@terreno/api 0.20.2 → 0.22.0

package/dist/api.js

@@ -173,9 +173,95 @@ exports.addPopulateToQuery = addPopulateToQuery;
 var PAGINATION_QUERY_PARAMS = ["limit", "page", "sort"];
 // Add support for more complex queries.
 var COMPLEX_QUERY_PARAMS = ["$and", "$or"];
+/**
+ * Parses a date-range query bound from an ISO-8601 string using Luxon, throwing a 400
+ * APIError when the value cannot be parsed. Centralizes date-string parsing so the repo's
+ * Luxon convention is honored for admin changelist date-range filters.
+ */
+var parseDateRangeBound = function (rawValue, queryKey) {
+    var parsed = luxon_1.DateTime.fromISO(String(rawValue), { zone: "utc" });
+    if (!parsed.isValid) {
+        throw new errors_1.APIError({
+            status: 400,
+            title: "Invalid date for query parameter ".concat(queryKey),
+        });
+    }
+    return parsed.toJSDate();
+};
+/**
+ * Collapses `field_gte` / `field_lte` query pairs into `{ field: { $gte, $lte } }` for Date paths,
+ * so admin changelist date-range filters map to valid Mongoose range queries.
+ */
+var mergeDateRangeQueryParams = function (model, query) {
+    var e_2, _a, e_3, _b;
+    var schema = model.schema;
+    var result = __assign({}, query);
+    var dateRangeBases = new Set();
+    try {
+        for (var _c = __values(Object.keys(result)), _d = _c.next(); !_d.done; _d = _c.next()) {
+            var key = _d.value;
+            var match = /^(.+)_(gte|lte)$/.exec(key);
+            if (!match) {
+                continue;
+            }
+            var baseField = match[1];
+            var path = schema.path(baseField);
+            if (!path || path.instance !== "Date") {
+                continue;
+            }
+            dateRangeBases.add(baseField);
+        }
+    }
+    catch (e_2_1) { e_2 = { error: e_2_1 }; }
+    finally {
+        try {
+            if (_d && !_d.done && (_a = _c.return)) _a.call(_c);
+        }
+        finally { if (e_2) throw e_2.error; }
+    }
+    try {
+        for (var dateRangeBases_1 = __values(dateRangeBases), dateRangeBases_1_1 = dateRangeBases_1.next(); !dateRangeBases_1_1.done; dateRangeBases_1_1 = dateRangeBases_1.next()) {
+            var baseField = dateRangeBases_1_1.value;
+            var gteKey = "".concat(baseField, "_gte");
+            var lteKey = "".concat(baseField, "_lte");
+            var gteRaw = result[gteKey];
+            var lteRaw = result[lteKey];
+            var bounds = {};
+            if (gteRaw !== undefined && gteRaw !== null && String(gteRaw).trim() !== "") {
+                bounds.$gte = parseDateRangeBound(gteRaw, gteKey);
+            }
+            if (lteRaw !== undefined && lteRaw !== null && String(lteRaw).trim() !== "") {
+                bounds.$lte = parseDateRangeBound(lteRaw, lteKey);
+            }
+            if (Object.keys(bounds).length === 0) {
+                continue;
+            }
+            delete result[gteKey];
+            delete result[lteKey];
+            var direct = result[baseField];
+            if (direct !== undefined && direct !== null && typeof direct !== "object") {
+                delete result[baseField];
+            }
+            if (typeof direct === "object" && direct !== null && !Array.isArray(direct)) {
+                result[baseField] = __assign(__assign({}, direct), bounds);
+            }
+            else {
+                result[baseField] = bounds;
+            }
+        }
+    }
+    catch (e_3_1) { e_3 = { error: e_3_1 }; }
+    finally {
+        try {
+            if (dateRangeBases_1_1 && !dateRangeBases_1_1.done && (_b = dateRangeBases_1.return)) _b.call(dateRangeBases_1);
+        }
+        finally { if (e_3) throw e_3.error; }
+    }
+    return result;
+};
 // Ensures query params are allowed. Also checks nested query params when using $and/$or.
 var checkQueryParamAllowed = function (queryParam, queryParamValue, queryFields) {
-    var e_2, _a, e_3, _b;
+    var e_4, _a, e_5, _b;
     if (queryFields === void 0) { queryFields = []; }
     // Cast for iteration through complex query values
     var complexValue = queryParamValue;
@@ -187,26 +273,26 @@ var checkQueryParamAllowed = function (queryParam, queryParamValue, queryFields)
             for (var complexValue_1 = __values(complexValue), complexValue_1_1 = complexValue_1.next(); !complexValue_1_1.done; complexValue_1_1 = complexValue_1.next()) {
                 var subQuery = complexValue_1_1.value;
                 try {
-                    for (var _c = (e_3 = void 0, __values(Object.keys(subQuery))), _d = _c.next(); !_d.done; _d = _c.next()) {
+                    for (var _c = (e_5 = void 0, __values(Object.keys(subQuery))), _d = _c.next(); !_d.done; _d = _c.next()) {
                         var subKey = _d.value;
                         checkQueryParamAllowed(subKey, subQuery[subKey], queryFields);
                     }
                 }
-                catch (e_3_1) { e_3 = { error: e_3_1 }; }
+                catch (e_5_1) { e_5 = { error: e_5_1 }; }
                 finally {
                     try {
                         if (_d && !_d.done && (_b = _c.return)) _b.call(_c);
                     }
-                    finally { if (e_3) throw e_3.error; }
+                    finally { if (e_5) throw e_5.error; }
                 }
             }
         }
-        catch (e_2_1) { e_2 = { error: e_2_1 }; }
+        catch (e_4_1) { e_4 = { error: e_4_1 }; }
         finally {
             try {
                 if (complexValue_1_1 && !complexValue_1_1.done && (_a = complexValue_1.return)) _a.call(complexValue_1);
             }
-            finally { if (e_2) throw e_2.error; }
+            finally { if (e_4) throw e_4.error; }
         }
         return;
     }
@@ -489,7 +575,7 @@ function _buildModelRouter(model, options) {
         queryValidation,
     ], (0, exports.asyncHandler)(function (req, res) { return __awaiter(_this, void 0, void 0, function () {
         var query, _a, _b, queryParam, _c, _d, queryParam, queryFilter, error_6, limit, builtQuery, total, populatedQuery, data, error_7, serialized, error_8, more, msg;
-        var e_4, _e, e_5, _f;
+        var e_6, _e, e_7, _f;
         var _g, _h, _j, _k, _l, _m;
         return __generator(this, function (_o) {
             switch (_o.label) {
@@ -501,12 +587,12 @@ function _buildModelRouter(model, options) {
                             query[queryParam] = (_h = options.defaultQueryParams) === null || _h === void 0 ? void 0 : _h[queryParam];
                         }
                     }
-                    catch (e_4_1) { e_4 = { error: e_4_1 }; }
+                    catch (e_6_1) { e_6 = { error: e_6_1 }; }
                     finally {
                         try {
                             if (_b && !_b.done && (_e = _a.return)) _e.call(_a);
                         }
-                        finally { if (e_4) throw e_4.error; }
+                        finally { if (e_6) throw e_6.error; }
                     }
                     try {
                         for (_c = __values(Object.keys(req.query)), _d = _c.next(); !_d.done; _d = _c.next()) {
@@ -527,13 +613,14 @@ function _buildModelRouter(model, options) {
                             }
                         }
                     }
-                    catch (e_5_1) { e_5 = { error: e_5_1 }; }
+                    catch (e_7_1) { e_7 = { error: e_7_1 }; }
                     finally {
                         try {
                             if (_d && !_d.done && (_f = _c.return)) _f.call(_c);
                         }
-                        finally { if (e_5) throw e_5.error; }
+                        finally { if (e_7) throw e_7.error; }
                     }
+                    query = mergeDateRangeQueryParams(model, query);
                     // Special operators. NOTE: these request Mongo Atlas.
                     if (req.query.$search) {
                         (_j = mongoose_1.default.connection.db) === null || _j === void 0 ? void 0 : _j.collection(model.collection.collectionName);

package/dist/api.query.test.js

@@ -184,7 +184,17 @@ var tests_1 = require("./tests");
                             update: [permissions_1.Permissions.IsOwner],
                         },
                         populatePaths: [{ path: "ownerId" }],
-                        queryFields: ["hidden", "name", "calories", "created", "source.name", "tags", "eatenBy"],
+                        queryFields: [
+                            "hidden",
+                            "name",
+                            "calories",
+                            "created",
+                            "created_gte",
+                            "created_lte",
+                            "source.name",
+                            "tags",
+                            "eatenBy",
+                        ],
                         sort: { created: "descending" },
                     }));
                     server = (0, supertest_1.default)(app);
@@ -344,6 +354,26 @@ var tests_1 = require("./tests");
             }
         });
     }); });
+    (0, bun_test_1.it)("list applies created_gte and created_lte as a Date range", function () { return __awaiter(void 0, void 0, void 0, function () {
+        var res, names;
+        return __generator(this, function (_a) {
+            switch (_a.label) {
+                case 0: return [4 /*yield*/, agent
+                        .get("/food")
+                        .query({
+                        created_gte: "2021-12-03T00:00:05.000Z",
+                        created_lte: "2021-12-03T00:00:25.000Z",
+                        limit: 10,
+                    })
+                        .expect(200)];
+                case 1:
+                    res = _a.sent();
+                    names = res.body.data.map(function (d) { return d.name; }).sort();
+                    (0, bun_test_1.expect)(names).toEqual(["Pizza", "Spinach"]);
+                    return [2 /*return*/];
+            }
+        });
+    }); });
     (0, bun_test_1.it)("list query params not in list", function () { return __awaiter(void 0, void 0, void 0, function () {
         var res;
         return __generator(this, function (_a) {

package/dist/api.test.js

@@ -2588,5 +2588,216 @@ var transformers_1 = require("./transformers");
                 }
             });
         }); });
+        (0, bun_test_1.it)("returns 400 when X-Unmodified-Since-ISO header is an invalid date", function () { return __awaiter(void 0, void 0, void 0, function () {
+            var res;
+            return __generator(this, function (_a) {
+                switch (_a.label) {
+                    case 0: return [4 /*yield*/, agent
+                            .patch("/food/".concat(spinach._id))
+                            .set("X-Unmodified-Since-ISO", "not-a-date")
+                            .send({ name: "Bad Date" })
+                            .expect(400)];
+                    case 1:
+                        res = _a.sent();
+                        (0, bun_test_1.expect)(res.body.title).toBe("Invalid conflict-detection timestamp");
+                        (0, bun_test_1.expect)(res.body.detail).toContain("X-Unmodified-Since-ISO");
+                        return [2 /*return*/];
+                }
+            });
+        }); });
+        (0, bun_test_1.it)("returns 400 when If-Unmodified-Since header is an invalid HTTP date", function () { return __awaiter(void 0, void 0, void 0, function () {
+            var res;
+            return __generator(this, function (_a) {
+                switch (_a.label) {
+                    case 0: return [4 /*yield*/, agent
+                            .patch("/food/".concat(spinach._id))
+                            .set("If-Unmodified-Since", "not-a-valid-http-date")
+                            .send({ name: "Bad HTTP Date" })
+                            .expect(400)];
+                    case 1:
+                        res = _a.sent();
+                        (0, bun_test_1.expect)(res.body.title).toBe("Invalid conflict-detection timestamp");
+                        (0, bun_test_1.expect)(res.body.detail).toContain("If-Unmodified-Since");
+                        return [2 /*return*/];
+                }
+            });
+        }); });
+        (0, bun_test_1.it)("returns 400 when _updatedAt body field is an invalid date", function () { return __awaiter(void 0, void 0, void 0, function () {
+            var res;
+            return __generator(this, function (_a) {
+                switch (_a.label) {
+                    case 0: return [4 /*yield*/, agent
+                            .patch("/food/".concat(spinach._id))
+                            .send({ _updatedAt: "garbage-date", name: "Bad Body Date" })
+                            .expect(400)];
+                    case 1:
+                        res = _a.sent();
+                        (0, bun_test_1.expect)(res.body.title).toBe("Invalid conflict-detection timestamp");
+                        (0, bun_test_1.expect)(res.body.detail).toContain("_updatedAt");
+                        return [2 /*return*/];
+                }
+            });
+        }); });
+        (0, bun_test_1.it)("handles doc timestamp stored as ISO string", function () { return __awaiter(void 0, void 0, void 0, function () {
+            var res;
+            return __generator(this, function (_a) {
+                switch (_a.label) {
+                    case 0: return [4 /*yield*/, tests_1.FoodModel.collection.updateOne({ _id: spinach._id }, { $set: { updated: "2025-06-15T12:00:00.000Z" } })];
+                    case 1:
+                        _a.sent();
+                        return [4 /*yield*/, agent
+                                .patch("/food/".concat(spinach._id))
+                                .set("If-Unmodified-Since", luxon_1.DateTime.fromISO("2025-06-15T11:00:00.000Z").toHTTP())
+                                .send({ name: "String Timestamp" })
+                                .expect(409)];
+                    case 2:
+                        res = _a.sent();
+                        (0, bun_test_1.expect)(res.body.error).toBe("Conflict");
+                        return [2 /*return*/];
+                }
+            });
+        }); });
+    });
+    (0, bun_test_1.describe)("three-arg modelRouter registration", function () {
+        (0, bun_test_1.it)("returns a ModelRouterRegistration with path and realtime", function () {
+            var registration = (0, api_1.modelRouter)("/food", tests_1.FoodModel, {
+                permissions: {
+                    create: [permissions_1.Permissions.IsAny],
+                    delete: [permissions_1.Permissions.IsAny],
+                    list: [permissions_1.Permissions.IsAny],
+                    read: [permissions_1.Permissions.IsAny],
+                    update: [permissions_1.Permissions.IsAny],
+                },
+                realtime: { methods: ["create", "update", "delete"], roomStrategy: "model" },
+            });
+            (0, bun_test_1.expect)(registration).toHaveProperty("__type", "modelRouter");
+            (0, bun_test_1.expect)(registration).toHaveProperty("path", "/food");
+            (0, bun_test_1.expect)(registration).toHaveProperty("router");
+            (0, bun_test_1.expect)(registration).toHaveProperty("_buildWithOpenApi");
+        });
+        (0, bun_test_1.it)("logs a warning when realtime config is used without the path form", function () {
+            var router = (0, api_1.modelRouter)(tests_1.FoodModel, {
+                permissions: {
+                    create: [permissions_1.Permissions.IsAny],
+                    delete: [permissions_1.Permissions.IsAny],
+                    list: [permissions_1.Permissions.IsAny],
+                    read: [permissions_1.Permissions.IsAny],
+                    update: [permissions_1.Permissions.IsAny],
+                },
+                realtime: { methods: ["create", "update", "delete"], roomStrategy: "model" },
+            });
+            // Returns a plain Router, not a registration, because no path was given
+            (0, bun_test_1.expect)(router).toBeDefined();
+            (0, bun_test_1.expect)(router).not.toHaveProperty("__type");
+        });
+    });
+    (0, bun_test_1.describe)("create transform error wrapping", function () {
+        var admin;
+        var agent;
+        (0, bun_test_1.beforeEach)(function () { return __awaiter(void 0, void 0, void 0, function () {
+            var _a;
+            return __generator(this, function (_b) {
+                switch (_b.label) {
+                    case 0: return [4 /*yield*/, (0, tests_1.setupDb)()];
+                    case 1:
+                        _a = __read.apply(void 0, [_b.sent(), 1]), admin = _a[0];
+                        app = (0, tests_1.getBaseServer)();
+                        (0, auth_1.setupAuth)(app, tests_1.UserModel);
+                        (0, auth_1.addAuthRoutes)(app, tests_1.UserModel);
+                        app.use("/food", (0, api_1.modelRouter)(tests_1.FoodModel, {
+                            permissions: {
+                                create: [permissions_1.Permissions.IsAny],
+                                delete: [permissions_1.Permissions.IsAny],
+                                list: [permissions_1.Permissions.IsAny],
+                                read: [permissions_1.Permissions.IsAny],
+                                update: [permissions_1.Permissions.IsAny],
+                            },
+                            transformer: {
+                                transform: function () {
+                                    throw new Error("generic transform error");
+                                },
+                            },
+                        }));
+                        server = (0, supertest_1.default)(app);
+                        return [4 /*yield*/, (0, tests_1.authAsUser)(app, "admin")];
+                    case 2:
+                        agent = _b.sent();
+                        return [2 /*return*/];
+                }
+            });
+        }); });
+        (0, bun_test_1.it)("wraps non-APIError transform errors in a 400 APIError on create", function () { return __awaiter(void 0, void 0, void 0, function () {
+            var res;
+            return __generator(this, function (_a) {
+                switch (_a.label) {
+                    case 0: return [4 /*yield*/, agent
+                            .post("/food")
+                            .send({ calories: 10, name: "New Food", ownerId: admin._id })
+                            .expect(400)];
+                    case 1:
+                        res = _a.sent();
+                        (0, bun_test_1.expect)(res.body.title).toContain("generic transform error");
+                        return [2 /*return*/];
+                }
+            });
+        }); });
+    });
+    (0, bun_test_1.describe)("update transform error wrapping", function () {
+        var admin;
+        var agent;
+        var spinach;
+        (0, bun_test_1.beforeEach)(function () { return __awaiter(void 0, void 0, void 0, function () {
+            var _a;
+            return __generator(this, function (_b) {
+                switch (_b.label) {
+                    case 0: return [4 /*yield*/, (0, tests_1.setupDb)()];
+                    case 1:
+                        _a = __read.apply(void 0, [_b.sent(), 1]), admin = _a[0];
+                        return [4 /*yield*/, tests_1.FoodModel.create({
+                                calories: 10,
+                                created: new Date(),
+                                hidden: false,
+                                name: "Spinach",
+                                ownerId: admin._id,
+                            })];
+                    case 2:
+                        spinach = _b.sent();
+                        app = (0, tests_1.getBaseServer)();
+                        (0, auth_1.setupAuth)(app, tests_1.UserModel);
+                        (0, auth_1.addAuthRoutes)(app, tests_1.UserModel);
+                        app.use("/food", (0, api_1.modelRouter)(tests_1.FoodModel, {
+                            permissions: {
+                                create: [permissions_1.Permissions.IsAny],
+                                delete: [permissions_1.Permissions.IsAny],
+                                list: [permissions_1.Permissions.IsAny],
+                                read: [permissions_1.Permissions.IsAny],
+                                update: [permissions_1.Permissions.IsAny],
+                            },
+                            transformer: {
+                                transform: function () {
+                                    throw new Error("update transform error");
+                                },
+                            },
+                        }));
+                        server = (0, supertest_1.default)(app);
+                        return [4 /*yield*/, (0, tests_1.authAsUser)(app, "admin")];
+                    case 3:
+                        agent = _b.sent();
+                        return [2 /*return*/];
+                }
+            });
+        }); });
+        (0, bun_test_1.it)("wraps non-APIError transform errors in a 403 APIError on update", function () { return __awaiter(void 0, void 0, void 0, function () {
+            var res;
+            return __generator(this, function (_a) {
+                switch (_a.label) {
+                    case 0: return [4 /*yield*/, agent.patch("/food/".concat(spinach._id)).send({ name: "Updated" }).expect(403)];
+                    case 1:
+                        res = _a.sent();
+                        (0, bun_test_1.expect)(res.body.title).toContain("update transform error");
+                        return [2 /*return*/];
+                }
+            });
+        }); });
     });
 });