@terreno/api 0.13.2 → 0.14.0

package/dist/openApiValidator.test.js

@@ -72,6 +72,7 @@ var __spreadArray = (this && this.__spreadArray) || function (to, from, pack) {
     return to.concat(ar || Array.prototype.slice.call(from));
 };
 Object.defineProperty(exports, "__esModule", { value: true });
+// biome-ignore-all lint/suspicious/noExplicitAny: test mock typing
 var bun_test_1 = require("bun:test");
 var api_1 = require("./api");
 var auth_1 = require("./auth");
@@ -262,6 +263,70 @@ var setupFreshApp = function () { return __awaiter(void 0, void 0, void 0, funct
             });
         }); });
     });
+    (0, bun_test_1.describe)("per-route validation: object-form options", function () {
+        (0, bun_test_1.it)("applies object validation options with per-operation control", function () { return __awaiter(void 0, void 0, void 0, function () {
+            var removedProps, errorsCaught, freshApp, admin, res;
+            return __generator(this, function (_a) {
+                switch (_a.label) {
+                    case 0:
+                        (0, openApiValidator_1.configureOpenApiValidator)({ removeAdditional: true });
+                        removedProps = [];
+                        errorsCaught = [];
+                        return [4 /*yield*/, setupFreshApp()];
+                    case 1:
+                        freshApp = _a.sent();
+                        freshApp.use("/required", (0, api_1.modelRouter)(tests_1.RequiredModel, __assign(__assign({}, requiredRouterOptions), { validation: {
+                                excludeFromCreate: ["about"],
+                                onAdditionalPropertiesRemoved: function (props) {
+                                    removedProps.push.apply(removedProps, __spreadArray([], __read(props), false));
+                                },
+                                onError: function (errors) {
+                                    errorsCaught.push(errors);
+                                },
+                                validateCreate: true,
+                                validateQuery: true,
+                                validateUpdate: true,
+                            } })));
+                        return [4 /*yield*/, (0, tests_1.authAsUser)(freshApp, "admin")];
+                    case 2:
+                        admin = _a.sent();
+                        return [4 /*yield*/, admin.post("/required").send({ name: "Validated" }).expect(201)];
+                    case 3:
+                        res = _a.sent();
+                        (0, bun_test_1.expect)(res.body.data.name).toBe("Validated");
+                        return [2 /*return*/];
+                }
+            });
+        }); });
+        (0, bun_test_1.it)("disables create validation when validateCreate is false", function () { return __awaiter(void 0, void 0, void 0, function () {
+            var freshApp, admin, res;
+            return __generator(this, function (_a) {
+                switch (_a.label) {
+                    case 0:
+                        (0, openApiValidator_1.configureOpenApiValidator)({ removeAdditional: true });
+                        return [4 /*yield*/, setupFreshApp()];
+                    case 1:
+                        freshApp = _a.sent();
+                        freshApp.use("/required", (0, api_1.modelRouter)(tests_1.RequiredModel, __assign(__assign({}, requiredRouterOptions), { validation: {
+                                excludeFromUpdate: ["about"],
+                                validateCreate: false,
+                                validateUpdate: true,
+                            } })));
+                        return [4 /*yield*/, (0, tests_1.authAsUser)(freshApp, "admin")];
+                    case 2:
+                        admin = _a.sent();
+                        return [4 /*yield*/, admin
+                                .post("/required")
+                                .send({ extraField: "ignored", name: "NoCreateValidation" })
+                                .expect(201)];
+                    case 3:
+                        res = _a.sent();
+                        (0, bun_test_1.expect)(res.body.data.name).toBe("NoCreateValidation");
+                        return [2 /*return*/];
+                }
+            });
+        }); });
+    });
     (0, bun_test_1.describe)("sanitization of non-standard mongoose-to-swagger types", function () {
         (0, bun_test_1.it)("validates models with ObjectId and DateOnly fields after sanitization", function () { return __awaiter(void 0, void 0, void 0, function () {
             var freshApp, admin, res;

package/dist/permissions.d.ts

@@ -19,8 +19,8 @@ export declare const Permissions: {
     IsAny: () => boolean;
     IsAuthenticated: (_method: RESTMethod, user?: User) => boolean;
     IsAuthenticatedOrReadOnly: (method: RESTMethod, user?: User) => boolean;
-    IsOwner: (_method: RESTMethod, user?: User, obj?: any) => any;
-    IsOwnerOrReadOnly: (method: RESTMethod, user?: User, obj?: any) => boolean;
+    IsOwner: (_method: RESTMethod, user?: User, obj?: unknown) => boolean;
+    IsOwnerOrReadOnly: (method: RESTMethod, user?: User, obj?: unknown) => boolean;
 };
-export declare function checkPermissions<T>(method: RESTMethod, permissions: PermissionMethod<T>[], user?: User, obj?: T): Promise<boolean>;
-export declare function permissionMiddleware<T>(model: Model<T>, options: Pick<ModelRouterOptions<T>, "permissions" | "populatePaths">): (req: express.Request, _res: express.Response, next: NextFunction) => Promise<void>;
+export declare const checkPermissions: <T>(method: RESTMethod, permissions: PermissionMethod<T>[], user?: User, obj?: T) => Promise<boolean>;
+export declare const permissionMiddleware: <T>(model: Model<T>, options: Pick<ModelRouterOptions<T>, "permissions" | "populatePaths">) => (req: express.Request, _res: express.Response, next: NextFunction) => Promise<void>;

package/dist/permissions.js

@@ -83,10 +83,7 @@ var __importDefault = (this && this.__importDefault) || function (mod) {
     return (mod && mod.__esModule) ? mod : { "default": mod };
 };
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.Permissions = exports.OwnerQueryFilter = void 0;
-exports.checkPermissions = checkPermissions;
-exports.permissionMiddleware = permissionMiddleware;
-// Defaults closed
+exports.permissionMiddleware = exports.checkPermissions = exports.Permissions = exports.OwnerQueryFilter = void 0;
 var Sentry = __importStar(require("@sentry/bun"));
 var mongoose_1 = __importDefault(require("mongoose"));
 var api_1 = require("./api");
@@ -96,7 +93,6 @@ var OwnerQueryFilter = function (user) {
     if (user) {
         return { ownerId: user === null || user === void 0 ? void 0 : user.id };
     }
-    // Return a null, so we know to return no results.
     return null;
 };
 exports.OwnerQueryFilter = OwnerQueryFilter;
@@ -131,8 +127,10 @@ exports.Permissions = {
         if (user === null || user === void 0 ? void 0 : user.admin) {
             return true;
         }
-        var ownerId = ((_a = obj === null || obj === void 0 ? void 0 : obj.ownerId) === null || _a === void 0 ? void 0 : _a._id) || (obj === null || obj === void 0 ? void 0 : obj.ownerId);
-        return (user === null || user === void 0 ? void 0 : user.id) && ownerId && String(ownerId) === String(user === null || user === void 0 ? void 0 : user.id);
+        var withOwner = obj;
+        var ownerObj = withOwner.ownerId;
+        var ownerId = (_a = ownerObj === null || ownerObj === void 0 ? void 0 : ownerObj._id) !== null && _a !== void 0 ? _a : withOwner.ownerId;
+        return Boolean((user === null || user === void 0 ? void 0 : user.id) && ownerId && String(ownerId) === String(user === null || user === void 0 ? void 0 : user.id));
     },
     IsOwnerOrReadOnly: function (method, user, obj) {
         // When checking if we can possibly perform the action, return true.
@@ -142,61 +140,59 @@ exports.Permissions = {
         if (user === null || user === void 0 ? void 0 : user.admin) {
             return true;
         }
-        if ((user === null || user === void 0 ? void 0 : user.id) && (obj === null || obj === void 0 ? void 0 : obj.ownerId) && String(obj === null || obj === void 0 ? void 0 : obj.ownerId) === String(user === null || user === void 0 ? void 0 : user.id)) {
+        var withOwner = obj;
+        if ((user === null || user === void 0 ? void 0 : user.id) && withOwner.ownerId && String(withOwner.ownerId) === String(user === null || user === void 0 ? void 0 : user.id)) {
             return true;
         }
         return method === "list" || method === "read";
     },
 };
-function checkPermissions(method, permissions, user, obj) {
-    return __awaiter(this, void 0, void 0, function () {
-        var anyTrue, permissions_1, permissions_1_1, perm, e_1_1;
-        var e_1, _a;
-        return __generator(this, function (_b) {
-            switch (_b.label) {
-                case 0:
-                    anyTrue = false;
-                    _b.label = 1;
-                case 1:
-                    _b.trys.push([1, 6, 7, 8]);
-                    permissions_1 = __values(permissions), permissions_1_1 = permissions_1.next();
-                    _b.label = 2;
-                case 2:
-                    if (!!permissions_1_1.done) return [3 /*break*/, 5];
-                    perm = permissions_1_1.value;
-                    return [4 /*yield*/, perm(method, user, obj)];
-                case 3:
-                    // May or may not be a promise.
-                    if (!(_b.sent())) {
-                        return [2 /*return*/, false];
-                    }
-                    anyTrue = true;
-                    _b.label = 4;
-                case 4:
-                    permissions_1_1 = permissions_1.next();
-                    return [3 /*break*/, 2];
-                case 5: return [3 /*break*/, 8];
-                case 6:
-                    e_1_1 = _b.sent();
-                    e_1 = { error: e_1_1 };
-                    return [3 /*break*/, 8];
-                case 7:
-                    try {
-                        if (permissions_1_1 && !permissions_1_1.done && (_a = permissions_1.return)) _a.call(permissions_1);
-                    }
-                    finally { if (e_1) throw e_1.error; }
-                    return [7 /*endfinally*/];
-                case 8: return [2 /*return*/, anyTrue];
-            }
-        });
+var checkPermissions = function (method, permissions, user, obj) { return __awaiter(void 0, void 0, void 0, function () {
+    var anyTrue, permissions_1, permissions_1_1, perm, e_1_1;
+    var e_1, _a;
+    return __generator(this, function (_b) {
+        switch (_b.label) {
+            case 0:
+                anyTrue = false;
+                _b.label = 1;
+            case 1:
+                _b.trys.push([1, 6, 7, 8]);
+                permissions_1 = __values(permissions), permissions_1_1 = permissions_1.next();
+                _b.label = 2;
+            case 2:
+                if (!!permissions_1_1.done) return [3 /*break*/, 5];
+                perm = permissions_1_1.value;
+                return [4 /*yield*/, perm(method, user, obj)];
+            case 3:
+                if (!(_b.sent())) {
+                    return [2 /*return*/, false];
+                }
+                anyTrue = true;
+                _b.label = 4;
+            case 4:
+                permissions_1_1 = permissions_1.next();
+                return [3 /*break*/, 2];
+            case 5: return [3 /*break*/, 8];
+            case 6:
+                e_1_1 = _b.sent();
+                e_1 = { error: e_1_1 };
+                return [3 /*break*/, 8];
+            case 7:
+                try {
+                    if (permissions_1_1 && !permissions_1_1.done && (_a = permissions_1.return)) _a.call(permissions_1);
+                }
+                finally { if (e_1) throw e_1.error; }
+                return [7 /*endfinally*/];
+            case 8: return [2 /*return*/, anyTrue];
+        }
     });
-}
+}); };
+exports.checkPermissions = checkPermissions;
 // Check the permissions for a given model and method. If the method is a read, update, or delete,
 // finds the relevant object, checks the permissions, and attaches the object to the request as
 // req.obj.
-function permissionMiddleware(model, options) {
-    var _this = this;
-    return function (req, _res, next) { return __awaiter(_this, void 0, void 0, function () {
+var permissionMiddleware = function (model, options) {
+    return function (req, _res, next) { return __awaiter(void 0, void 0, void 0, function () {
         var method, reqMethod, builtQuery, populatedQuery, data, error_1, hiddenDoc, error, reason, error, error_2;
         var _a, _b;
         return __generator(this, function (_c) {
@@ -233,7 +229,7 @@ function permissionMiddleware(model, options) {
                             title: "Method ".concat(req.method, " not allowed"),
                         });
                     }
-                    return [4 /*yield*/, checkPermissions(method, options.permissions[method], req.user)];
+                    return [4 /*yield*/, (0, exports.checkPermissions)(method, options.permissions[method], req.user)];
                 case 2:
                     // All methods check for permissions.
                     if (!(_c.sent())) {
@@ -247,14 +243,16 @@ function permissionMiddleware(model, options) {
                         return [2 /*return*/, next()];
                     }
                     builtQuery = model.findById(req.params.id);
-                    populatedQuery = (0, api_1.addPopulateToQuery)(builtQuery, options.populatePaths);
+                    populatedQuery = (0, api_1.addPopulateToQuery)(
+                    // biome-ignore lint/suspicious/noExplicitAny: Query types vary based on populate paths
+                    builtQuery, options.populatePaths);
                     data = void 0;
                     _c.label = 3;
                 case 3:
                     _c.trys.push([3, 5, , 6]);
                     return [4 /*yield*/, populatedQuery.exec()];
                 case 4:
-                    data = _c.sent();
+                    data = (_c.sent());
                     return [3 /*break*/, 6];
                 case 5:
                     error_1 = _c.sent();
@@ -279,13 +277,16 @@ function permissionMiddleware(model, options) {
                         error.meta = undefined;
                         throw error;
                     }
-                    reason = hiddenDoc.deleted
-                        ? { deleted: "true" }
-                        : hiddenDoc.disabled
-                            ? { disabled: "true" }
-                            : hiddenDoc.archived
-                                ? { archived: "true" }
-                                : null;
+                    reason = null;
+                    if (hiddenDoc.deleted) {
+                        reason = { deleted: "true" };
+                    }
+                    else if (hiddenDoc.disabled) {
+                        reason = { disabled: "true" };
+                    }
+                    else if (hiddenDoc.archived) {
+                        reason = { archived: "true" };
+                    }
                     // If no reason found, treat as not found
                     if (!reason) {
                         error = new errors_1.APIError({
@@ -302,7 +303,7 @@ function permissionMiddleware(model, options) {
                         status: 404,
                         title: "Document ".concat(req.params.id, " not found for model ").concat(model.modelName),
                     });
-                case 8: return [4 /*yield*/, checkPermissions(method, options.permissions[method], req.user, data)];
+                case 8: return [4 /*yield*/, (0, exports.checkPermissions)(method, options.permissions[method], req.user, data)];
                 case 9:
                     if (!(_c.sent())) {
                         throw new errors_1.APIError({
@@ -320,4 +321,5 @@ function permissionMiddleware(model, options) {
             }
         });
     }); };
-}
+};
+exports.permissionMiddleware = permissionMiddleware;

package/dist/permissions.middleware.test.js

@@ -96,6 +96,7 @@ var __read = (this && this.__read) || function (o, n) {
     return ar;
 };
 Object.defineProperty(exports, "__esModule", { value: true });
+// biome-ignore-all lint/suspicious/noExplicitAny: test mock typing
 var bun_test_1 = require("bun:test");
 var Sentry = __importStar(require("@sentry/bun"));
 var errors_1 = require("./errors");

package/dist/permissions.test.js

@@ -55,6 +55,7 @@ var __importDefault = (this && this.__importDefault) || function (mod) {
     return (mod && mod.__esModule) ? mod : { "default": mod };
 };
 Object.defineProperty(exports, "__esModule", { value: true });
+// biome-ignore-all lint/suspicious/noExplicitAny: test mock typing
 var bun_test_1 = require("bun:test");
 var supertest_1 = __importDefault(require("supertest"));
 var api_1 = require("./api");

package/dist/plugins.d.ts

@@ -60,19 +60,19 @@ export declare const findExactlyOne: <T>(schema: Schema<T>) => void;
 export declare const upsertPlugin: <T>(schema: Schema<any, any, any, any>) => void;
 /** For models with the upsertPlugin, extend this interface to add the upsert static method. */
 export interface HasUpsert<T> {
-    upsert(conditions: Record<string, any>, update: Record<string, any>): Promise<T>;
+    upsert(conditions: Record<string, unknown>, update: Record<string, unknown>): Promise<T>;
 }
 export interface FindOneOrNonePlugin<T> {
-    findOneOrNone(query: Record<string, any>, errorArgs?: Partial<APIErrorConstructor>): Promise<(Document & T) | null>;
+    findOneOrNone(query: Record<string, unknown>, errorArgs?: Partial<APIErrorConstructor>): Promise<(Document & T) | null>;
 }
 export interface FindExactlyOnePlugin<T> {
-    findExactlyOne(query: Record<string, any>, errorArgs?: Partial<APIErrorConstructor>): Promise<Document & T>;
+    findExactlyOne(query: Record<string, unknown>, errorArgs?: Partial<APIErrorConstructor>): Promise<Document & T>;
 }
 export declare class DateOnly extends SchemaType {
     constructor(key: string, options: SchemaTypeOptions<Date>);
-    handleSingle(val: any): Date | undefined;
+    handleSingle(val: unknown): Date | undefined;
     $conditionalHandlers: any;
-    castForQuery($conditional: any, val: any, context: any): Date | undefined;
+    castForQuery($conditional: string | undefined, val: unknown, context: unknown): Date | undefined;
     cast(val: unknown): Date | undefined;
     get(val: unknown): this;
 }

package/dist/plugins.js

@@ -99,6 +99,7 @@ exports.DateOnly = exports.upsertPlugin = exports.findExactlyOne = exports.findO
 var luxon_1 = require("luxon");
 var mongoose_1 = __importStar(require("mongoose"));
 var errors_1 = require("./errors");
+// biome-ignore lint/suspicious/noExplicitAny: Schema generics must be loose to accept arbitrary consumer schemas
 var baseUserPlugin = function (schema) {
     schema.add({
         admin: { default: false, description: "Whether the user has admin privileges", type: Boolean },
@@ -106,6 +107,7 @@ var baseUserPlugin = function (schema) {
     schema.add({ email: { description: "The user's email address", index: true, type: String } });
 };
 exports.baseUserPlugin = baseUserPlugin;
+// biome-ignore lint/suspicious/noExplicitAny: Schema generics must be loose to accept arbitrary consumer schemas
 var isDeletedPlugin = function (schema, defaultValue) {
     if (defaultValue === void 0) { defaultValue = false; }
     schema.add({
@@ -117,6 +119,7 @@ var isDeletedPlugin = function (schema, defaultValue) {
             type: Boolean,
         },
     });
+    // biome-ignore lint/suspicious/noExplicitAny: Query<any, any> must be loose to accept arbitrary consumer queries
     var applyDeleteFilter = function (q) {
         var query = q.getQuery();
         if (query && query.deleted === undefined) {
@@ -131,7 +134,9 @@ var isDeletedPlugin = function (schema, defaultValue) {
     });
 };
 exports.isDeletedPlugin = isDeletedPlugin;
-var isDisabledPlugin = function (schema, defaultValue) {
+var isDisabledPlugin = function (
+// biome-ignore lint/suspicious/noExplicitAny: Schema generics must be loose to accept arbitrary consumer schemas
+schema, defaultValue) {
     if (defaultValue === void 0) { defaultValue = false; }
     schema.add({
         disabled: {
@@ -143,6 +148,7 @@ var isDisabledPlugin = function (schema, defaultValue) {
     });
 };
 exports.isDisabledPlugin = isDisabledPlugin;
+// biome-ignore lint/suspicious/noExplicitAny: Schema generics must be loose to accept arbitrary consumer schemas
 var createdUpdatedPlugin = function (schema) {
     schema.add({
         updated: { description: "When this document was last updated", index: true, type: Date },
@@ -268,6 +274,7 @@ exports.findExactlyOne = findExactlyOne;
  * match the conditions to prevent ambiguous updates.
  * @param schema Mongoose Schema
  */
+// biome-ignore lint/suspicious/noExplicitAny: Schema generics with unknown collide with mongoose's loose this-binding on schema.statics
 var upsertPlugin = function (schema) {
     schema.statics.upsert = function (conditions, update) {
         return __awaiter(this, void 0, void 0, function () {
@@ -285,14 +292,16 @@ var upsertPlugin = function (schema) {
                             });
                         }
                         doc = docs[0];
-                        if (doc) {
-                            // If the document exists, update it with the provided update values.
-                            Object.assign(doc, update);
-                            return [2 /*return*/, doc.save()];
-                        }
+                        if (!doc) return [3 /*break*/, 3];
+                        // If the document exists, update it with the provided update values.
+                        Object.assign(doc, update);
+                        return [4 /*yield*/, doc.save()];
+                    case 2: return [2 /*return*/, (_a.sent())];
+                    case 3:
                         combinedData = __assign(__assign({}, conditions), update);
                         newDoc = new this(combinedData);
-                        return [2 /*return*/, newDoc.save()];
+                        return [4 /*yield*/, newDoc.save()];
+                    case 4: return [2 /*return*/, (_a.sent())];
                 }
             });
         });
@@ -313,7 +322,7 @@ var DateOnly = /** @class */ (function (_super) {
     // When using $gt, $gte, $lt, $lte, etc, we need to cast the value to a Date
     DateOnly.prototype.castForQuery = function ($conditional, val, context) {
         if ($conditional == null) {
-            // noExplicitAny: applySetters is an internal Mongoose SchemaType method not in public type definitions
+            // biome-ignore lint/suspicious/noExplicitAny: applySetters is an internal Mongoose SchemaType method not in public type definitions
             return this.applySetters(val, context);
         }
         var handler = this.$conditionalHandlers[$conditional];
@@ -354,5 +363,5 @@ var DateOnly = /** @class */ (function (_super) {
 }(mongoose_1.SchemaType));
 exports.DateOnly = DateOnly;
 // Register DateOnly with Mongoose's Schema.Types
-// noExplicitAny: DateOnly is a custom SchemaType not declared in Mongoose's Schema.Types interface
+// biome-ignore lint/suspicious/noExplicitAny: DateOnly is a custom SchemaType not declared in Mongoose's Schema.Types interface
 mongoose_1.default.Schema.Types.DateOnly = DateOnly;

package/dist/plugins.test.js

@@ -55,6 +55,7 @@ var __importDefault = (this && this.__importDefault) || function (mod) {
     return (mod && mod.__esModule) ? mod : { "default": mod };
 };
 Object.defineProperty(exports, "__esModule", { value: true });
+// biome-ignore-all lint/suspicious/noExplicitAny: test mock typing
 var bun_test_1 = require("bun:test");
 var mongoose_1 = require("mongoose");
 var supertest_1 = __importDefault(require("supertest"));
@@ -77,7 +78,6 @@ var StuffModel = (0, mongoose_1.model)("Stuff", stuffSchema);
 (0, bun_test_1.describe)("baseUserPlugin", function () {
     (0, bun_test_1.it)("adds admin and email fields to the schema", function () {
         var testSchema = new mongoose_1.Schema({});
-        // biome-ignore lint/suspicious/noExplicitAny: test schema
         (0, plugins_1.baseUserPlugin)(testSchema);
         var adminPath = testSchema.path("admin");
         (0, bun_test_1.expect)(adminPath).toBeDefined();

package/dist/populate.d.ts

@@ -1,15 +1,22 @@
-import type { Document } from "mongoose";
-export type PopulatePath = {
+import type { Document, Schema } from "mongoose";
+interface OpenApiSchemaNode {
+    description?: string;
+    items?: OpenApiSchemaNode;
+    properties?: Record<string, OpenApiSchemaNode>;
+    type?: string;
+}
+export interface PopulatePath {
     path: string;
-    openApiComponent?: any;
+    openApiComponent?: string;
     fields?: string[];
-};
-export declare const fixMixedFields: (schema: any, properties: Record<string, any>) => void;
-export declare function getOpenApiSpecForModel(model: any, { populatePaths, extraModelProperties, }?: {
+}
+export declare const fixMixedFields: (schema: Schema | null, properties: Record<string, OpenApiSchemaNode> | Record<string, unknown> | null) => void;
+export declare const getOpenApiSpecForModel: (model: any, { populatePaths, extraModelProperties, }?: {
     populatePaths?: PopulatePath[];
     extraModelProperties?: Record<string, unknown>;
-}): {
+}) => {
     properties: Record<string, unknown>;
     required: string[];
 };
-export declare function unpopulate<T>(doc: Document<T>, path: string): Document<T>;
+export declare const unpopulate: <T>(doc: Document<T>, path: string) => Document<T>;
+export {};

package/dist/populate.js

@@ -50,19 +50,14 @@ var __importDefault = (this && this.__importDefault) || function (mod) {
     return (mod && mod.__esModule) ? mod : { "default": mod };
 };
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.fixMixedFields = void 0;
-exports.getOpenApiSpecForModel = getOpenApiSpecForModel;
-exports.unpopulate = unpopulate;
+exports.unpopulate = exports.getOpenApiSpecForModel = exports.fixMixedFields = void 0;
 var isArray_1 = __importDefault(require("lodash/isArray"));
 var mongoose_to_swagger_1 = __importDefault(require("mongoose-to-swagger"));
 var errors_1 = require("./errors");
 var m2sOptions = {
     props: ["readOnly", "required", "enum", "default"],
 };
-// This function filters an object to only include specified keys.
-// It supports nested keys using dot notation (e.g., 'user.name').
-// If no keys are provided, it returns the original object.
-// The function recursively traverses the object structure to handle nested properties.
+// Keeps only the specified dot-notation keys from an object.
 var filterKeys = function (obj, keysToKeep) {
     if (!keysToKeep) {
         return obj;
@@ -98,7 +93,7 @@ var filterKeys = function (obj, keysToKeep) {
 };
 // Helper function to get the path in the OpenAPI schema, so we can swap out the type for the
 // populated model component or generated type.
-function getPathInSchema(schema, path) {
+var getPathInSchema = function (schema, path) {
     var _a;
     var keys = path.split(".");
     var currentSchema = schema;
@@ -119,23 +114,21 @@ function getPathInSchema(schema, path) {
             break;
         }
         else {
-            throw new Error("Path ".concat(path, " not found in schema at key ").concat(key));
+            throw new errors_1.APIError({ status: 500, title: "Path ".concat(path, " not found in schema at key ").concat(key) });
         }
     }
     return fullPath;
-}
-// Replaces populated properties with the populated schema.
-// Recursively walks a Mongoose schema and fixes any Mixed fields in the
-// OpenAPI properties so they use an empty schema (accepts any type) instead
-// of the `{type: "object", properties: {}}` that mongoose-to-swagger emits.
+};
+// Corrects Mixed-type fields in OpenAPI properties so they accept any value.
 var fixMixedFields = function (schema, properties) {
     var e_1, _a;
     var _b, _c, _d;
     if (!properties || !schema) {
         return;
     }
+    var props = properties;
     try {
-        for (var _e = __values(Object.keys(properties)), _f = _e.next(); !_f.done; _f = _e.next()) {
+        for (var _e = __values(Object.keys(props)), _f = _e.next(); !_f.done; _f = _e.next()) {
             var key = _f.value;
             var schemaPath = schema.path(key);
             if (!schemaPath) {
@@ -143,14 +136,15 @@ var fixMixedFields = function (schema, properties) {
             }
             // Direct Mixed field
             if (schemaPath.instance === "Mixed") {
-                properties[key] = { description: (_b = properties[key]) === null || _b === void 0 ? void 0 : _b.description };
+                props[key] = { description: (_b = props[key]) === null || _b === void 0 ? void 0 : _b.description };
                 continue;
             }
             // Array of sub-documents — check each sub-field for Mixed
-            if (schemaPath.instance === "Array" &&
-                schemaPath.schema &&
-                ((_d = (_c = properties[key]) === null || _c === void 0 ? void 0 : _c.items) === null || _d === void 0 ? void 0 : _d.properties)) {
-                (0, exports.fixMixedFields)(schemaPath.schema, properties[key].items.properties);
+            if (schemaPath.instance === "Array" && schemaPath.schema) {
+                var itemProperties = (_d = (_c = props[key]) === null || _c === void 0 ? void 0 : _c.items) === null || _d === void 0 ? void 0 : _d.properties;
+                if (itemProperties) {
+                    (0, exports.fixMixedFields)(schemaPath.schema, itemProperties);
+                }
             }
         }
     }
@@ -163,7 +157,9 @@ var fixMixedFields = function (schema, properties) {
     }
 };
 exports.fixMixedFields = fixMixedFields;
-function getOpenApiSpecForModel(model, _a) {
+var getOpenApiSpecForModel = function (
+// biome-ignore lint/suspicious/noExplicitAny: noExplicitAny: Mongoose Model param uses deep internal APIs (schema.path().options.ref, schema.virtuals, schema.childSchemas, db.model) that are not exposed in public type definitions
+model, _a) {
     var e_2, _b, _c, e_3, _d, e_4, _e, e_5, _f;
     var _g, _h, _j, _k;
     var _l = _a === void 0 ? {} : _a, populatePaths = _l.populatePaths, extraModelProperties = _l.extraModelProperties;
@@ -296,17 +292,19 @@ function getOpenApiSpecForModel(model, _a) {
         properties: __assign(__assign({}, modelSwagger.properties), extraModelProperties),
         required: (_k = modelSwagger.required) !== null && _k !== void 0 ? _k : [],
     };
-}
+};
+exports.getOpenApiSpecForModel = getOpenApiSpecForModel;
 // Helper function to unpopulate a document that has been populated.
 // This is helpful for supporting backwards compatibility. E.g. you use populatePaths
 // to populate a document but if the version header for the request is below the version
 // that the populatePath was added, we remove the population and just return the _id.
-function unpopulate(doc, path) {
+var unpopulate = function (doc, path) {
     if (!path) {
         throw new errors_1.APIError({ status: 500, title: "path is required for unpopulate" });
     }
     var pathParts = path.split(".");
     // Recursive because we need to support nested paths.
+    // biome-ignore lint/suspicious/noExplicitAny: noExplicitAny: recursive document traversal uses bracket-notation indexing on arbitrary nested document shapes that Mongoose Document types do not expose
     var recursiveUnpopulate = function (current, parts) {
         var e_6, _a;
         var _b;
@@ -352,4 +350,5 @@ function unpopulate(doc, path) {
         return current;
     };
     return recursiveUnpopulate(doc, pathParts);
-}
+};
+exports.unpopulate = unpopulate;

package/dist/populate.test.js

@@ -85,6 +85,7 @@ var __read = (this && this.__read) || function (o, n) {
     return ar;
 };
 Object.defineProperty(exports, "__esModule", { value: true });
+// biome-ignore-all lint/suspicious/noExplicitAny: test mock typing
 var bun_test_1 = require("bun:test");
 var mongoose_1 = __importStar(require("mongoose"));
 var populate_1 = require("./populate");