) {
-                            throw new Error("SecretManagerServiceClient not found in @google-cloud/secret-manager module");
+                            throw new errors_1.APIError({
+                                status: 500,
+                                title: "SecretManagerServiceClient not found in @google-cloud/secret-manager module",
+                            });
                         }
                         this.client = new SecretManagerServiceClient();
                         _d.label = 5;