@terreno/api 0.3.1 → 0.4.2

package/dist/configuration.test.js

@@ -0,0 +1,699 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, generator) {
+    function adopt(value) { return value instanceof P ? value : new P(function (resolve) { resolve(value); }); }
+    return new (P || (P = Promise))(function (resolve, reject) {
+        function fulfilled(value) { try { step(generator.next(value)); } catch (e) { reject(e); } }
+        function rejected(value) { try { step(generator["throw"](value)); } catch (e) { reject(e); } }
+        function step(result) { result.done ? resolve(result.value) : adopt(result.value).then(fulfilled, rejected); }
+        step((generator = generator.apply(thisArg, _arguments || [])).next());
+    });
+};
+var __generator = (this && this.__generator) || function (thisArg, body) {
+    var _ = { label: 0, sent: function() { if (t[0] & 1) throw t[1]; return t[1]; }, trys: [], ops: [] }, f, y, t, g = Object.create((typeof Iterator === "function" ? Iterator : Object).prototype);
+    return g.next = verb(0), g["throw"] = verb(1), g["return"] = verb(2), typeof Symbol === "function" && (g[Symbol.iterator] = function() { return this; }), g;
+    function verb(n) { return function (v) { return step([n, v]); }; }
+    function step(op) {
+        if (f) throw new TypeError("Generator is already executing.");
+        while (g && (g = 0, op[0] && (_ = 0)), _) try {
+            if (f = 1, y && (t = op[0] & 2 ? y["return"] : op[0] ? y["throw"] || ((t = y["return"]) && t.call(y), 0) : y.next) && !(t = t.call(y, op[1])).done) return t;
+            if (y = 0, t) op = [op[0] & 2, t.value];
+            switch (op[0]) {
+                case 0: case 1: t = op; break;
+                case 4: _.label++; return { value: op[1], done: false };
+                case 5: _.label++; y = op[1]; op = [0]; continue;
+                case 7: op = _.ops.pop(); _.trys.pop(); continue;
+                default:
+                    if (!(t = _.trys, t = t.length > 0 && t[t.length - 1]) && (op[0] === 6 || op[0] === 2)) { _ = 0; continue; }
+                    if (op[0] === 3 && (!t || (op[1] > t[0] && op[1] < t[3]))) { _.label = op[1]; break; }
+                    if (op[0] === 6 && _.label < t[1]) { _.label = t[1]; t = op; break; }
+                    if (t && _.label < t[2]) { _.label = t[2]; _.ops.push(op); break; }
+                    if (t[2]) _.ops.pop();
+                    _.trys.pop(); continue;
+            }
+            op = body.call(thisArg, _);
+        } catch (e) { op = [6, e]; y = 0; } finally { f = t = 0; }
+        if (op[0] & 5) throw op[1]; return { value: op[0] ? op[1] : void 0, done: true };
+    }
+};
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+var bun_test_1 = require("bun:test");
+var mongoose_1 = __importStar(require("mongoose"));
+var supertest_1 = __importDefault(require("supertest"));
+var auth_1 = require("./auth");
+var configurationApp_1 = require("./configurationApp");
+var configurationPlugin_1 = require("./configurationPlugin");
+var errors_1 = require("./errors");
+var plugins_1 = require("./plugins");
+var tests_1 = require("./tests");
+// -- Test configuration model --
+var generalSchema = new mongoose_1.Schema({
+    appName: {
+        default: "Test App",
+        description: "Display name of the application",
+        type: String,
+    },
+    maintenanceMode: {
+        default: false,
+        description: "Enable maintenance mode",
+        type: Boolean,
+    },
+}, { _id: false });
+var integrationsSchema = new mongoose_1.Schema({
+    apiKey: {
+        default: "",
+        description: "External API key",
+        secret: true,
+        secretName: "external-api-key",
+        type: String,
+    },
+    webhookUrl: {
+        default: "https://example.com/hook",
+        description: "Webhook URL",
+        type: String,
+    },
+}, { _id: false });
+var testConfigSchema = new mongoose_1.Schema({
+    general: { default: function () { return ({}); }, description: "General settings", type: generalSchema },
+    integrations: {
+        default: function () { return ({}); },
+        description: "Integration settings",
+        type: integrationsSchema,
+    },
+}, { strict: "throw", toJSON: { virtuals: true }, toObject: { virtuals: true } });
+testConfigSchema.plugin(configurationPlugin_1.configurationPlugin);
+testConfigSchema.plugin(plugins_1.createdUpdatedPlugin);
+var TestConfig = (mongoose_1.default.models.TestConfig ||
+    mongoose_1.default.model("TestConfig", testConfigSchema));
+// -- Test model with top-level scalar fields --
+var scalarConfigSchema = new mongoose_1.Schema({
+    debugMode: { default: false, description: "Enable debug", type: Boolean },
+    siteName: { default: "My Site", description: "Site name", type: String },
+}, { strict: "throw", toJSON: { virtuals: true }, toObject: { virtuals: true } });
+scalarConfigSchema.plugin(configurationPlugin_1.configurationPlugin);
+scalarConfigSchema.plugin(plugins_1.createdUpdatedPlugin);
+var ScalarConfig = (mongoose_1.default.models.ScalarConfig ||
+    mongoose_1.default.model("ScalarConfig", scalarConfigSchema));
+// -- Helpers --
+var buildApp = function (configModel, options) {
+    var app = (0, tests_1.getBaseServer)();
+    (0, auth_1.setupAuth)(app, tests_1.UserModel);
+    (0, auth_1.addAuthRoutes)(app, tests_1.UserModel);
+    var configApp = new configurationApp_1.ConfigurationApp({
+        basePath: options === null || options === void 0 ? void 0 : options.basePath,
+        fieldOverrides: options === null || options === void 0 ? void 0 : options.fieldOverrides,
+        model: configModel,
+    });
+    configApp.register(app);
+    app.use(errors_1.apiUnauthorizedMiddleware);
+    app.use(errors_1.apiErrorMiddleware);
+    return app;
+};
+// -- Tests --
+(0, bun_test_1.describe)("configurationPlugin", function () {
+    (0, bun_test_1.beforeEach)(function () { return __awaiter(void 0, void 0, void 0, function () {
+        var _a, _b;
+        return __generator(this, function (_c) {
+            switch (_c.label) {
+                case 0: 
+                // Direct MongoDB collection delete to bypass plugin hooks
+                return [4 /*yield*/, ((_a = mongoose_1.default.connection.db) === null || _a === void 0 ? void 0 : _a.collection("testconfigs").deleteMany({}))];
+                case 1:
+                    // Direct MongoDB collection delete to bypass plugin hooks
+                    _c.sent();
+                    return [4 /*yield*/, ((_b = mongoose_1.default.connection.db) === null || _b === void 0 ? void 0 : _b.collection("scalarconfigs").deleteMany({}))];
+                case 2:
+                    _c.sent();
+                    return [2 /*return*/];
+            }
+        });
+    }); });
+    (0, bun_test_1.describe)("getConfig", function () {
+        (0, bun_test_1.it)("creates a default document when none exists", function () { return __awaiter(void 0, void 0, void 0, function () {
+            var config;
+            return __generator(this, function (_a) {
+                switch (_a.label) {
+                    case 0: return [4 /*yield*/, TestConfig.getConfig()];
+                    case 1:
+                        config = _a.sent();
+                        (0, bun_test_1.expect)(config).toBeDefined();
+                        (0, bun_test_1.expect)(config.general.appName).toBe("Test App");
+                        (0, bun_test_1.expect)(config.general.maintenanceMode).toBe(false);
+                        return [2 /*return*/];
+                }
+            });
+        }); });
+        (0, bun_test_1.it)("returns existing document on subsequent calls", function () { return __awaiter(void 0, void 0, void 0, function () {
+            var first, second;
+            return __generator(this, function (_a) {
+                switch (_a.label) {
+                    case 0: return [4 /*yield*/, TestConfig.getConfig()];
+                    case 1:
+                        first = _a.sent();
+                        return [4 /*yield*/, TestConfig.getConfig()];
+                    case 2:
+                        second = _a.sent();
+                        (0, bun_test_1.expect)(first._id.toString()).toBe(second._id.toString());
+                        return [2 /*return*/];
+                }
+            });
+        }); });
+        (0, bun_test_1.it)("returns a top-level section by key", function () { return __awaiter(void 0, void 0, void 0, function () {
+            var general;
+            return __generator(this, function (_a) {
+                switch (_a.label) {
+                    case 0: return [4 /*yield*/, TestConfig.getConfig("general")];
+                    case 1:
+                        general = _a.sent();
+                        (0, bun_test_1.expect)(general.appName).toBe("Test App");
+                        (0, bun_test_1.expect)(general.maintenanceMode).toBe(false);
+                        return [2 /*return*/];
+                }
+            });
+        }); });
+        (0, bun_test_1.it)("returns a nested value by dot-notation key", function () { return __awaiter(void 0, void 0, void 0, function () {
+            var appName;
+            return __generator(this, function (_a) {
+                switch (_a.label) {
+                    case 0: return [4 /*yield*/, TestConfig.getConfig("general.appName")];
+                    case 1:
+                        appName = _a.sent();
+                        (0, bun_test_1.expect)(appName).toBe("Test App");
+                        return [2 /*return*/];
+                }
+            });
+        }); });
+        (0, bun_test_1.it)("returns updated value after updateConfig", function () { return __awaiter(void 0, void 0, void 0, function () {
+            var appName;
+            return __generator(this, function (_a) {
+                switch (_a.label) {
+                    case 0: return [4 /*yield*/, TestConfig.updateConfig({ general: { appName: "Updated", maintenanceMode: false } })];
+                    case 1:
+                        _a.sent();
+                        return [4 /*yield*/, TestConfig.getConfig("general.appName")];
+                    case 2:
+                        appName = _a.sent();
+                        (0, bun_test_1.expect)(appName).toBe("Updated");
+                        return [2 /*return*/];
+                }
+            });
+        }); });
+    });
+    (0, bun_test_1.describe)("updateConfig", function () {
+        (0, bun_test_1.it)("creates and sets values when no document exists", function () { return __awaiter(void 0, void 0, void 0, function () {
+            var config;
+            return __generator(this, function (_a) {
+                switch (_a.label) {
+                    case 0: return [4 /*yield*/, TestConfig.updateConfig({
+                            general: { appName: "Updated", maintenanceMode: false },
+                        })];
+                    case 1:
+                        config = _a.sent();
+                        (0, bun_test_1.expect)(config.general.appName).toBe("Updated");
+                        return [2 /*return*/];
+                }
+            });
+        }); });
+        (0, bun_test_1.it)("updates existing document", function () { return __awaiter(void 0, void 0, void 0, function () {
+            var updated;
+            return __generator(this, function (_a) {
+                switch (_a.label) {
+                    case 0: return [4 /*yield*/, TestConfig.getConfig()];
+                    case 1:
+                        _a.sent();
+                        return [4 /*yield*/, TestConfig.updateConfig({
+                                general: { appName: "Changed", maintenanceMode: true },
+                            })];
+                    case 2:
+                        updated = _a.sent();
+                        (0, bun_test_1.expect)(updated.general.appName).toBe("Changed");
+                        (0, bun_test_1.expect)(updated.general.maintenanceMode).toBe(true);
+                        return [2 /*return*/];
+                }
+            });
+        }); });
+    });
+    (0, bun_test_1.describe)("singleton enforcement", function () {
+        (0, bun_test_1.it)("prevents creating a second document via save", function () { return __awaiter(void 0, void 0, void 0, function () {
+            var error_1;
+            return __generator(this, function (_a) {
+                switch (_a.label) {
+                    case 0: return [4 /*yield*/, TestConfig.getConfig()];
+                    case 1:
+                        _a.sent();
+                        _a.label = 2;
+                    case 2:
+                        _a.trys.push([2, 4, , 5]);
+                        return [4 /*yield*/, TestConfig.create({})];
+                    case 3:
+                        _a.sent();
+                        throw new Error("Should have thrown");
+                    case 4:
+                        error_1 = _a.sent();
+                        (0, bun_test_1.expect)(error_1.title || error_1.message).toInclude("Only one configuration document");
+                        return [3 /*break*/, 5];
+                    case 5: return [2 /*return*/];
+                }
+            });
+        }); });
+    });
+    (0, bun_test_1.describe)("hard delete prevention", function () {
+        (0, bun_test_1.it)("blocks deleteOne", function () { return __awaiter(void 0, void 0, void 0, function () {
+            var error_2;
+            return __generator(this, function (_a) {
+                switch (_a.label) {
+                    case 0: return [4 /*yield*/, TestConfig.getConfig()];
+                    case 1:
+                        _a.sent();
+                        _a.label = 2;
+                    case 2:
+                        _a.trys.push([2, 4, , 5]);
+                        return [4 /*yield*/, TestConfig.deleteOne({})];
+                    case 3:
+                        _a.sent();
+                        throw new Error("Should have thrown");
+                    case 4:
+                        error_2 = _a.sent();
+                        (0, bun_test_1.expect)(error_2.title || error_2.message).toInclude("Cannot hard-delete");
+                        return [3 /*break*/, 5];
+                    case 5: return [2 /*return*/];
+                }
+            });
+        }); });
+        (0, bun_test_1.it)("blocks deleteMany", function () { return __awaiter(void 0, void 0, void 0, function () {
+            var error_3;
+            return __generator(this, function (_a) {
+                switch (_a.label) {
+                    case 0: return [4 /*yield*/, TestConfig.getConfig()];
+                    case 1:
+                        _a.sent();
+                        _a.label = 2;
+                    case 2:
+                        _a.trys.push([2, 4, , 5]);
+                        return [4 /*yield*/, TestConfig.deleteMany({})];
+                    case 3:
+                        _a.sent();
+                        throw new Error("Should have thrown");
+                    case 4:
+                        error_3 = _a.sent();
+                        (0, bun_test_1.expect)(error_3.title || error_3.message).toInclude("Cannot hard-delete");
+                        return [3 /*break*/, 5];
+                    case 5: return [2 /*return*/];
+                }
+            });
+        }); });
+        (0, bun_test_1.it)("blocks findOneAndDelete", function () { return __awaiter(void 0, void 0, void 0, function () {
+            var error_4;
+            return __generator(this, function (_a) {
+                switch (_a.label) {
+                    case 0: return [4 /*yield*/, TestConfig.getConfig()];
+                    case 1:
+                        _a.sent();
+                        _a.label = 2;
+                    case 2:
+                        _a.trys.push([2, 4, , 5]);
+                        return [4 /*yield*/, TestConfig.findOneAndDelete({})];
+                    case 3:
+                        _a.sent();
+                        throw new Error("Should have thrown");
+                    case 4:
+                        error_4 = _a.sent();
+                        (0, bun_test_1.expect)(error_4.title || error_4.message).toInclude("Cannot hard-delete");
+                        return [3 /*break*/, 5];
+                    case 5: return [2 /*return*/];
+                }
+            });
+        }); });
+    });
+    (0, bun_test_1.describe)("getSecretFields", function () {
+        (0, bun_test_1.it)("discovers secret fields from nested schemas", function () {
+            var secrets = TestConfig.getSecretFields();
+            (0, bun_test_1.expect)(secrets).toHaveLength(1);
+            (0, bun_test_1.expect)(secrets[0].path).toBe("integrations.apiKey");
+            (0, bun_test_1.expect)(secrets[0].secretName).toBe("external-api-key");
+        });
+        (0, bun_test_1.it)("returns empty array when no secrets", function () {
+            var secrets = ScalarConfig.getSecretFields();
+            (0, bun_test_1.expect)(secrets).toHaveLength(0);
+        });
+    });
+    (0, bun_test_1.describe)("resolveSecrets", function () {
+        (0, bun_test_1.it)("resolves secrets from a provider", function () { return __awaiter(void 0, void 0, void 0, function () {
+            var provider, resolved;
+            return __generator(this, function (_a) {
+                switch (_a.label) {
+                    case 0:
+                        provider = {
+                            getSecret: function (name) { return __awaiter(void 0, void 0, void 0, function () { return __generator(this, function (_a) {
+                                return [2 /*return*/, (name === "external-api-key" ? "resolved-key" : null)];
+                            }); }); },
+                            name: "test-provider",
+                        };
+                        return [4 /*yield*/, TestConfig.resolveSecrets(provider)];
+                    case 1:
+                        resolved = _a.sent();
+                        (0, bun_test_1.expect)(resolved.get("integrations.apiKey")).toBe("resolved-key");
+                        return [2 /*return*/];
+                }
+            });
+        }); });
+        (0, bun_test_1.it)("handles provider failures gracefully", function () { return __awaiter(void 0, void 0, void 0, function () {
+            var provider, resolved;
+            return __generator(this, function (_a) {
+                switch (_a.label) {
+                    case 0:
+                        provider = {
+                            getSecret: function () { return __awaiter(void 0, void 0, void 0, function () {
+                                return __generator(this, function (_a) {
+                                    throw new Error("Provider down");
+                                });
+                            }); },
+                            name: "failing-provider",
+                        };
+                        return [4 /*yield*/, TestConfig.resolveSecrets(provider)];
+                    case 1:
+                        resolved = _a.sent();
+                        (0, bun_test_1.expect)(resolved.size).toBe(0);
+                        return [2 /*return*/];
+                }
+            });
+        }); });
+    });
+});
+(0, bun_test_1.describe)("ConfigurationApp routes", function () {
+    var app;
+    var adminAgent;
+    var notAdminAgent;
+    (0, bun_test_1.beforeEach)(function () { return __awaiter(void 0, void 0, void 0, function () {
+        var _a;
+        return __generator(this, function (_b) {
+            switch (_b.label) {
+                case 0: return [4 /*yield*/, (0, tests_1.setupDb)()];
+                case 1:
+                    _b.sent();
+                    return [4 /*yield*/, ((_a = mongoose_1.default.connection.db) === null || _a === void 0 ? void 0 : _a.collection("testconfigs").deleteMany({}))];
+                case 2:
+                    _b.sent();
+                    app = buildApp(TestConfig);
+                    return [4 /*yield*/, (0, tests_1.authAsUser)(app, "admin")];
+                case 3:
+                    adminAgent = _b.sent();
+                    return [4 /*yield*/, (0, tests_1.authAsUser)(app, "notAdmin")];
+                case 4:
+                    notAdminAgent = _b.sent();
+                    return [2 /*return*/];
+            }
+        });
+    }); });
+    (0, bun_test_1.describe)("GET /configuration/meta", function () {
+        (0, bun_test_1.it)("returns schema metadata for admin", function () { return __awaiter(void 0, void 0, void 0, function () {
+            var res, generalSection;
+            return __generator(this, function (_a) {
+                switch (_a.label) {
+                    case 0: return [4 /*yield*/, adminAgent.get("/configuration/meta").expect(200)];
+                    case 1:
+                        res = _a.sent();
+                        (0, bun_test_1.expect)(res.body.sections).toBeDefined();
+                        (0, bun_test_1.expect)(res.body.sections.length).toBeGreaterThan(0);
+                        generalSection = res.body.sections.find(function (s) { return s.name === "general"; });
+                        (0, bun_test_1.expect)(generalSection).toBeDefined();
+                        (0, bun_test_1.expect)(generalSection.fields.appName).toBeDefined();
+                        (0, bun_test_1.expect)(generalSection.fields.appName.type).toBe("string");
+                        return [2 /*return*/];
+                }
+            });
+        }); });
+        (0, bun_test_1.it)("marks secret fields in metadata", function () { return __awaiter(void 0, void 0, void 0, function () {
+            var res, intSection;
+            return __generator(this, function (_a) {
+                switch (_a.label) {
+                    case 0: return [4 /*yield*/, adminAgent.get("/configuration/meta").expect(200)];
+                    case 1:
+                        res = _a.sent();
+                        intSection = res.body.sections.find(function (s) { return s.name === "integrations"; });
+                        (0, bun_test_1.expect)(intSection.fields.apiKey.secret).toBe(true);
+                        (0, bun_test_1.expect)(intSection.fields.webhookUrl.secret).toBeFalsy();
+                        return [2 /*return*/];
+                }
+            });
+        }); });
+        (0, bun_test_1.it)("returns 403 for non-admin", function () { return __awaiter(void 0, void 0, void 0, function () {
+            return __generator(this, function (_a) {
+                switch (_a.label) {
+                    case 0: return [4 /*yield*/, notAdminAgent.get("/configuration/meta").expect(403)];
+                    case 1:
+                        _a.sent();
+                        return [2 /*return*/];
+                }
+            });
+        }); });
+        (0, bun_test_1.it)("returns 401 for unauthenticated user", function () { return __awaiter(void 0, void 0, void 0, function () {
+            return __generator(this, function (_a) {
+                switch (_a.label) {
+                    case 0: return [4 /*yield*/, (0, supertest_1.default)(app).get("/configuration/meta").expect(401)];
+                    case 1:
+                        _a.sent();
+                        return [2 /*return*/];
+                }
+            });
+        }); });
+    });
+    (0, bun_test_1.describe)("GET /configuration", function () {
+        (0, bun_test_1.it)("returns config values with defaults", function () { return __awaiter(void 0, void 0, void 0, function () {
+            var res;
+            return __generator(this, function (_a) {
+                switch (_a.label) {
+                    case 0: return [4 /*yield*/, adminAgent.get("/configuration").expect(200)];
+                    case 1:
+                        res = _a.sent();
+                        (0, bun_test_1.expect)(res.body.data.general.appName).toBe("Test App");
+                        (0, bun_test_1.expect)(res.body.data.general.maintenanceMode).toBe(false);
+                        return [2 /*return*/];
+                }
+            });
+        }); });
+        (0, bun_test_1.it)("redacts secret fields", function () { return __awaiter(void 0, void 0, void 0, function () {
+            var res;
+            return __generator(this, function (_a) {
+                switch (_a.label) {
+                    case 0: 
+                    // Set a secret value first
+                    return [4 /*yield*/, TestConfig.updateConfig({ integrations: { apiKey: "super-secret-key" } })];
+                    case 1:
+                        // Set a secret value first
+                        _a.sent();
+                        return [4 /*yield*/, adminAgent.get("/configuration").expect(200)];
+                    case 2:
+                        res = _a.sent();
+                        (0, bun_test_1.expect)(res.body.data.integrations.apiKey).toBe("********");
+                        (0, bun_test_1.expect)(res.body.data.integrations.webhookUrl).toBe("https://example.com/hook");
+                        return [2 /*return*/];
+                }
+            });
+        }); });
+        (0, bun_test_1.it)("does not redact empty secret fields", function () { return __awaiter(void 0, void 0, void 0, function () {
+            var res;
+            return __generator(this, function (_a) {
+                switch (_a.label) {
+                    case 0: return [4 /*yield*/, adminAgent.get("/configuration").expect(200)];
+                    case 1:
+                        res = _a.sent();
+                        // Empty string should not be redacted
+                        (0, bun_test_1.expect)(res.body.data.integrations.apiKey).toBe("");
+                        return [2 /*return*/];
+                }
+            });
+        }); });
+        (0, bun_test_1.it)("returns 403 for non-admin", function () { return __awaiter(void 0, void 0, void 0, function () {
+            return __generator(this, function (_a) {
+                switch (_a.label) {
+                    case 0: return [4 /*yield*/, notAdminAgent.get("/configuration").expect(403)];
+                    case 1:
+                        _a.sent();
+                        return [2 /*return*/];
+                }
+            });
+        }); });
+    });
+    (0, bun_test_1.describe)("PATCH /configuration", function () {
+        (0, bun_test_1.it)("updates configuration values", function () { return __awaiter(void 0, void 0, void 0, function () {
+            var res;
+            return __generator(this, function (_a) {
+                switch (_a.label) {
+                    case 0: return [4 /*yield*/, adminAgent
+                            .patch("/configuration")
+                            .send({ general: { appName: "New Name" } })
+                            .expect(200)];
+                    case 1:
+                        res = _a.sent();
+                        (0, bun_test_1.expect)(res.body.data.general.appName).toBe("New Name");
+                        return [2 /*return*/];
+                }
+            });
+        }); });
+        (0, bun_test_1.it)("redacts secrets in the response", function () { return __awaiter(void 0, void 0, void 0, function () {
+            var res;
+            return __generator(this, function (_a) {
+                switch (_a.label) {
+                    case 0: return [4 /*yield*/, adminAgent
+                            .patch("/configuration")
+                            .send({ integrations: { apiKey: "new-secret" } })
+                            .expect(200)];
+                    case 1:
+                        res = _a.sent();
+                        (0, bun_test_1.expect)(res.body.data.integrations.apiKey).toBe("********");
+                        return [2 /*return*/];
+                }
+            });
+        }); });
+        (0, bun_test_1.it)("returns 403 for non-admin", function () { return __awaiter(void 0, void 0, void 0, function () {
+            return __generator(this, function (_a) {
+                switch (_a.label) {
+                    case 0: return [4 /*yield*/, notAdminAgent
+                            .patch("/configuration")
+                            .send({ general: { appName: "Hack" } })
+                            .expect(403)];
+                    case 1:
+                        _a.sent();
+                        return [2 /*return*/];
+                }
+            });
+        }); });
+    });
+    (0, bun_test_1.describe)("POST /configuration/list-secrets", function () {
+        (0, bun_test_1.it)("returns discovered secret fields", function () { return __awaiter(void 0, void 0, void 0, function () {
+            var res;
+            return __generator(this, function (_a) {
+                switch (_a.label) {
+                    case 0: return [4 /*yield*/, adminAgent.post("/configuration/list-secrets").expect(200)];
+                    case 1:
+                        res = _a.sent();
+                        (0, bun_test_1.expect)(res.body.secretFields).toHaveLength(1);
+                        (0, bun_test_1.expect)(res.body.secretFields[0].path).toBe("integrations.apiKey");
+                        (0, bun_test_1.expect)(res.body.secretFields[0].secretName).toBe("external-api-key");
+                        return [2 /*return*/];
+                }
+            });
+        }); });
+        (0, bun_test_1.it)("returns 403 for non-admin", function () { return __awaiter(void 0, void 0, void 0, function () {
+            return __generator(this, function (_a) {
+                switch (_a.label) {
+                    case 0: return [4 /*yield*/, notAdminAgent.post("/configuration/list-secrets").expect(403)];
+                    case 1:
+                        _a.sent();
+                        return [2 /*return*/];
+                }
+            });
+        }); });
+    });
+});
+(0, bun_test_1.describe)("ConfigurationApp with scalar fields", function () {
+    var app;
+    var adminAgent;
+    (0, bun_test_1.beforeEach)(function () { return __awaiter(void 0, void 0, void 0, function () {
+        var _a;
+        return __generator(this, function (_b) {
+            switch (_b.label) {
+                case 0: return [4 /*yield*/, (0, tests_1.setupDb)()];
+                case 1:
+                    _b.sent();
+                    return [4 /*yield*/, ((_a = mongoose_1.default.connection.db) === null || _a === void 0 ? void 0 : _a.collection("scalarconfigs").deleteMany({}))];
+                case 2:
+                    _b.sent();
+                    app = buildApp(ScalarConfig);
+                    return [4 /*yield*/, (0, tests_1.authAsUser)(app, "admin")];
+                case 3:
+                    adminAgent = _b.sent();
+                    return [2 /*return*/];
+            }
+        });
+    }); });
+    (0, bun_test_1.it)("puts scalar fields into __root__ section", function () { return __awaiter(void 0, void 0, void 0, function () {
+        var res, rootSection;
+        return __generator(this, function (_a) {
+            switch (_a.label) {
+                case 0: return [4 /*yield*/, adminAgent.get("/configuration/meta").expect(200)];
+                case 1:
+                    res = _a.sent();
+                    rootSection = res.body.sections.find(function (s) { return s.name === "__root__"; });
+                    (0, bun_test_1.expect)(rootSection).toBeDefined();
+                    (0, bun_test_1.expect)(rootSection.displayName).toBe("General");
+                    (0, bun_test_1.expect)(rootSection.fields.siteName).toBeDefined();
+                    (0, bun_test_1.expect)(rootSection.fields.debugMode).toBeDefined();
+                    return [2 /*return*/];
+            }
+        });
+    }); });
+});
+(0, bun_test_1.describe)("ConfigurationApp with field overrides", function () {
+    var app;
+    var adminAgent;
+    (0, bun_test_1.beforeEach)(function () { return __awaiter(void 0, void 0, void 0, function () {
+        var _a;
+        return __generator(this, function (_b) {
+            switch (_b.label) {
+                case 0: return [4 /*yield*/, (0, tests_1.setupDb)()];
+                case 1:
+                    _b.sent();
+                    return [4 /*yield*/, ((_a = mongoose_1.default.connection.db) === null || _a === void 0 ? void 0 : _a.collection("testconfigs").deleteMany({}))];
+                case 2:
+                    _b.sent();
+                    app = buildApp(TestConfig, {
+                        fieldOverrides: { "integrations.webhookUrl": { widget: "url" } },
+                    });
+                    return [4 /*yield*/, (0, tests_1.authAsUser)(app, "admin")];
+                case 3:
+                    adminAgent = _b.sent();
+                    return [2 /*return*/];
+            }
+        });
+    }); });
+    (0, bun_test_1.it)("applies widget overrides to metadata", function () { return __awaiter(void 0, void 0, void 0, function () {
+        var res, intSection;
+        return __generator(this, function (_a) {
+            switch (_a.label) {
+                case 0: return [4 /*yield*/, adminAgent.get("/configuration/meta").expect(200)];
+                case 1:
+                    res = _a.sent();
+                    intSection = res.body.sections.find(function (s) { return s.name === "integrations"; });
+                    (0, bun_test_1.expect)(intSection.fields.webhookUrl.widget).toBe("url");
+                    return [2 /*return*/];
+            }
+        });
+    }); });
+});