@terreno/api 0.13.1 → 0.13.3

package/dist/api.asyncHandler.test.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/api.asyncHandler.test.js

@@ -0,0 +1,236 @@
+"use strict";
+var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, generator) {
+    function adopt(value) { return value instanceof P ? value : new P(function (resolve) { resolve(value); }); }
+    return new (P || (P = Promise))(function (resolve, reject) {
+        function fulfilled(value) { try { step(generator.next(value)); } catch (e) { reject(e); } }
+        function rejected(value) { try { step(generator["throw"](value)); } catch (e) { reject(e); } }
+        function step(result) { result.done ? resolve(result.value) : adopt(result.value).then(fulfilled, rejected); }
+        step((generator = generator.apply(thisArg, _arguments || [])).next());
+    });
+};
+var __generator = (this && this.__generator) || function (thisArg, body) {
+    var _ = { label: 0, sent: function() { if (t[0] & 1) throw t[1]; return t[1]; }, trys: [], ops: [] }, f, y, t, g = Object.create((typeof Iterator === "function" ? Iterator : Object).prototype);
+    return g.next = verb(0), g["throw"] = verb(1), g["return"] = verb(2), typeof Symbol === "function" && (g[Symbol.iterator] = function() { return this; }), g;
+    function verb(n) { return function (v) { return step([n, v]); }; }
+    function step(op) {
+        if (f) throw new TypeError("Generator is already executing.");
+        while (g && (g = 0, op[0] && (_ = 0)), _) try {
+            if (f = 1, y && (t = op[0] & 2 ? y["return"] : op[0] ? y["throw"] || ((t = y["return"]) && t.call(y), 0) : y.next) && !(t = t.call(y, op[1])).done) return t;
+            if (y = 0, t) op = [op[0] & 2, t.value];
+            switch (op[0]) {
+                case 0: case 1: t = op; break;
+                case 4: _.label++; return { value: op[1], done: false };
+                case 5: _.label++; y = op[1]; op = [0]; continue;
+                case 7: op = _.ops.pop(); _.trys.pop(); continue;
+                default:
+                    if (!(t = _.trys, t = t.length > 0 && t[t.length - 1]) && (op[0] === 6 || op[0] === 2)) { _ = 0; continue; }
+                    if (op[0] === 3 && (!t || (op[1] > t[0] && op[1] < t[3]))) { _.label = op[1]; break; }
+                    if (op[0] === 6 && _.label < t[1]) { _.label = t[1]; t = op; break; }
+                    if (t && _.label < t[2]) { _.label = t[2]; _.ops.push(op); break; }
+                    if (t[2]) _.ops.pop();
+                    _.trys.pop(); continue;
+            }
+            op = body.call(thisArg, _);
+        } catch (e) { op = [6, e]; y = 0; } finally { f = t = 0; }
+        if (op[0] & 5) throw op[1]; return { value: op[0] ? op[1] : void 0, done: true };
+    }
+};
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+var bun_test_1 = require("bun:test");
+var express_1 = __importDefault(require("express"));
+var supertest_1 = __importDefault(require("supertest"));
+var api_1 = require("./api");
+var openApiValidator_1 = require("./openApiValidator");
+(0, bun_test_1.afterEach)(function () {
+    (0, openApiValidator_1.resetOpenApiValidatorConfig)();
+});
+var createApp = function () {
+    var app = (0, express_1.default)();
+    app.use(express_1.default.json());
+    return app;
+};
+var errorHandler = function (err, _req, res, _next) {
+    res.status(err.status || 500).json({ error: err.title || err.message });
+};
+(0, bun_test_1.describe)("asyncHandler with bodySchema validation", function () {
+    (0, bun_test_1.it)("validates and accepts a conforming body", function () { return __awaiter(void 0, void 0, void 0, function () {
+        var app, res;
+        return __generator(this, function (_a) {
+            switch (_a.label) {
+                case 0:
+                    (0, openApiValidator_1.configureOpenApiValidator)({});
+                    app = createApp();
+                    app.post("/test", (0, api_1.asyncHandler)(function (_req, res) { return __awaiter(void 0, void 0, void 0, function () {
+                        return __generator(this, function (_a) {
+                            res.json({ ok: true });
+                            return [2 /*return*/];
+                        });
+                    }); }, {
+                        bodySchema: { name: { required: true, type: "string" } },
+                        validate: true,
+                    }));
+                    app.use(errorHandler);
+                    return [4 /*yield*/, (0, supertest_1.default)(app).post("/test").send({ name: "hello" }).expect(200)];
+                case 1:
+                    res = _a.sent();
+                    (0, bun_test_1.expect)(res.body.ok).toBe(true);
+                    return [2 /*return*/];
+            }
+        });
+    }); });
+    (0, bun_test_1.it)("rejects a body missing a required field", function () { return __awaiter(void 0, void 0, void 0, function () {
+        var app;
+        return __generator(this, function (_a) {
+            switch (_a.label) {
+                case 0:
+                    (0, openApiValidator_1.configureOpenApiValidator)({});
+                    app = createApp();
+                    app.post("/test", (0, api_1.asyncHandler)(function (_req, res) { return __awaiter(void 0, void 0, void 0, function () {
+                        return __generator(this, function (_a) {
+                            res.json({ ok: true });
+                            return [2 /*return*/];
+                        });
+                    }); }, {
+                        bodySchema: { name: { required: true, type: "string" } },
+                        validate: true,
+                    }));
+                    app.use(errorHandler);
+                    return [4 /*yield*/, (0, supertest_1.default)(app).post("/test").send({}).expect(400)];
+                case 1:
+                    _a.sent();
+                    return [2 /*return*/];
+            }
+        });
+    }); });
+    (0, bun_test_1.it)("skips body validation when validate is false", function () { return __awaiter(void 0, void 0, void 0, function () {
+        var app, res;
+        return __generator(this, function (_a) {
+            switch (_a.label) {
+                case 0:
+                    (0, openApiValidator_1.configureOpenApiValidator)({});
+                    app = createApp();
+                    app.post("/test", (0, api_1.asyncHandler)(function (_req, res) { return __awaiter(void 0, void 0, void 0, function () {
+                        return __generator(this, function (_a) {
+                            res.json({ ok: true });
+                            return [2 /*return*/];
+                        });
+                    }); }, {
+                        bodySchema: { name: { required: true, type: "string" } },
+                        validate: false,
+                    }));
+                    app.use(errorHandler);
+                    return [4 /*yield*/, (0, supertest_1.default)(app).post("/test").send({}).expect(200)];
+                case 1:
+                    res = _a.sent();
+                    (0, bun_test_1.expect)(res.body.ok).toBe(true);
+                    return [2 /*return*/];
+            }
+        });
+    }); });
+});
+(0, bun_test_1.describe)("asyncHandler with querySchema validation", function () {
+    (0, bun_test_1.it)("validates and accepts conforming query params", function () { return __awaiter(void 0, void 0, void 0, function () {
+        var app, res;
+        return __generator(this, function (_a) {
+            switch (_a.label) {
+                case 0:
+                    (0, openApiValidator_1.configureOpenApiValidator)({});
+                    app = createApp();
+                    app.get("/test", (0, api_1.asyncHandler)(function (_req, res) { return __awaiter(void 0, void 0, void 0, function () {
+                        return __generator(this, function (_a) {
+                            res.json({ ok: true });
+                            return [2 /*return*/];
+                        });
+                    }); }, {
+                        querySchema: { page: { type: "integer" } },
+                        validate: true,
+                    }));
+                    app.use(errorHandler);
+                    return [4 /*yield*/, (0, supertest_1.default)(app).get("/test?page=1").expect(200)];
+                case 1:
+                    res = _a.sent();
+                    (0, bun_test_1.expect)(res.body.ok).toBe(true);
+                    return [2 /*return*/];
+            }
+        });
+    }); });
+    (0, bun_test_1.it)("rejects invalid query params", function () { return __awaiter(void 0, void 0, void 0, function () {
+        var app;
+        return __generator(this, function (_a) {
+            switch (_a.label) {
+                case 0:
+                    (0, openApiValidator_1.configureOpenApiValidator)({});
+                    app = createApp();
+                    app.get("/test", (0, api_1.asyncHandler)(function (_req, res) { return __awaiter(void 0, void 0, void 0, function () {
+                        return __generator(this, function (_a) {
+                            res.json({ ok: true });
+                            return [2 /*return*/];
+                        });
+                    }); }, {
+                        querySchema: { page: { required: true, type: "integer" } },
+                        validate: true,
+                    }));
+                    app.use(errorHandler);
+                    return [4 /*yield*/, (0, supertest_1.default)(app).get("/test").expect(400)];
+                case 1:
+                    _a.sent();
+                    return [2 /*return*/];
+            }
+        });
+    }); });
+});
+(0, bun_test_1.describe)("asyncHandler with both schemas", function () {
+    (0, bun_test_1.it)("runs both body and query validators sequentially", function () { return __awaiter(void 0, void 0, void 0, function () {
+        var app, res;
+        return __generator(this, function (_a) {
+            switch (_a.label) {
+                case 0:
+                    (0, openApiValidator_1.configureOpenApiValidator)({});
+                    app = createApp();
+                    app.post("/test", (0, api_1.asyncHandler)(function (_req, res) { return __awaiter(void 0, void 0, void 0, function () {
+                        return __generator(this, function (_a) {
+                            res.json({ ok: true });
+                            return [2 /*return*/];
+                        });
+                    }); }, {
+                        bodySchema: { name: { required: true, type: "string" } },
+                        querySchema: { page: { type: "integer" } },
+                        validate: true,
+                    }));
+                    app.use(errorHandler);
+                    return [4 /*yield*/, (0, supertest_1.default)(app).post("/test?page=1").send({ name: "hi" }).expect(200)];
+                case 1:
+                    res = _a.sent();
+                    (0, bun_test_1.expect)(res.body.ok).toBe(true);
+                    return [2 /*return*/];
+            }
+        });
+    }); });
+    (0, bun_test_1.it)("forwards handler errors through next", function () { return __awaiter(void 0, void 0, void 0, function () {
+        var app, res;
+        return __generator(this, function (_a) {
+            switch (_a.label) {
+                case 0:
+                    (0, openApiValidator_1.configureOpenApiValidator)({});
+                    app = createApp();
+                    app.post("/test", (0, api_1.asyncHandler)(function () { return __awaiter(void 0, void 0, void 0, function () {
+                        return __generator(this, function (_a) {
+                            throw new Error("handler boom");
+                        });
+                    }); }, {
+                        bodySchema: { name: { type: "string" } },
+                        validate: true,
+                    }));
+                    app.use(errorHandler);
+                    return [4 /*yield*/, (0, supertest_1.default)(app).post("/test").send({ name: "ok" }).expect(500)];
+                case 1:
+                    res = _a.sent();
+                    (0, bun_test_1.expect)(res.body.error).toBe("handler boom");
+                    return [2 /*return*/];
+            }
+        });
+    }); });
+});

package/dist/api.js

@@ -335,6 +335,9 @@ function _buildModelRouter(model, options) {
                         body = (0, transformers_1.transform)(options, req.body, "create", req.user);
                     }
                     catch (error) {
+                        if ((0, errors_1.isAPIError)(error)) {
+                            throw error;
+                        }
                         throw new errors_1.APIError({
                             disableExternalErrorTracking: (0, errors_1.getDisableExternalErrorTracking)(error),
                             error: error,
@@ -687,6 +690,9 @@ function _buildModelRouter(model, options) {
                         body = (0, transformers_1.transform)(options, req.body, "update", req.user);
                     }
                     catch (error) {
+                        if ((0, errors_1.isAPIError)(error)) {
+                            throw error;
+                        }
                         throw new errors_1.APIError({
                             disableExternalErrorTracking: (0, errors_1.getDisableExternalErrorTracking)(error),
                             error: error,
@@ -968,6 +974,9 @@ function _buildModelRouter(model, options) {
                             body = (0, transformers_1.transform)(options, body, "update", req.user);
                         }
                         catch (error) {
+                            if ((0, errors_1.isAPIError)(error)) {
+                                throw error;
+                            }
                             throw new errors_1.APIError({
                                 disableExternalErrorTracking: (0, errors_1.getDisableExternalErrorTracking)(error),
                                 error: error,

package/dist/api.test.js

@@ -774,7 +774,7 @@ var transformers_1 = require("./transformers");
                             }),
                         }));
                         server = (0, supertest_1.default)(app);
-                        return [4 /*yield*/, server.post("/food").send({ calories: 15, name: "Broccoli" }).expect(400)];
+                        return [4 /*yield*/, server.post("/food").send({ calories: 15, name: "Broccoli" }).expect(403)];
                     case 1:
                         res = _a.sent();
                         (0, bun_test_1.expect)(res.body.title).toContain("cannot write fields");
@@ -1699,7 +1699,7 @@ var transformers_1 = require("./transformers");
                             }),
                         }));
                         server = (0, supertest_1.default)(app);
-                        return [4 /*yield*/, server.post("/food").send({ calories: 15, name: "Broccoli" }).expect(400)];
+                        return [4 /*yield*/, server.post("/food").send({ calories: 15, name: "Broccoli" }).expect(403)];
                     case 1:
                         res = _a.sent();
                         (0, bun_test_1.expect)(res.body.title).toContain("cannot write fields");

package/dist/models/versionConfig.d.ts

@@ -12,6 +12,6 @@ export interface VersionConfigDocument extends mongoose.Document {
     updated?: Date;
 }
 export interface VersionConfigModel extends mongoose.Model<VersionConfigDocument> {
-    findOneOrNone(query: Record<string, any>, errorArgs?: Partial<APIErrorConstructor>): Promise<(Document & VersionConfigDocument) | null>;
+    findOneOrNone(query: Record<string, unknown>, errorArgs?: Partial<APIErrorConstructor>): Promise<(Document & VersionConfigDocument) | null>;
 }
 export declare const VersionConfig: VersionConfigModel;

package/dist/openApiValidator.test.js

@@ -262,6 +262,70 @@ var setupFreshApp = function () { return __awaiter(void 0, void 0, void 0, funct
             });
         }); });
     });
+    (0, bun_test_1.describe)("per-route validation: object-form options", function () {
+        (0, bun_test_1.it)("applies object validation options with per-operation control", function () { return __awaiter(void 0, void 0, void 0, function () {
+            var removedProps, errorsCaught, freshApp, admin, res;
+            return __generator(this, function (_a) {
+                switch (_a.label) {
+                    case 0:
+                        (0, openApiValidator_1.configureOpenApiValidator)({ removeAdditional: true });
+                        removedProps = [];
+                        errorsCaught = [];
+                        return [4 /*yield*/, setupFreshApp()];
+                    case 1:
+                        freshApp = _a.sent();
+                        freshApp.use("/required", (0, api_1.modelRouter)(tests_1.RequiredModel, __assign(__assign({}, requiredRouterOptions), { validation: {
+                                excludeFromCreate: ["about"],
+                                onAdditionalPropertiesRemoved: function (props) {
+                                    removedProps.push.apply(removedProps, __spreadArray([], __read(props), false));
+                                },
+                                onError: function (errors) {
+                                    errorsCaught.push(errors);
+                                },
+                                validateCreate: true,
+                                validateQuery: true,
+                                validateUpdate: true,
+                            } })));
+                        return [4 /*yield*/, (0, tests_1.authAsUser)(freshApp, "admin")];
+                    case 2:
+                        admin = _a.sent();
+                        return [4 /*yield*/, admin.post("/required").send({ name: "Validated" }).expect(201)];
+                    case 3:
+                        res = _a.sent();
+                        (0, bun_test_1.expect)(res.body.data.name).toBe("Validated");
+                        return [2 /*return*/];
+                }
+            });
+        }); });
+        (0, bun_test_1.it)("disables create validation when validateCreate is false", function () { return __awaiter(void 0, void 0, void 0, function () {
+            var freshApp, admin, res;
+            return __generator(this, function (_a) {
+                switch (_a.label) {
+                    case 0:
+                        (0, openApiValidator_1.configureOpenApiValidator)({ removeAdditional: true });
+                        return [4 /*yield*/, setupFreshApp()];
+                    case 1:
+                        freshApp = _a.sent();
+                        freshApp.use("/required", (0, api_1.modelRouter)(tests_1.RequiredModel, __assign(__assign({}, requiredRouterOptions), { validation: {
+                                excludeFromUpdate: ["about"],
+                                validateCreate: false,
+                                validateUpdate: true,
+                            } })));
+                        return [4 /*yield*/, (0, tests_1.authAsUser)(freshApp, "admin")];
+                    case 2:
+                        admin = _a.sent();
+                        return [4 /*yield*/, admin
+                                .post("/required")
+                                .send({ extraField: "ignored", name: "NoCreateValidation" })
+                                .expect(201)];
+                    case 3:
+                        res = _a.sent();
+                        (0, bun_test_1.expect)(res.body.data.name).toBe("NoCreateValidation");
+                        return [2 /*return*/];
+                }
+            });
+        }); });
+    });
     (0, bun_test_1.describe)("sanitization of non-standard mongoose-to-swagger types", function () {
         (0, bun_test_1.it)("validates models with ObjectId and DateOnly fields after sanitization", function () { return __awaiter(void 0, void 0, void 0, function () {
             var freshApp, admin, res;

package/dist/transformers.d.ts

@@ -6,7 +6,7 @@ export interface TerrenoTransformer<T> {
     transform?: (obj: Partial<T>, method: "create" | "update", user?: User) => Partial<T> | undefined;
     serialize?: (obj: T, user?: User) => Partial<T> | undefined;
 }
-export declare function AdminOwnerTransformer<T>(options: {
+export declare const AdminOwnerTransformer: <T>(options: {
     anonReadFields?: string[];
     authReadFields?: string[];
     ownerReadFields?: string[];
@@ -15,11 +15,11 @@ export declare function AdminOwnerTransformer<T>(options: {
     authWriteFields?: string[];
     ownerWriteFields?: string[];
     adminWriteFields?: string[];
-}): TerrenoTransformer<T>;
-export declare function transform<T>(options: ModelRouterOptions<T>, data: Partial<T> | Partial<T>[], method: "create" | "update", user?: User): Partial<T> | (Partial<T> | undefined)[] | undefined;
-export declare function serialize<T>(req: express.Request, options: ModelRouterOptions<T>, data: (Document<any, any, any> & T) | (Document<any, any, any> & T)[]): Partial<T> | (Partial<T> | undefined)[] | undefined;
+}) => TerrenoTransformer<T>;
+export declare const transform: <T>(options: ModelRouterOptions<T>, data: Partial<T> | Partial<T>[], method: "create" | "update", user?: User) => Partial<T> | (Partial<T> | undefined)[] | undefined;
+export declare const serialize: <T>(req: express.Request, options: ModelRouterOptions<T>, data: (Document & T) | (Document & T)[]) => Partial<T> | (Partial<T> | undefined)[] | undefined;
 /**
  * Default response handler for modelRouter. Calls toObject on each doc and returns the result,
  * using transformers.serializer if provided.
  */
-export declare function defaultResponseHandler<T>(doc: (Document<any, any, any> & T) | (Document<any, any, any> & T)[] | null, method: "list" | "create" | "read" | "update", request: express.Request, options: ModelRouterOptions<T>): Promise<Partial<T> | (Partial<T> | undefined)[] | null | undefined>;
+export declare const defaultResponseHandler: <T>(doc: (Document & T) | (Document & T)[] | null, method: "list" | "create" | "read" | "update", request: express.Request, options: ModelRouterOptions<T>) => Promise<Partial<T> | (Partial<T> | undefined)[] | null | undefined>;

package/dist/transformers.js

@@ -72,13 +72,10 @@ var __spreadArray = (this && this.__spreadArray) || function (to, from, pack) {
     return to.concat(ar || Array.prototype.slice.call(from));
 };
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.AdminOwnerTransformer = AdminOwnerTransformer;
-exports.transform = transform;
-exports.serialize = serialize;
-exports.defaultResponseHandler = defaultResponseHandler;
+exports.defaultResponseHandler = exports.serialize = exports.transform = exports.AdminOwnerTransformer = void 0;
 var errors_1 = require("./errors");
 var logger_1 = require("./logger");
-function getUserType(user, obj) {
+var getUserType = function (user, obj) {
     if (user === null || user === void 0 ? void 0 : user.admin) {
         return "admin";
     }
@@ -89,9 +86,9 @@ function getUserType(user, obj) {
         return "auth";
     }
     return "anon";
-}
-function AdminOwnerTransformer(options) {
-    function pickFields(obj, fields) {
+};
+var AdminOwnerTransformer = function (options) {
+    var pickFields = function (obj, fields) {
         var e_1, _a;
         var newData = {};
         try {
@@ -110,7 +107,7 @@ function AdminOwnerTransformer(options) {
             finally { if (e_1) throw e_1.error; }
         }
         return newData;
-    }
+    };
     return {
         serialize: function (obj, user) {
             var _a, _b, _c, _d;
@@ -126,7 +123,6 @@ function AdminOwnerTransformer(options) {
             }
             return pickFields(obj, __spreadArray(__spreadArray([], __read(((_d = options.anonReadFields) !== null && _d !== void 0 ? _d : [])), false), ["id"], false));
         },
-        // TODO: Migrate AdminOwnerTransform to use pre-hooks.
         transform: function (obj, _method, user) {
             var _a, _b, _c, _d;
             var userType = getUserType(user, obj);
@@ -145,13 +141,17 @@ function AdminOwnerTransformer(options) {
             }
             var unallowedFields = Object.keys(obj).filter(function (k) { return !allowedFields.includes(k); });
             if (unallowedFields.length) {
-                throw new Error("User of type ".concat(userType, " cannot write fields: ").concat(unallowedFields.join(", ")));
+                throw new errors_1.APIError({
+                    status: 403,
+                    title: "User of type ".concat(userType, " cannot write fields: ").concat(unallowedFields.join(", ")),
+                });
             }
             return obj;
         },
     };
-}
-function transform(options, data, method, user) {
+};
+exports.AdminOwnerTransformer = AdminOwnerTransformer;
+var transform = function (options, data, method, user) {
     var _a, _b;
     if (!((_a = options.transformer) === null || _a === void 0 ? void 0 : _a.transform)) {
         return data;
@@ -163,8 +163,9 @@ function transform(options, data, method, user) {
         return transformFn(data, method, user);
     }
     return data.map(function (d) { return transformFn(d, method, user); });
-}
-function serialize(req, options, data) {
+};
+exports.transform = transform;
+var serialize = function (req, options, data) {
     var _a;
     var serializeFn = function (serializeData, serializeUser) {
         var _a, _b;
@@ -190,30 +191,30 @@ function serialize(req, options, data) {
         return serializeFn(data, req.user);
     }
     return data.map(function (d) { return serializeFn(d, req.user); });
-}
+};
+exports.serialize = serialize;
 /**
  * Default response handler for modelRouter. Calls toObject on each doc and returns the result,
  * using transformers.serializer if provided.
  */
-function defaultResponseHandler(doc, method, request, options) {
-    return __awaiter(this, void 0, void 0, function () {
-        var errorObj;
-        return __generator(this, function (_a) {
-            if (!doc) {
-                return [2 /*return*/, null];
-            }
-            try {
-                return [2 /*return*/, serialize(request, options, doc)];
-            }
-            catch (error) {
-                errorObj = error;
-                throw new errors_1.APIError({
-                    error: errorObj,
-                    status: 400,
-                    title: "Error serializing ".concat(method, " response: ").concat(errorObj.message),
-                });
-            }
-            return [2 /*return*/];
-        });
+var defaultResponseHandler = function (doc, method, request, options) { return __awaiter(void 0, void 0, void 0, function () {
+    var errorObj;
+    return __generator(this, function (_a) {
+        if (!doc) {
+            return [2 /*return*/, null];
+        }
+        try {
+            return [2 /*return*/, (0, exports.serialize)(request, options, doc)];
+        }
+        catch (error) {
+            errorObj = error;
+            throw new errors_1.APIError({
+                error: errorObj,
+                status: 400,
+                title: "Error serializing ".concat(method, " response: ").concat(errorObj.message),
+            });
+        }
+        return [2 /*return*/];
     });
-}
+}); };
+exports.defaultResponseHandler = defaultResponseHandler;

package/package.json

@@ -104,5 +104,5 @@
     "updateSnapshot": "bun test --update-snapshots"
   },
   "types": "dist/index.d.ts",
-  "version": "0.13.1"
+  "version": "0.13.3"
 }

package/src/api.asyncHandler.test.ts

@@ -0,0 +1,177 @@
+import {afterEach, describe, expect, it} from "bun:test";
+import express, {type NextFunction, type Request, type Response} from "express";
+import supertest from "supertest";
+
+import {asyncHandler} from "./api";
+import {configureOpenApiValidator, resetOpenApiValidatorConfig} from "./openApiValidator";
+
+afterEach(() => {
+  resetOpenApiValidatorConfig();
+});
+
+const createApp = (): express.Application => {
+  const app = express();
+  app.use(express.json());
+  return app;
+};
+
+const errorHandler = (
+  err: {status?: number; title?: string; message?: string},
+  _req: Request,
+  res: Response,
+  _next: NextFunction
+): void => {
+  res.status(err.status || 500).json({error: err.title || err.message});
+};
+
+describe("asyncHandler with bodySchema validation", () => {
+  it("validates and accepts a conforming body", async () => {
+    configureOpenApiValidator({});
+    const app = createApp();
+    app.post(
+      "/test",
+      asyncHandler(
+        async (_req: Request, res: Response) => {
+          res.json({ok: true});
+        },
+        {
+          bodySchema: {name: {required: true, type: "string"}},
+          validate: true,
+        }
+      )
+    );
+    app.use(errorHandler);
+
+    const res = await supertest(app).post("/test").send({name: "hello"}).expect(200);
+    expect(res.body.ok).toBe(true);
+  });
+
+  it("rejects a body missing a required field", async () => {
+    configureOpenApiValidator({});
+    const app = createApp();
+    app.post(
+      "/test",
+      asyncHandler(
+        async (_req: Request, res: Response) => {
+          res.json({ok: true});
+        },
+        {
+          bodySchema: {name: {required: true, type: "string"}},
+          validate: true,
+        }
+      )
+    );
+    app.use(errorHandler);
+
+    await supertest(app).post("/test").send({}).expect(400);
+  });
+
+  it("skips body validation when validate is false", async () => {
+    configureOpenApiValidator({});
+    const app = createApp();
+    app.post(
+      "/test",
+      asyncHandler(
+        async (_req: Request, res: Response) => {
+          res.json({ok: true});
+        },
+        {
+          bodySchema: {name: {required: true, type: "string"}},
+          validate: false,
+        }
+      )
+    );
+    app.use(errorHandler);
+
+    const res = await supertest(app).post("/test").send({}).expect(200);
+    expect(res.body.ok).toBe(true);
+  });
+});
+
+describe("asyncHandler with querySchema validation", () => {
+  it("validates and accepts conforming query params", async () => {
+    configureOpenApiValidator({});
+    const app = createApp();
+    app.get(
+      "/test",
+      asyncHandler(
+        async (_req: Request, res: Response) => {
+          res.json({ok: true});
+        },
+        {
+          querySchema: {page: {type: "integer"}},
+          validate: true,
+        }
+      )
+    );
+    app.use(errorHandler);
+
+    const res = await supertest(app).get("/test?page=1").expect(200);
+    expect(res.body.ok).toBe(true);
+  });
+
+  it("rejects invalid query params", async () => {
+    configureOpenApiValidator({});
+    const app = createApp();
+    app.get(
+      "/test",
+      asyncHandler(
+        async (_req: Request, res: Response) => {
+          res.json({ok: true});
+        },
+        {
+          querySchema: {page: {required: true, type: "integer"}},
+          validate: true,
+        }
+      )
+    );
+    app.use(errorHandler);
+
+    await supertest(app).get("/test").expect(400);
+  });
+});
+
+describe("asyncHandler with both schemas", () => {
+  it("runs both body and query validators sequentially", async () => {
+    configureOpenApiValidator({});
+    const app = createApp();
+    app.post(
+      "/test",
+      asyncHandler(
+        async (_req: Request, res: Response) => {
+          res.json({ok: true});
+        },
+        {
+          bodySchema: {name: {required: true, type: "string"}},
+          querySchema: {page: {type: "integer"}},
+          validate: true,
+        }
+      )
+    );
+    app.use(errorHandler);
+
+    const res = await supertest(app).post("/test?page=1").send({name: "hi"}).expect(200);
+    expect(res.body.ok).toBe(true);
+  });
+
+  it("forwards handler errors through next", async () => {
+    configureOpenApiValidator({});
+    const app = createApp();
+    app.post(
+      "/test",
+      asyncHandler(
+        async () => {
+          throw new Error("handler boom");
+        },
+        {
+          bodySchema: {name: {type: "string"}},
+          validate: true,
+        }
+      )
+    );
+    app.use(errorHandler);
+
+    const res = await supertest(app).post("/test").send({name: "ok"}).expect(500);
+    expect(res.body.error).toBe("handler boom");
+  });
+});

package/src/api.test.ts

@@ -576,7 +576,7 @@ describe("@terreno/api", () => {
       );
       server = supertest(app);
 
-      const res = await server.post("/food").send({calories: 15, name: "Broccoli"}).expect(400);
+      const res = await server.post("/food").send({calories: 15, name: "Broccoli"}).expect(403);
       expect(res.body.title).toContain("cannot write fields");
     });
 
@@ -1324,7 +1324,7 @@ describe("@terreno/api", () => {
       );
       server = supertest(app);
 
-      const res = await server.post("/food").send({calories: 15, name: "Broccoli"}).expect(400);
+      const res = await server.post("/food").send({calories: 15, name: "Broccoli"}).expect(403);
       expect(res.body.title).toContain("cannot write fields");
     });
 

package/src/api.ts

@@ -528,6 +528,9 @@ function _buildModelRouter<T>(model: Model<T>, options: ModelRouterOptions<T>):
       try {
         body = transform<T>(options, req.body, "create", req.user);
       } catch (error: any) {
+        if (isAPIError(error)) {
+          throw error;
+        }
         throw new APIError({
           disableExternalErrorTracking: getDisableExternalErrorTracking(error),
           error,
@@ -827,6 +830,9 @@ function _buildModelRouter<T>(model: Model<T>, options: ModelRouterOptions<T>):
       try {
         body = transform<T>(options, req.body, "update", req.user);
       } catch (error: any) {
+        if (isAPIError(error)) {
+          throw error;
+        }
         throw new APIError({
           disableExternalErrorTracking: getDisableExternalErrorTracking(error),
           error,
@@ -1080,6 +1086,9 @@ function _buildModelRouter<T>(model: Model<T>, options: ModelRouterOptions<T>):
     try {
       body = transform<T>(options, body, "update", req.user) as Partial<T>;
     } catch (error: any) {
+      if (isAPIError(error)) {
+        throw error;
+      }
       throw new APIError({
         disableExternalErrorTracking: getDisableExternalErrorTracking(error),
         error,

package/src/models/versionConfig.ts

@@ -17,7 +17,7 @@ export interface VersionConfigDocument extends mongoose.Document {
 
 export interface VersionConfigModel extends mongoose.Model<VersionConfigDocument> {
   findOneOrNone(
-    query: Record<string, any>,
+    query: Record<string, unknown>,
     errorArgs?: Partial<APIErrorConstructor>
   ): Promise<(Document & VersionConfigDocument) | null>;
 }

package/src/openApiEtag.ts

@@ -14,7 +14,7 @@ export const openApiEtagMiddleware = (req: Request, res: Response, next: NextFun
 
   const originalJson = res.json.bind(res);
 
-  res.json = (body: any) => {
+  res.json = (body: unknown) => {
     const jsonString = JSON.stringify(body);
     const etag = `"${crypto.createHash("sha256").update(jsonString).digest("hex").substring(0, 16)}"`;
 

package/src/openApiValidator.test.ts

@@ -161,6 +161,64 @@ describe("openApiValidator", () => {
     });
   });
 
+  describe("per-route validation: object-form options", () => {
+    it("applies object validation options with per-operation control", async () => {
+      configureOpenApiValidator({removeAdditional: true});
+
+      const removedProps: string[] = [];
+      const errorsCaught: ErrorObject[][] = [];
+
+      const freshApp = await setupFreshApp();
+      freshApp.use(
+        "/required",
+        modelRouter(RequiredModel, {
+          ...requiredRouterOptions,
+          validation: {
+            excludeFromCreate: ["about"],
+            onAdditionalPropertiesRemoved: (props) => {
+              removedProps.push(...props);
+            },
+            onError: (errors) => {
+              errorsCaught.push(errors);
+            },
+            validateCreate: true,
+            validateQuery: true,
+            validateUpdate: true,
+          },
+        })
+      );
+      const admin = await authAsUser(freshApp, "admin");
+
+      const res = await admin.post("/required").send({name: "Validated"}).expect(201);
+      expect(res.body.data.name).toBe("Validated");
+    });
+
+    it("disables create validation when validateCreate is false", async () => {
+      configureOpenApiValidator({removeAdditional: true});
+
+      const freshApp = await setupFreshApp();
+      freshApp.use(
+        "/required",
+        modelRouter(RequiredModel, {
+          ...requiredRouterOptions,
+          validation: {
+            excludeFromUpdate: ["about"],
+            validateCreate: false,
+            validateUpdate: true,
+          },
+        })
+      );
+      const admin = await authAsUser(freshApp, "admin");
+
+      // Even with extra field, should pass since create validation is disabled
+      const res = await admin
+        .post("/required")
+        .send({extraField: "ignored", name: "NoCreateValidation"})
+        .expect(201);
+      expect(res.body.data.name).toBe("NoCreateValidation");
+    });
+  });
+
   describe("sanitization of non-standard mongoose-to-swagger types", () => {
     it("validates models with ObjectId and DateOnly fields after sanitization", async () => {
       configureOpenApiValidator({removeAdditional: true});

package/src/transformers.ts

@@ -15,7 +15,10 @@ export interface TerrenoTransformer<T> {
   serialize?: (obj: T, user?: User) => Partial<T> | undefined;
 }
 
-function getUserType(user?: User, obj?: any): "anon" | "auth" | "owner" | "admin" {
+const getUserType = (
+  user?: User,
+  obj?: Record<string, unknown>
+): "anon" | "auth" | "owner" | "admin" => {
   if (user?.admin) {
     return "admin";
   }
@@ -26,10 +29,9 @@ function getUserType(user?: User, obj?: any): "anon" | "auth" | "owner" | "admin
     return "auth";
   }
   return "anon";
-}
+};
 
-export function AdminOwnerTransformer<T>(options: {
-  // TODO: do something with KeyOf here.
+export const AdminOwnerTransformer = <T>(options: {
   anonReadFields?: string[];
   authReadFields?: string[];
   ownerReadFields?: string[];
@@ -38,20 +40,20 @@ export function AdminOwnerTransformer<T>(options: {
   authWriteFields?: string[];
   ownerWriteFields?: string[];
   adminWriteFields?: string[];
-}): TerrenoTransformer<T> {
-  function pickFields(obj: Partial<T>, fields: any[]): Partial<T> {
+}): TerrenoTransformer<T> => {
+  const pickFields = (obj: Partial<T>, fields: string[]): Partial<T> => {
     const newData: Partial<T> = {};
     for (const field of fields) {
-      if (obj[field] !== undefined) {
-        newData[field] = obj[field];
+      if ((obj as Record<string, unknown>)[field] !== undefined) {
+        (newData as Record<string, unknown>)[field] = (obj as Record<string, unknown>)[field];
       }
     }
     return newData;
-  }
+  };
 
   return {
     serialize: (obj: T, user?: User) => {
-      const userType = getUserType(user, obj);
+      const userType = getUserType(user, obj as Record<string, unknown>);
       if (userType === "admin") {
         return pickFields(obj, [...(options.adminReadFields ?? []), "id"]);
       }
@@ -63,10 +65,9 @@ export function AdminOwnerTransformer<T>(options: {
       }
       return pickFields(obj, [...(options.anonReadFields ?? []), "id"]);
     },
-    // TODO: Migrate AdminOwnerTransform to use pre-hooks.
     transform: (obj: Partial<T>, _method: "create" | "update", user?: User) => {
-      const userType = getUserType(user, obj);
-      let allowedFields: any;
+      const userType = getUserType(user, obj as Record<string, unknown>);
+      let allowedFields: string[];
       if (userType === "admin") {
         allowedFields = options.adminWriteFields ?? [];
       } else if (userType === "owner") {
@@ -78,21 +79,22 @@ export function AdminOwnerTransformer<T>(options: {
       }
       const unallowedFields = Object.keys(obj).filter((k) => !allowedFields.includes(k));
       if (unallowedFields.length) {
-        throw new Error(
-          `User of type ${userType} cannot write fields: ${unallowedFields.join(", ")}`
-        );
+        throw new APIError({
+          status: 403,
+          title: `User of type ${userType} cannot write fields: ${unallowedFields.join(", ")}`,
+        });
       }
       return obj;
     },
   };
-}
+};
 
-export function transform<T>(
+export const transform = <T>(
   options: ModelRouterOptions<T>,
   data: Partial<T> | Partial<T>[],
   method: "create" | "update",
   user?: User
-) {
+) => {
   if (!options.transformer?.transform) {
     return data;
   }
@@ -108,16 +110,16 @@ export function transform<T>(
     return transformFn(data, method, user);
   }
   return data.map((d) => transformFn(d, method, user));
-}
+};
 
-export function serialize<T>(
+export const serialize = <T>(
   req: express.Request,
   options: ModelRouterOptions<T>,
-  data: (Document<any, any, any> & T) | (Document<any, any, any> & T)[]
-) {
-  const serializeFn = (serializeData: Document<any, any, any> & T, serializeUser?: User) => {
+  data: (Document & T) | (Document & T)[]
+) => {
+  const serializeFn = (serializeData: Document & T, serializeUser?: User) => {
     const dataObject = serializeData.toObject() as T;
-    (dataObject as any).id = serializeData._id;
+    (dataObject as Record<string, unknown>).id = serializeData._id;
 
     // Search for any value that is a Map and transform it to a plain object.
     // Otherwise Express drops the contents.
@@ -143,18 +145,18 @@ export function serialize<T>(
     return serializeFn(data, req.user);
   }
   return data.map((d) => serializeFn(d, req.user));
-}
+};
 
 /**
  * Default response handler for modelRouter. Calls toObject on each doc and returns the result,
  * using transformers.serializer if provided.
  */
-export async function defaultResponseHandler<T>(
-  doc: (Document<any, any, any> & T) | (Document<any, any, any> & T)[] | null,
+export const defaultResponseHandler = async <T>(
+  doc: (Document & T) | (Document & T)[] | null,
   method: "list" | "create" | "read" | "update",
   request: express.Request,
   options: ModelRouterOptions<T>
-) {
+) => {
   if (!doc) {
     return null;
   }
@@ -168,4 +170,4 @@ export async function defaultResponseHandler<T>(
       title: `Error serializing ${method} response: ${errorObj.message}`,
     });
   }
-}
+};