@terreno/api 0.20.2 → 0.22.0

package/dist/secretProviders.test.js

@@ -37,6 +37,7 @@ var __generator = (this && this.__generator) || function (thisArg, body) {
 };
 Object.defineProperty(exports, "__esModule", { value: true });
 var bun_test_1 = require("bun:test");
+var errors_1 = require("./errors");
 var secretProviders_1 = require("./secretProviders");
 (0, bun_test_1.describe)("EnvSecretProvider", function () {
     (0, bun_test_1.beforeEach)(function () {
@@ -389,3 +390,337 @@ var secretProviders_1 = require("./secretProviders");
         });
     }); });
 });
+/** Inject a pre-built mock client into a GcpSecretProvider, bypassing getClient(). */
+var injectClient = function (provider, client) {
+    // Bypass the private `client` field for testing — avoids the dynamic import of
+    // @google-cloud/secret-manager which is an optional peer dependency.
+    Object.defineProperty(provider, "client", { configurable: true, value: client, writable: true });
+};
+(0, bun_test_1.describe)("GcpSecretProvider", function () {
+    (0, bun_test_1.it)("has the name 'gcp'", function () {
+        var provider = new secretProviders_1.GcpSecretProvider({ projectId: "my-project" });
+        (0, bun_test_1.expect)(provider.name).toBe("gcp");
+    });
+    (0, bun_test_1.it)("throws APIError when @google-cloud/secret-manager is not installed", function () { return __awaiter(void 0, void 0, void 0, function () {
+        var provider, error_1;
+        return __generator(this, function (_a) {
+            switch (_a.label) {
+                case 0:
+                    provider = new secretProviders_1.GcpSecretProvider({ projectId: "my-project" });
+                    _a.label = 1;
+                case 1:
+                    _a.trys.push([1, 3, , 4]);
+                    return [4 /*yield*/, provider.getSecret("some-secret")];
+                case 2:
+                    _a.sent();
+                    bun_test_1.expect.unreachable("should have thrown");
+                    return [3 /*break*/, 4];
+                case 3:
+                    error_1 = _a.sent();
+                    (0, bun_test_1.expect)(error_1).toBeInstanceOf(errors_1.APIError);
+                    (0, bun_test_1.expect)(error_1.title).toContain("GcpSecretProvider requires @google-cloud/secret-manager");
+                    return [3 /*break*/, 4];
+                case 4: return [2 /*return*/];
+            }
+        });
+    }); });
+    (0, bun_test_1.it)("resolves a short secret name to the full resource path with default version", function () { return __awaiter(void 0, void 0, void 0, function () {
+        var calls, mockClient, provider, result;
+        return __generator(this, function (_a) {
+            switch (_a.label) {
+                case 0:
+                    calls = [];
+                    mockClient = {
+                        accessSecretVersion: function (req) { return __awaiter(void 0, void 0, void 0, function () {
+                            return __generator(this, function (_a) {
+                                calls.push(req.name);
+                                return [2 /*return*/, [{ payload: { data: "secret-value" } }]];
+                            });
+                        }); },
+                    };
+                    provider = new secretProviders_1.GcpSecretProvider({ projectId: "my-project" });
+                    injectClient(provider, mockClient);
+                    return [4 /*yield*/, provider.getSecret("openai-api-key")];
+                case 1:
+                    result = _a.sent();
+                    (0, bun_test_1.expect)(result).toBe("secret-value");
+                    (0, bun_test_1.expect)(calls).toEqual(["projects/my-project/secrets/openai-api-key/versions/latest"]);
+                    return [2 /*return*/];
+            }
+        });
+    }); });
+    (0, bun_test_1.it)("resolves a short secret name with an explicit version", function () { return __awaiter(void 0, void 0, void 0, function () {
+        var calls, mockClient, provider, result;
+        return __generator(this, function (_a) {
+            switch (_a.label) {
+                case 0:
+                    calls = [];
+                    mockClient = {
+                        accessSecretVersion: function (req) { return __awaiter(void 0, void 0, void 0, function () {
+                            return __generator(this, function (_a) {
+                                calls.push(req.name);
+                                return [2 /*return*/, [{ payload: { data: "v3-value" } }]];
+                            });
+                        }); },
+                    };
+                    provider = new secretProviders_1.GcpSecretProvider({ projectId: "p" });
+                    injectClient(provider, mockClient);
+                    return [4 /*yield*/, provider.getSecret("my-key", "3")];
+                case 1:
+                    result = _a.sent();
+                    (0, bun_test_1.expect)(result).toBe("v3-value");
+                    (0, bun_test_1.expect)(calls).toEqual(["projects/p/secrets/my-key/versions/3"]);
+                    return [2 /*return*/];
+            }
+        });
+    }); });
+    (0, bun_test_1.it)("honors a full resource path that already contains /versions/", function () { return __awaiter(void 0, void 0, void 0, function () {
+        var calls, mockClient, provider, result;
+        return __generator(this, function (_a) {
+            switch (_a.label) {
+                case 0:
+                    calls = [];
+                    mockClient = {
+                        accessSecretVersion: function (req) { return __awaiter(void 0, void 0, void 0, function () {
+                            return __generator(this, function (_a) {
+                                calls.push(req.name);
+                                return [2 /*return*/, [{ payload: { data: "pinned" } }]];
+                            });
+                        }); },
+                    };
+                    provider = new secretProviders_1.GcpSecretProvider({ projectId: "ignored" });
+                    injectClient(provider, mockClient);
+                    return [4 /*yield*/, provider.getSecret("projects/p/secrets/s/versions/7")];
+                case 1:
+                    result = _a.sent();
+                    (0, bun_test_1.expect)(result).toBe("pinned");
+                    (0, bun_test_1.expect)(calls).toEqual(["projects/p/secrets/s/versions/7"]);
+                    return [2 /*return*/];
+            }
+        });
+    }); });
+    (0, bun_test_1.it)("appends /versions/latest to a full resource path without a version suffix", function () { return __awaiter(void 0, void 0, void 0, function () {
+        var calls, mockClient, provider, result;
+        return __generator(this, function (_a) {
+            switch (_a.label) {
+                case 0:
+                    calls = [];
+                    mockClient = {
+                        accessSecretVersion: function (req) { return __awaiter(void 0, void 0, void 0, function () {
+                            return __generator(this, function (_a) {
+                                calls.push(req.name);
+                                return [2 /*return*/, [{ payload: { data: "latest-value" } }]];
+                            });
+                        }); },
+                    };
+                    provider = new secretProviders_1.GcpSecretProvider({ projectId: "ignored" });
+                    injectClient(provider, mockClient);
+                    return [4 /*yield*/, provider.getSecret("projects/p/secrets/s")];
+                case 1:
+                    result = _a.sent();
+                    (0, bun_test_1.expect)(result).toBe("latest-value");
+                    (0, bun_test_1.expect)(calls).toEqual(["projects/p/secrets/s/versions/latest"]);
+                    return [2 /*return*/];
+            }
+        });
+    }); });
+    (0, bun_test_1.it)("appends the explicit version when full path lacks /versions/", function () { return __awaiter(void 0, void 0, void 0, function () {
+        var calls, mockClient, provider, result;
+        return __generator(this, function (_a) {
+            switch (_a.label) {
+                case 0:
+                    calls = [];
+                    mockClient = {
+                        accessSecretVersion: function (req) { return __awaiter(void 0, void 0, void 0, function () {
+                            return __generator(this, function (_a) {
+                                calls.push(req.name);
+                                return [2 /*return*/, [{ payload: { data: "v5" } }]];
+                            });
+                        }); },
+                    };
+                    provider = new secretProviders_1.GcpSecretProvider({ projectId: "ignored" });
+                    injectClient(provider, mockClient);
+                    return [4 /*yield*/, provider.getSecret("projects/p/secrets/s", "5")];
+                case 1:
+                    result = _a.sent();
+                    (0, bun_test_1.expect)(result).toBe("v5");
+                    (0, bun_test_1.expect)(calls).toEqual(["projects/p/secrets/s/versions/5"]);
+                    return [2 /*return*/];
+            }
+        });
+    }); });
+    (0, bun_test_1.it)("decodes a Uint8Array payload", function () { return __awaiter(void 0, void 0, void 0, function () {
+        var encoded, mockClient, provider, _a;
+        return __generator(this, function (_b) {
+            switch (_b.label) {
+                case 0:
+                    encoded = new TextEncoder().encode("binary-secret");
+                    mockClient = {
+                        accessSecretVersion: function () { return __awaiter(void 0, void 0, void 0, function () { return __generator(this, function (_a) {
+                            return [2 /*return*/, [{ payload: { data: encoded } }]];
+                        }); }); },
+                    };
+                    provider = new secretProviders_1.GcpSecretProvider({ projectId: "p" });
+                    injectClient(provider, mockClient);
+                    _a = bun_test_1.expect;
+                    return [4 /*yield*/, provider.getSecret("bin-key")];
+                case 1:
+                    _a.apply(void 0, [_b.sent()]).toBe("binary-secret");
+                    return [2 /*return*/];
+            }
+        });
+    }); });
+    (0, bun_test_1.it)("returns null when the payload is empty", function () { return __awaiter(void 0, void 0, void 0, function () {
+        var mockClient, provider, _a;
+        return __generator(this, function (_b) {
+            switch (_b.label) {
+                case 0:
+                    mockClient = {
+                        accessSecretVersion: function () { return __awaiter(void 0, void 0, void 0, function () { return __generator(this, function (_a) {
+                            return [2 /*return*/, [{ payload: {} }]];
+                        }); }); },
+                    };
+                    provider = new secretProviders_1.GcpSecretProvider({ projectId: "p" });
+                    injectClient(provider, mockClient);
+                    _a = bun_test_1.expect;
+                    return [4 /*yield*/, provider.getSecret("empty-payload")];
+                case 1:
+                    _a.apply(void 0, [_b.sent()]).toBeNull();
+                    return [2 /*return*/];
+            }
+        });
+    }); });
+    (0, bun_test_1.it)("returns null when the payload field is missing entirely", function () { return __awaiter(void 0, void 0, void 0, function () {
+        var mockClient, provider, _a;
+        return __generator(this, function (_b) {
+            switch (_b.label) {
+                case 0:
+                    mockClient = {
+                        accessSecretVersion: function () { return __awaiter(void 0, void 0, void 0, function () { return __generator(this, function (_a) {
+                            return [2 /*return*/, [{}]];
+                        }); }); },
+                    };
+                    provider = new secretProviders_1.GcpSecretProvider({ projectId: "p" });
+                    injectClient(provider, mockClient);
+                    _a = bun_test_1.expect;
+                    return [4 /*yield*/, provider.getSecret("no-payload")];
+                case 1:
+                    _a.apply(void 0, [_b.sent()]).toBeNull();
+                    return [2 /*return*/];
+            }
+        });
+    }); });
+    (0, bun_test_1.it)("returns null on NOT_FOUND (gRPC code 5)", function () { return __awaiter(void 0, void 0, void 0, function () {
+        var notFound, mockClient, provider, _a;
+        return __generator(this, function (_b) {
+            switch (_b.label) {
+                case 0:
+                    notFound = Object.assign(new Error("NOT_FOUND"), { code: 5 });
+                    mockClient = {
+                        accessSecretVersion: function () { return __awaiter(void 0, void 0, void 0, function () {
+                            return __generator(this, function (_a) {
+                                throw notFound;
+                            });
+                        }); },
+                    };
+                    provider = new secretProviders_1.GcpSecretProvider({ projectId: "p" });
+                    injectClient(provider, mockClient);
+                    _a = bun_test_1.expect;
+                    return [4 /*yield*/, provider.getSecret("missing-secret")];
+                case 1:
+                    _a.apply(void 0, [_b.sent()]).toBeNull();
+                    return [2 /*return*/];
+            }
+        });
+    }); });
+    (0, bun_test_1.it)("re-throws non-NOT_FOUND errors", function () { return __awaiter(void 0, void 0, void 0, function () {
+        var permissionDenied, mockClient, provider, error_2;
+        return __generator(this, function (_a) {
+            switch (_a.label) {
+                case 0:
+                    permissionDenied = Object.assign(new Error("PERMISSION_DENIED"), { code: 7 });
+                    mockClient = {
+                        accessSecretVersion: function () { return __awaiter(void 0, void 0, void 0, function () {
+                            return __generator(this, function (_a) {
+                                throw permissionDenied;
+                            });
+                        }); },
+                    };
+                    provider = new secretProviders_1.GcpSecretProvider({ projectId: "p" });
+                    injectClient(provider, mockClient);
+                    _a.label = 1;
+                case 1:
+                    _a.trys.push([1, 3, , 4]);
+                    return [4 /*yield*/, provider.getSecret("forbidden-secret")];
+                case 2:
+                    _a.sent();
+                    bun_test_1.expect.unreachable("should have thrown");
+                    return [3 /*break*/, 4];
+                case 3:
+                    error_2 = _a.sent();
+                    (0, bun_test_1.expect)(error_2).toBe(permissionDenied);
+                    return [3 /*break*/, 4];
+                case 4: return [2 /*return*/];
+            }
+        });
+    }); });
+    (0, bun_test_1.it)("re-throws non-Error throwables", function () { return __awaiter(void 0, void 0, void 0, function () {
+        var mockClient, provider, error_3;
+        return __generator(this, function (_a) {
+            switch (_a.label) {
+                case 0:
+                    mockClient = {
+                        accessSecretVersion: function () { return __awaiter(void 0, void 0, void 0, function () {
+                            return __generator(this, function (_a) {
+                                throw "string-error";
+                            });
+                        }); },
+                    };
+                    provider = new secretProviders_1.GcpSecretProvider({ projectId: "p" });
+                    injectClient(provider, mockClient);
+                    _a.label = 1;
+                case 1:
+                    _a.trys.push([1, 3, , 4]);
+                    return [4 /*yield*/, provider.getSecret("x")];
+                case 2:
+                    _a.sent();
+                    bun_test_1.expect.unreachable("should have thrown");
+                    return [3 /*break*/, 4];
+                case 3:
+                    error_3 = _a.sent();
+                    (0, bun_test_1.expect)(error_3).toBe("string-error");
+                    return [3 /*break*/, 4];
+                case 4: return [2 /*return*/];
+            }
+        });
+    }); });
+    (0, bun_test_1.it)("caches the client across multiple getSecret calls", function () { return __awaiter(void 0, void 0, void 0, function () {
+        var callCount, mockClient, provider, _a, _b;
+        return __generator(this, function (_c) {
+            switch (_c.label) {
+                case 0:
+                    callCount = 0;
+                    mockClient = {
+                        accessSecretVersion: function () { return __awaiter(void 0, void 0, void 0, function () {
+                            return __generator(this, function (_a) {
+                                callCount++;
+                                return [2 /*return*/, [{ payload: { data: "call-".concat(callCount) } }]];
+                            });
+                        }); },
+                    };
+                    provider = new secretProviders_1.GcpSecretProvider({ projectId: "p" });
+                    injectClient(provider, mockClient);
+                    _a = bun_test_1.expect;
+                    return [4 /*yield*/, provider.getSecret("a")];
+                case 1:
+                    _a.apply(void 0, [_c.sent()]).toBe("call-1");
+                    _b = bun_test_1.expect;
+                    return [4 /*yield*/, provider.getSecret("b")];
+                case 2:
+                    _b.apply(void 0, [_c.sent()]).toBe("call-2");
+                    (0, bun_test_1.expect)(callCount).toBe(2);
+                    return [2 /*return*/];
+            }
+        });
+    }); });
+});

package/dist/syncConsents.test.js

@@ -50,7 +50,7 @@ Object.defineProperty(exports, "__esModule", { value: true });
 var bun_test_1 = require("bun:test");
 var consentForm_1 = require("./models/consentForm");
 var syncConsents_1 = require("./syncConsents");
-var tests_1 = require("./tests");
+var testHelper_1 = require("./tests/testHelper");
 var baseDef = {
     content: { en: "# Terms\nPlease agree." },
     order: 1,
@@ -62,7 +62,7 @@ var baseDef = {
     (0, bun_test_1.beforeEach)(function () { return __awaiter(void 0, void 0, void 0, function () {
         return __generator(this, function (_a) {
             switch (_a.label) {
-                case 0: return [4 /*yield*/, (0, tests_1.setupDb)()];
+                case 0: return [4 /*yield*/, (0, testHelper_1.setupDb)()];
                 case 1:
                     _a.sent();
                     return [4 /*yield*/, consentForm_1.ConsentForm.deleteMany({})];

package/dist/terrenoApp.d.ts

@@ -3,7 +3,7 @@ import express from "express";
 import type { ModelRouterRegistration } from "./api";
 import { type UserModel as UserMongooseModel } from "./auth";
 import { type ConfigurationAppOptions } from "./configurationApp";
-import { type AuthOptions } from "./expressServer";
+import { type AddRoutes, type AuthOptions } from "./expressServer";
 import { type GitHubAuthOptions } from "./githubAuth";
 import { type LoggingOptions } from "./logger";
 import type { RealtimeAppOptions } from "./realtime/types";
@@ -38,27 +38,40 @@ export interface TerrenoAppOptions {
      * Set to `true` for defaults, or pass a RealtimeAppOptions object for full control.
      */
     realtime?: boolean | RealtimeAppOptions;
+    /**
+     * Runs after CORS and before the `addMiddleware` chain and JSON body parsing.
+     * Use to attach early middleware via `app.use(...)` before JSON parsing.
+     */
+    beforeJsonSetup?: (app: express.Application) => void;
+    /**
+     * Invoked after registered plugins/model routers and before `/auth/me`.
+     * Receives the Express app and OpenAPI bundle for `modelRouter` / `createOpenApiBuilder` wiring.
+     */
+    configureApp?: AddRoutes;
 }
 /**
  * Fluent API for building Express applications with Terreno framework.
  *
- * TerrenoApp provides an alternative to `setupServer` using a registration
- * pattern instead of callbacks. Build applications by registering model
- * routers and plugins, then calling `start()` to begin listening.
+ * TerrenoApp is the supported way to assemble the Terreno Express stack.
+ * Build applications by registering model routers and plugins (and/or
+ * `configureApp`), then calling `start()` to listen.
  *
  * The middleware stack is configured in this order:
  * 1. CORS
- * 2. Custom middleware (via addMiddleware)
- * 3. JSON body parser
- * 4. Auth routes (/auth/login, /auth/signup, etc.)
- * 5. JWT authentication setup
- * 6. Request logging
- * 7. Sentry scopes
- * 8. OpenAPI middleware
- * 9. /auth/me routes
+ * 2. Optional `beforeJsonSetup` (configure the app before JSON parsing)
+ * 3. Custom middleware (via addMiddleware)
+ * 4. JSON body parser
+ * 5. Auth routes (/auth/login, /auth/signup, etc.)
+ * 6. JWT authentication setup
+ * 7. Request logging
+ * 8. Sentry scopes
+ * 9. OpenAPI middleware (including JSON `requestId` on object responses)
  * 10. GitHub OAuth routes (if enabled)
- * 11. Registered model routers and plugins
- * 12. Error handling middleware
+ * 11. Configuration app (if any)
+ * 12. Registered model routers and plugins
+ * 13. Optional `configureApp` callback
+ * 14. /auth/me routes
+ * 15. Error handling middleware
  *
  * @example
  * ```typescript
@@ -95,7 +108,6 @@ export interface TerrenoAppOptions {
  *   .start();
  * ```
  *
- * @see setupServer for the callback-based alternative
  * @see TerrenoPlugin for creating reusable plugins
  * @see modelRouter for creating CRUD route registrations
  */

package/dist/terrenoApp.js

@@ -70,6 +70,7 @@ var errors_1 = require("./errors");
 var expressServer_1 = require("./expressServer");
 var githubAuth_1 = require("./githubAuth");
 var logger_1 = require("./logger");
+var middleware_1 = require("./middleware");
 var openApiCompat_1 = require("./openApiCompat");
 var openApiEtag_1 = require("./openApiEtag");
 var realtimeApp_1 = require("./realtime/realtimeApp");
@@ -78,23 +79,26 @@ var index_1 = __importDefault(require("./vendor/wesleytodd-openapi/index"));
 /**
  * Fluent API for building Express applications with Terreno framework.
  *
- * TerrenoApp provides an alternative to `setupServer` using a registration
- * pattern instead of callbacks. Build applications by registering model
- * routers and plugins, then calling `start()` to begin listening.
+ * TerrenoApp is the supported way to assemble the Terreno Express stack.
+ * Build applications by registering model routers and plugins (and/or
+ * `configureApp`), then calling `start()` to listen.
  *
  * The middleware stack is configured in this order:
  * 1. CORS
- * 2. Custom middleware (via addMiddleware)
- * 3. JSON body parser
- * 4. Auth routes (/auth/login, /auth/signup, etc.)
- * 5. JWT authentication setup
- * 6. Request logging
- * 7. Sentry scopes
- * 8. OpenAPI middleware
- * 9. /auth/me routes
+ * 2. Optional `beforeJsonSetup` (configure the app before JSON parsing)
+ * 3. Custom middleware (via addMiddleware)
+ * 4. JSON body parser
+ * 5. Auth routes (/auth/login, /auth/signup, etc.)
+ * 6. JWT authentication setup
+ * 7. Request logging
+ * 8. Sentry scopes
+ * 9. OpenAPI middleware (including JSON `requestId` on object responses)
  * 10. GitHub OAuth routes (if enabled)
- * 11. Registered model routers and plugins
- * 12. Error handling middleware
+ * 11. Configuration app (if any)
+ * 12. Registered model routers and plugins
+ * 13. Optional `configureApp` callback
+ * 14. /auth/me routes
+ * 15. Error handling middleware
  *
  * @example
  * ```typescript
@@ -131,7 +135,6 @@ var index_1 = __importDefault(require("./vendor/wesleytodd-openapi/index"));
  *   .start();
  * ```
  *
- * @see setupServer for the callback-based alternative
  * @see TerrenoPlugin for creating reusable plugins
  * @see modelRouter for creating CRUD route registrations
  */
@@ -254,6 +257,9 @@ var TerrenoApp = /** @class */ (function () {
         app.set("query parser", function (str) { var _a; return qs_1.default.parse(str, { arrayLimit: (_a = options.arrayLimit) !== null && _a !== void 0 ? _a : 200 }); });
         app.use(requestContext_1.requestContextMiddleware);
         app.use((0, cors_1.default)({ credentials: true, origin: (_c = options.corsOrigin) !== null && _c !== void 0 ? _c : "*" }));
+        if (options.beforeJsonSetup) {
+            options.beforeJsonSetup(app);
+        }
         try {
             // Apply custom middleware before JSON parsing
             for (var _d = __values(this.middlewareFns), _e = _d.next(); !_e.done; _e = _d.next()) {
@@ -314,6 +320,7 @@ var TerrenoApp = /** @class */ (function () {
         // OpenAPI
         app.use(openApiCompat_1.openApiCompatMiddleware);
         app.use(openApiEtag_1.openApiEtagMiddleware);
+        app.use(middleware_1.jsonResponseRequestIdMiddleware);
         var oapi = (0, index_1.default)({
             info: {
                 description: "Generated docs from an Express api",
@@ -355,6 +362,9 @@ var TerrenoApp = /** @class */ (function () {
             }
             finally { if (e_2) throw e_2.error; }
         }
+        if (options.configureApp) {
+            options.configureApp(app, { openApi: oapi });
+        }
         // /auth/me must be registered after plugins so that session middleware
         // (e.g. Better Auth) has a chance to populate req.user first.
         (0, auth_1.addMeRoutes)(app, options.userModel, options.authOptions);

package/dist/terrenoApp.test.js

@@ -104,6 +104,7 @@ var mongoose_1 = __importStar(require("mongoose"));
 var supertest_1 = __importDefault(require("supertest"));
 var api_1 = require("./api");
 var configurationPlugin_1 = require("./configurationPlugin");
+var errors_1 = require("./errors");
 var permissions_1 = require("./permissions");
 var plugins_1 = require("./plugins");
 var terrenoApp_1 = require("./terrenoApp");
@@ -125,6 +126,24 @@ var typedUserModel = tests_1.UserModel;
             }).build();
             (0, bun_test_1.expect)(app).toBeDefined();
         });
+        (0, bun_test_1.it)("does not add requestId to GET /openapi.json document bodies", function () { return __awaiter(void 0, void 0, void 0, function () {
+            var app, res;
+            return __generator(this, function (_d) {
+                switch (_d.label) {
+                    case 0:
+                        app = new terrenoApp_1.TerrenoApp({
+                            skipListen: true,
+                            userModel: typedUserModel,
+                        }).build();
+                        return [4 /*yield*/, (0, supertest_1.default)(app).get("/openapi.json").expect(200)];
+                    case 1:
+                        res = _d.sent();
+                        (0, bun_test_1.expect)(res.body.openapi).toBe("3.0.0");
+                        (0, bun_test_1.expect)(res.body.requestId).toBeUndefined();
+                        return [2 /*return*/];
+                }
+            });
+        }); });
         (0, bun_test_1.it)("creates server with custom corsOrigin", function () {
             var app = new terrenoApp_1.TerrenoApp({
                 corsOrigin: "https://example.com",
@@ -196,6 +215,7 @@ var typedUserModel = tests_1.UserModel;
                         res = _d.sent();
                         (0, bun_test_1.expect)(res.body.data).toHaveLength(1);
                         (0, bun_test_1.expect)(res.body.data[0].name).toBe("Apple");
+                        (0, bun_test_1.expect)(res.body.requestId).toBe(res.headers["x-request-id"]);
                         return [2 /*return*/];
                 }
             });
@@ -301,6 +321,7 @@ var typedUserModel = tests_1.UserModel;
                     case 2:
                         res = _d.sent();
                         (0, bun_test_1.expect)(res.status).toBe(200);
+                        (0, bun_test_1.expect)(res.body.requestId).toBe(res.headers["x-request-id"]);
                         return [2 /*return*/];
                 }
             });
@@ -356,6 +377,37 @@ var typedUserModel = tests_1.UserModel;
                     case 1:
                         res = _d.sent();
                         (0, bun_test_1.expect)(res.status).toBe(500);
+                        (0, bun_test_1.expect)(res.body.requestId).toBe(res.headers["x-request-id"]);
+                        (0, bun_test_1.expect)(res.body.status).toBe(500);
+                        (0, bun_test_1.expect)(res.body.title).toBe("Internal server error");
+                        return [2 /*return*/];
+                }
+            });
+        }); });
+        (0, bun_test_1.it)("adds requestId to APIError JSON responses", function () { return __awaiter(void 0, void 0, void 0, function () {
+            var plugin, app, res;
+            return __generator(this, function (_d) {
+                switch (_d.label) {
+                    case 0:
+                        plugin = {
+                            register: function (pluginApp) {
+                                pluginApp.get("/api-error-route", function () {
+                                    throw new errors_1.APIError({ status: 400, title: "Bad request test" });
+                                });
+                            },
+                        };
+                        app = new terrenoApp_1.TerrenoApp({
+                            skipListen: true,
+                            userModel: typedUserModel,
+                        })
+                            .register(plugin)
+                            .build();
+                        return [4 /*yield*/, (0, supertest_1.default)(app).get("/api-error-route").set("X-Request-ID", "api-err-rid")];
+                    case 1:
+                        res = _d.sent();
+                        (0, bun_test_1.expect)(res.status).toBe(400);
+                        (0, bun_test_1.expect)(res.body.requestId).toBe("api-err-rid");
+                        (0, bun_test_1.expect)(res.body.title).toBe("Bad request test");
                         return [2 /*return*/];
                 }
             });