@terreno/api 0.18.0 → 0.20.0

package/CHANGELOG.md

@@ -1,5 +1,30 @@
 # Changelog
 
+## 0.20.0
+
+### Changed (breaking)
+
+- **`ConfigurationApp` `POST {basePath}/list-secrets` no longer persists secret values.** Previously it resolved secrets from the provider and wrote the resolved plaintext values into the configuration document. It is now a **read-only validation/status** endpoint: it reports, per secret field, only non-sensitive metadata (`path`, `secretName`, `version`, and a boolean `resolvable`/`isConfigured`) and never writes to the document or returns secret values. A `POST {basePath}/validate-secrets` alias with the same behavior is also registered.
+- **`ConfigurationApp` `PATCH {basePath}` strips `secret: true` fields** from the incoming body, so a secret value can never be written through the update path. Secret fields are read-only via this surface.
+- **`configurationPlugin` no longer adds the `_singleton` unique index by default.** It is now opt-in via `enforceSingletonIndex: true` so it does not double-enforce or conflict with consumers that already guarantee a single non-deleted document via the pre-save guard or their own soft-delete plugin/indexes.
+- **`configurationPlugin` singleton semantics are now soft-delete aware.** `getConfig`, `updateConfig`, and the pre-save guard operate on `{deleted: false}` when the schema has a `deleted` path (e.g. via `isDeletedPlugin`). A soft-deleted document no longer blocks creating a new singleton; hard deletes (`deleteOne`/`deleteMany`/`findOneAndDelete`) remain blocked.
+- **`configurationPlugin.updateConfig` now applies updates via `findOneAndUpdate({$set})` with dotted paths** instead of `Object.assign` + `doc.save()`. This preserves sibling fields inside nested subdocuments on partial patches and tolerates legacy/out-of-schema fields already persisted under `strict: "throw"`.
+
+### Added
+
+- **`SecretProvider.getSecret(secretName, version?)`** — optional `version` parameter. `GcpSecretProvider` resolves `projects/{projectId}/secrets/{name}/versions/{version}` (default `latest`, full resource paths still honored); `EnvSecretProvider` ignores it. Secret fields can declare a `secretVersion` schema option, surfaced on `SecretFieldMeta.version` and passed through `resolveSecrets`.
+- **`CompositeSecretProvider`** — composes an ordered list of providers and returns the first non-null result; a failing provider is warn-logged (secret name only) and resolution falls through to the next.
+- **`CachingSecretProvider`** — wraps any provider with an in-memory TTL cache keyed by `secretName@version`, with `clear()` / `clearKey()` for rotation and tests. Caches `null` results. Never logs values.
+- **`ConfigurationApp` pluggable permissions** — `permissions: {read?, update?, meta?, listSecrets?}` accepts terreno permission functions (e.g. `[IsStaff]`), AND-combined like `modelRouter`. Defaults to admin-only for every route.
+- **`ConfigurationApp` lifecycle hooks** — `preUpdate(body, req)` (validate/normalize) and `postUpdate(config, prevValue, req)` (audit logging). Both payloads have secret values redacted.
+- **`flattenToDotPaths`** — exported helper used by `updateConfig`.
+
+### Migration
+
+- If you relied on `list-secrets` to populate secret values into the configuration document, stop. Resolve secrets on-demand at runtime via `Model.resolveSecrets(provider)` (returns an in-memory `Map`) and read them from memory; never persist them.
+- If you depended on the `_singleton` unique index, pass `configurationPlugin(schema, {enforceSingletonIndex: true})`.
+- For GCP-with-env-fallback and caching, compose `new CachingSecretProvider(new CompositeSecretProvider([gcp, env]), {ttlMs})`.
+
 ## 0.16.0
 
 ### Added

package/dist/api.test.js

@@ -2545,14 +2545,20 @@ var transformers_1 = require("./transformers");
             });
         }); });
         (0, bun_test_1.it)("returns 409 when precise conflict timestamp is older than doc.updated", function () { return __awaiter(void 0, void 0, void 0, function () {
+            var ifUnmodifiedSince;
             return __generator(this, function (_a) {
                 switch (_a.label) {
-                    case 0: return [4 /*yield*/, agent
-                            .patch("/food/".concat(spinach._id))
-                            .set("If-Unmodified-Since", luxon_1.DateTime.fromISO("2025-06-15T12:00:01.000Z").toHTTP())
-                            .set("X-Unmodified-Since-ISO", "2025-06-15T11:59:59.500Z")
-                            .send({ name: "Precise Stale" })
-                            .expect(409)];
+                    case 0:
+                        ifUnmodifiedSince = luxon_1.DateTime.fromISO("2025-06-15T12:00:01.000Z").toHTTP();
+                        if (ifUnmodifiedSince === null) {
+                            throw new Error("expected HTTP If-Unmodified-Since value");
+                        }
+                        return [4 /*yield*/, agent
+                                .patch("/food/".concat(spinach._id))
+                                .set("If-Unmodified-Since", ifUnmodifiedSince)
+                                .set("X-Unmodified-Since-ISO", "2025-06-15T11:59:59.500Z")
+                                .send({ name: "Precise Stale" })
+                                .expect(409)];
                     case 1:
                         _a.sent();
                         return [2 /*return*/];
@@ -2560,15 +2566,19 @@ var transformers_1 = require("./transformers");
             });
         }); });
         (0, bun_test_1.it)("falls back to doc.created when doc.updated is unavailable", function () { return __awaiter(void 0, void 0, void 0, function () {
-            var res;
+            var ifUnmodifiedSince, res;
             return __generator(this, function (_a) {
                 switch (_a.label) {
                     case 0: return [4 /*yield*/, tests_1.FoodModel.collection.updateOne({ _id: spinach._id }, { $unset: { updated: "" } })];
                     case 1:
                         _a.sent();
+                        ifUnmodifiedSince = luxon_1.DateTime.fromISO("2025-06-15T11:59:59.999Z").toHTTP();
+                        if (ifUnmodifiedSince === null) {
+                            throw new Error("expected HTTP If-Unmodified-Since value");
+                        }
                         return [4 /*yield*/, agent
                                 .patch("/food/".concat(spinach._id))
-                                .set("If-Unmodified-Since", luxon_1.DateTime.fromISO("2025-06-15T11:59:59.999Z").toHTTP())
+                                .set("If-Unmodified-Since", ifUnmodifiedSince)
                                 .send({ name: "Created Fallback" })
                                 .expect(409)];
                     case 2:

package/dist/auth.d.ts

@@ -22,8 +22,8 @@ export interface UserModel extends Model<User> {
 export interface GenerateTokensOptions {
     sessionId?: string;
 }
-export declare function authenticateMiddleware(anonymous?: boolean): (req: express.Request, res: express.Response, next: express.NextFunction) => any;
-export declare function signupUser(userModel: UserModel, email: string, password: string, body?: Record<string, unknown>): Promise<any>;
+export declare const authenticateMiddleware: (anonymous?: boolean) => (req: express.Request, res: express.Response, next: express.NextFunction) => any;
+export declare const signupUser: (userModel: UserModel, email: string, password: string, body?: Record<string, unknown>) => Promise<any>;
 /**
  * Generates both an access token (JWT) and a refresh token for a given user.
  *
@@ -50,6 +50,6 @@ export declare const generateTokens: (user: unknown, authOptions?: AuthOptions,
     sessionId: string;
     token: string;
 }>;
-export declare function setupAuth(app: express.Application, userModel: UserModel): void;
-export declare function addAuthRoutes(app: express.Application, userModel: UserModel, authOptions?: AuthOptions): void;
-export declare function addMeRoutes(app: express.Application, userModel: UserModel, _authOptions?: AuthOptions): void;
+export declare const setupAuth: (app: express.Application, userModel: UserModel) => void;
+export declare const addAuthRoutes: (app: express.Application, userModel: UserModel, authOptions?: AuthOptions) => void;
+export declare const addMeRoutes: (app: express.Application, userModel: UserModel, _authOptions?: AuthOptions) => void;

package/dist/auth.js

@@ -86,12 +86,7 @@ var __importDefault = (this && this.__importDefault) || function (mod) {
     return (mod && mod.__esModule) ? mod : { "default": mod };
 };
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.generateTokens = void 0;
-exports.authenticateMiddleware = authenticateMiddleware;
-exports.signupUser = signupUser;
-exports.setupAuth = setupAuth;
-exports.addAuthRoutes = addAuthRoutes;
-exports.addMeRoutes = addMeRoutes;
+exports.addMeRoutes = exports.addAuthRoutes = exports.setupAuth = exports.generateTokens = exports.signupUser = exports.authenticateMiddleware = void 0;
 var node_crypto_1 = require("node:crypto");
 var express_1 = __importDefault(require("express"));
 var jsonwebtoken_1 = __importDefault(require("jsonwebtoken"));
@@ -103,7 +98,7 @@ var passport_local_1 = require("passport-local");
 var errors_1 = require("./errors");
 var logger_1 = require("./logger");
 var requestContext_1 = require("./requestContext");
-function authenticateMiddleware(anonymous) {
+var authenticateMiddleware = function (anonymous) {
     if (anonymous === void 0) { anonymous = false; }
     var strategies = ["jwt"];
     if (anonymous) {
@@ -120,45 +115,45 @@ function authenticateMiddleware(anonymous) {
         }
         return passportAuth(req, res, next);
     };
-}
-function signupUser(userModel, email, password, body) {
-    return __awaiter(this, void 0, void 0, function () {
-        var _a, _email, _password, bodyRest, user, error_1, error_2, message;
-        return __generator(this, function (_b) {
-            switch (_b.label) {
-                case 0:
-                    _a = body !== null && body !== void 0 ? body : {}, _email = _a.email, _password = _a.password, bodyRest = __rest(_a, ["email", "password"]);
-                    _b.label = 1;
-                case 1:
-                    _b.trys.push([1, 8, , 9]);
-                    return [4 /*yield*/, userModel.register(__assign({ email: email }, bodyRest), password)];
-                case 2:
-                    user = _b.sent();
-                    if (!user.postCreate) return [3 /*break*/, 6];
-                    _b.label = 3;
-                case 3:
-                    _b.trys.push([3, 5, , 6]);
-                    return [4 /*yield*/, user.postCreate(bodyRest)];
-                case 4:
-                    _b.sent();
-                    return [3 /*break*/, 6];
-                case 5:
-                    error_1 = _b.sent();
-                    logger_1.logger.error("Error in user.postCreate: ".concat(error_1));
-                    throw error_1;
-                case 6: return [4 /*yield*/, user.save()];
-                case 7:
-                    _b.sent();
-                    return [2 /*return*/, user];
-                case 8:
-                    error_2 = _b.sent();
-                    message = (0, errors_1.errorMessage)(error_2);
-                    throw new errors_1.APIError({ title: message });
-                case 9: return [2 /*return*/];
-            }
-        });
+};
+exports.authenticateMiddleware = authenticateMiddleware;
+var signupUser = function (userModel, email, password, body) { return __awaiter(void 0, void 0, void 0, function () {
+    var _a, _email, _password, bodyRest, user, error_1, error_2, message;
+    return __generator(this, function (_b) {
+        switch (_b.label) {
+            case 0:
+                _a = body !== null && body !== void 0 ? body : {}, _email = _a.email, _password = _a.password, bodyRest = __rest(_a, ["email", "password"]);
+                _b.label = 1;
+            case 1:
+                _b.trys.push([1, 8, , 9]);
+                return [4 /*yield*/, userModel.register(__assign({ email: email }, bodyRest), password)];
+            case 2:
+                user = _b.sent();
+                if (!user.postCreate) return [3 /*break*/, 6];
+                _b.label = 3;
+            case 3:
+                _b.trys.push([3, 5, , 6]);
+                return [4 /*yield*/, user.postCreate(bodyRest)];
+            case 4:
+                _b.sent();
+                return [3 /*break*/, 6];
+            case 5:
+                error_1 = _b.sent();
+                logger_1.logger.error("Error in user.postCreate: ".concat(error_1));
+                throw error_1;
+            case 6: return [4 /*yield*/, user.save()];
+            case 7:
+                _b.sent();
+                return [2 /*return*/, user];
+            case 8:
+                error_2 = _b.sent();
+                message = (0, errors_1.errorMessage)(error_2);
+                throw new errors_1.APIError({ title: message });
+            case 9: return [2 /*return*/];
+        }
     });
-}
+}); };
+exports.signupUser = signupUser;
 /**
  * Generates both an access token (JWT) and a refresh token for a given user.
  *
@@ -188,7 +183,7 @@ var generateTokens = function (user_1, authOptions_1) {
         return __generator(this, function (_b) {
             tokenSecretOrKey = process.env.TOKEN_SECRET;
             if (!tokenSecretOrKey) {
-                throw new Error("TOKEN_SECRET must be set in env.");
+                throw new errors_1.APIError({ status: 500, title: "TOKEN_SECRET must be set in env." });
             }
             tokenUser = user;
             if (!(tokenUser === null || tokenUser === void 0 ? void 0 : tokenUser._id)) {
@@ -253,15 +248,14 @@ var generateTokens = function (user_1, authOptions_1) {
 };
 exports.generateTokens = generateTokens;
 // TODO allow customization
-function setupAuth(app, userModel) {
-    var _this = this;
+var setupAuth = function (app, userModel) {
     passport_1.default.use(new passport_anonymous_1.Strategy());
     passport_1.default.use(userModel.createStrategy());
     passport_1.default.use("signup", new passport_local_1.Strategy({
         passReqToCallback: true,
         passwordField: "password",
         usernameField: "email",
-    }, function (req, email, password, done) { return __awaiter(_this, void 0, void 0, function () {
+    }, function (req, email, password, done) { return __awaiter(void 0, void 0, void 0, function () {
         var _a, _b, error_3;
         return __generator(this, function (_c) {
             switch (_c.label) {
@@ -269,7 +263,7 @@ function setupAuth(app, userModel) {
                     _c.trys.push([0, 2, , 3]);
                     _a = done;
                     _b = [undefined];
-                    return [4 /*yield*/, signupUser(userModel, email, password, req.body)];
+                    return [4 /*yield*/, (0, exports.signupUser)(userModel, email, password, req.body)];
                 case 1:
                     _a.apply(void 0, _b.concat([_c.sent()]));
                     return [3 /*break*/, 3];
@@ -281,7 +275,7 @@ function setupAuth(app, userModel) {
         });
     }); }));
     if (!userModel.createStrategy) {
-        throw new Error("setupAuth userModel must have .createStrategy()");
+        throw new errors_1.APIError({ status: 500, title: "setupAuth userModel must have .createStrategy()" });
     }
     var customTokenExtractor = function (req) {
         var _a, _b, _c;
@@ -300,14 +294,14 @@ function setupAuth(app, userModel) {
         }
         var secretOrKey = process.env.TOKEN_SECRET;
         if (!secretOrKey) {
-            throw new Error("TOKEN_SECRET must be set in env.");
+            throw new errors_1.APIError({ status: 500, title: "TOKEN_SECRET must be set in env." });
         }
         var jwtOpts = {
             issuer: process.env.TOKEN_ISSUER,
             jwtFromRequest: customTokenExtractor,
             secretOrKey: secretOrKey,
         };
-        passport_1.default.use("jwt", new passport_jwt_1.Strategy(jwtOpts, function (jwtPayload, done) { return __awaiter(_this, void 0, void 0, function () {
+        passport_1.default.use("jwt", new passport_jwt_1.Strategy(jwtOpts, function (jwtPayload, done) { return __awaiter(void 0, void 0, void 0, function () {
             var user, error_4;
             return __generator(this, function (_a) {
                 switch (_a.label) {
@@ -346,82 +340,79 @@ function setupAuth(app, userModel) {
     }
     // Adds req.user to the request. This may wind up duplicating requests with passport,
     // but passport doesn't give us req.user early enough.
-    function decodeJWTMiddleware(req, res, next) {
-        return __awaiter(this, void 0, void 0, function () {
-            var token, decoded, userText, expiredAt, message, details, sessionId, user, error_5;
-            var _a, _b, _c, _d;
-            return __generator(this, function (_e) {
-                switch (_e.label) {
-                    case 0:
-                        if (!process.env.TOKEN_SECRET) {
-                            return [2 /*return*/, next()];
-                        }
-                        // Allow requests with a "Secret" prefix to pass through since this is a string value,
-                        // not a jwt that needs to be decoded
-                        if (((_b = (_a = req === null || req === void 0 ? void 0 : req.headers) === null || _a === void 0 ? void 0 : _a.authorization) === null || _b === void 0 ? void 0 : _b.split(" ")[0]) === "Secret") {
-                            return [2 /*return*/, next()];
-                        }
-                        token = customTokenExtractor(req);
-                        // For some reason, our app will happily put null into the authorization header when logging
-                        // out then back in.
-                        if (!token || token === "null" || token === "undefined") {
-                            return [2 /*return*/, next()];
-                        }
-                        try {
-                            decoded = jsonwebtoken_1.default.verify(token, process.env.TOKEN_SECRET, {
-                                issuer: process.env.TOKEN_ISSUER,
-                            });
-                        }
-                        catch (error) {
-                            userText = ((_c = req.user) === null || _c === void 0 ? void 0 : _c._id) ? " for user ".concat(req.user._id, " ") : "";
-                            expiredAt = error && typeof error === "object" && "expiredAt" in error
-                                ? error.expiredAt
-                                : undefined;
-                            message = (0, errors_1.errorMessage)(error);
-                            details = "[jwt] Error decoding token".concat(userText, ": ").concat(error, ", expired at ").concat(expiredAt, ", current time: ").concat(Date.now());
-                            logger_1.logger.debug(details);
-                            return [2 /*return*/, res.status(401).json({ details: details, message: message })];
-                        }
-                        if (!(decoded === null || decoded === void 0 ? void 0 : decoded.id)) return [3 /*break*/, 4];
-                        sessionId = (0, requestContext_1.getSessionIdFromJwtPayload)(decoded);
-                        req.authTokenPayload = decoded;
-                        if (sessionId) {
-                            req.sessionId = sessionId;
-                            (0, requestContext_1.setRequestContext)({ sessionId: sessionId });
-                        }
-                        _e.label = 1;
-                    case 1:
-                        _e.trys.push([1, 3, , 4]);
-                        return [4 /*yield*/, userModel.findById(decoded.id)];
-                    case 2:
-                        user = _e.sent();
-                        req.user = user;
-                        (0, requestContext_1.updateRequestContextFromRequest)(req, res);
-                        if ((_d = req.user) === null || _d === void 0 ? void 0 : _d.disabled) {
-                            logger_1.logger.warn("[jwt] User ".concat(req.user.id, " is disabled"));
-                            return [2 /*return*/, res.status(401).json({ status: 401, title: "User is disabled" })];
-                        }
-                        return [3 /*break*/, 4];
-                    case 3:
-                        error_5 = _e.sent();
-                        logger_1.logger.warn("[jwt] Error finding user from id: ".concat(error_5));
-                        return [3 /*break*/, 4];
-                    case 4: return [2 /*return*/, next()];
-                }
-            });
+    var decodeJWTMiddleware = function (req, res, next) { return __awaiter(void 0, void 0, void 0, function () {
+        var token, decoded, userText, expiredAt, message, details, sessionId, user, error_5;
+        var _a, _b, _c, _d;
+        return __generator(this, function (_e) {
+            switch (_e.label) {
+                case 0:
+                    if (!process.env.TOKEN_SECRET) {
+                        return [2 /*return*/, next()];
+                    }
+                    // Allow requests with a "Secret" prefix to pass through since this is a string value,
+                    // not a jwt that needs to be decoded
+                    if (((_b = (_a = req === null || req === void 0 ? void 0 : req.headers) === null || _a === void 0 ? void 0 : _a.authorization) === null || _b === void 0 ? void 0 : _b.split(" ")[0]) === "Secret") {
+                        return [2 /*return*/, next()];
+                    }
+                    token = customTokenExtractor(req);
+                    // For some reason, our app will happily put null into the authorization header when logging
+                    // out then back in.
+                    if (!token || token === "null" || token === "undefined") {
+                        return [2 /*return*/, next()];
+                    }
+                    try {
+                        decoded = jsonwebtoken_1.default.verify(token, process.env.TOKEN_SECRET, {
+                            issuer: process.env.TOKEN_ISSUER,
+                        });
+                    }
+                    catch (error) {
+                        userText = ((_c = req.user) === null || _c === void 0 ? void 0 : _c._id) ? " for user ".concat(req.user._id, " ") : "";
+                        expiredAt = error && typeof error === "object" && "expiredAt" in error
+                            ? error.expiredAt
+                            : undefined;
+                        message = (0, errors_1.errorMessage)(error);
+                        details = "[jwt] Error decoding token".concat(userText, ": ").concat(error, ", expired at ").concat(expiredAt, ", current time: ").concat(Date.now());
+                        logger_1.logger.debug(details);
+                        return [2 /*return*/, res.status(401).json({ details: details, message: message })];
+                    }
+                    if (!(decoded === null || decoded === void 0 ? void 0 : decoded.id)) return [3 /*break*/, 4];
+                    sessionId = (0, requestContext_1.getSessionIdFromJwtPayload)(decoded);
+                    req.authTokenPayload = decoded;
+                    if (sessionId) {
+                        req.sessionId = sessionId;
+                        (0, requestContext_1.setRequestContext)({ sessionId: sessionId });
+                    }
+                    _e.label = 1;
+                case 1:
+                    _e.trys.push([1, 3, , 4]);
+                    return [4 /*yield*/, userModel.findById(decoded.id)];
+                case 2:
+                    user = _e.sent();
+                    req.user = user;
+                    (0, requestContext_1.updateRequestContextFromRequest)(req, res);
+                    if ((_d = req.user) === null || _d === void 0 ? void 0 : _d.disabled) {
+                        logger_1.logger.warn("[jwt] User ".concat(req.user.id, " is disabled"));
+                        return [2 /*return*/, res.status(401).json({ status: 401, title: "User is disabled" })];
+                    }
+                    return [3 /*break*/, 4];
+                case 3:
+                    error_5 = _e.sent();
+                    logger_1.logger.warn("[jwt] Error finding user from id: ".concat(error_5));
+                    return [3 /*break*/, 4];
+                case 4: return [2 /*return*/, next()];
+            }
         });
-    }
+    }); };
     app.use(decodeJWTMiddleware);
     // biome-ignore lint/suspicious/noExplicitAny: express 5 type for urlencoded doesn't match RequestHandler
     app.use(express_1.default.urlencoded({ extended: false }));
-}
-function addAuthRoutes(app, userModel, authOptions) {
-    var _this = this;
+};
+exports.setupAuth = setupAuth;
+var addAuthRoutes = function (app, userModel, authOptions) {
     var router = express_1.default.Router();
-    router.post("/login", function (req, res, next) { return __awaiter(_this, void 0, void 0, function () {
-        var _this = this;
+    router.post("/login", function (req, res, next) { return __awaiter(void 0, void 0, void 0, function () {
         return __generator(this, function (_a) {
-            passport_1.default.authenticate("local", { session: false }, function (err, user, info) { return __awaiter(_this, void 0, void 0, function () {
+            passport_1.default.authenticate("local", { session: false }, function (err, user, info) { return __awaiter(void 0, void 0, void 0, function () {
                 var tokens;
                 return __generator(this, function (_a) {
                     switch (_a.label) {
@@ -453,7 +444,7 @@ function addAuthRoutes(app, userModel, authOptions) {
             return [2 /*return*/];
         });
     }); });
-    router.post("/refresh_token", function (req, res) { return __awaiter(_this, void 0, void 0, function () {
+    router.post("/refresh_token", function (req, res) { return __awaiter(void 0, void 0, void 0, function () {
         var refreshTokenSecretOrKey, decoded, message, user, sessionId, tokens;
         var _a, _b, _c, _d;
         return __generator(this, function (_e) {
@@ -503,7 +494,7 @@ function addAuthRoutes(app, userModel, authOptions) {
     }); });
     var signupDisabled = process.env.SIGNUP_DISABLED === "true";
     if (!signupDisabled) {
-        router.post("/signup", passport_1.default.authenticate("signup", { failWithError: true, session: false }), function (req, res) { return __awaiter(_this, void 0, void 0, function () {
+        router.post("/signup", passport_1.default.authenticate("signup", { failWithError: true, session: false }), function (req, res) { return __awaiter(void 0, void 0, void 0, function () {
             var tokens;
             var _a, _b;
             return __generator(this, function (_c) {
@@ -527,11 +518,11 @@ function addAuthRoutes(app, userModel, authOptions) {
     }
     app.set("etag", false);
     app.use("/auth", router);
-}
-function addMeRoutes(app, userModel, _authOptions) {
-    var _this = this;
+};
+exports.addAuthRoutes = addAuthRoutes;
+var addMeRoutes = function (app, userModel, _authOptions) {
     var router = express_1.default.Router();
-    router.get("/me", authenticateMiddleware(), function (req, res) { return __awaiter(_this, void 0, void 0, function () {
+    router.get("/me", (0, exports.authenticateMiddleware)(), function (req, res) { return __awaiter(void 0, void 0, void 0, function () {
         var data, dataObject;
         var _a;
         return __generator(this, function (_b) {
@@ -554,7 +545,7 @@ function addMeRoutes(app, userModel, _authOptions) {
             }
         });
     }); });
-    router.patch("/me", authenticateMiddleware(), function (req, res) { return __awaiter(_this, void 0, void 0, function () {
+    router.patch("/me", (0, exports.authenticateMiddleware)(), function (req, res) { return __awaiter(void 0, void 0, void 0, function () {
         var doc, dataObject, error_6, message;
         var _a;
         return __generator(this, function (_b) {
@@ -590,4 +581,5 @@ function addMeRoutes(app, userModel, _authOptions) {
     app.set("etag", false);
     app.use("/auth", router);
     app.use(errors_1.apiErrorMiddleware);
-}
+};
+exports.addMeRoutes = addMeRoutes;