@terreno/api 0.9.2 → 0.10.0

package/dist/permissions.middleware.test.js

@@ -0,0 +1,341 @@
+"use strict";
+var __assign = (this && this.__assign) || function () {
+    __assign = Object.assign || function(t) {
+        for (var s, i = 1, n = arguments.length; i < n; i++) {
+            s = arguments[i];
+            for (var p in s) if (Object.prototype.hasOwnProperty.call(s, p))
+                t[p] = s[p];
+        }
+        return t;
+    };
+    return __assign.apply(this, arguments);
+};
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, generator) {
+    function adopt(value) { return value instanceof P ? value : new P(function (resolve) { resolve(value); }); }
+    return new (P || (P = Promise))(function (resolve, reject) {
+        function fulfilled(value) { try { step(generator.next(value)); } catch (e) { reject(e); } }
+        function rejected(value) { try { step(generator["throw"](value)); } catch (e) { reject(e); } }
+        function step(result) { result.done ? resolve(result.value) : adopt(result.value).then(fulfilled, rejected); }
+        step((generator = generator.apply(thisArg, _arguments || [])).next());
+    });
+};
+var __generator = (this && this.__generator) || function (thisArg, body) {
+    var _ = { label: 0, sent: function() { if (t[0] & 1) throw t[1]; return t[1]; }, trys: [], ops: [] }, f, y, t, g = Object.create((typeof Iterator === "function" ? Iterator : Object).prototype);
+    return g.next = verb(0), g["throw"] = verb(1), g["return"] = verb(2), typeof Symbol === "function" && (g[Symbol.iterator] = function() { return this; }), g;
+    function verb(n) { return function (v) { return step([n, v]); }; }
+    function step(op) {
+        if (f) throw new TypeError("Generator is already executing.");
+        while (g && (g = 0, op[0] && (_ = 0)), _) try {
+            if (f = 1, y && (t = op[0] & 2 ? y["return"] : op[0] ? y["throw"] || ((t = y["return"]) && t.call(y), 0) : y.next) && !(t = t.call(y, op[1])).done) return t;
+            if (y = 0, t) op = [op[0] & 2, t.value];
+            switch (op[0]) {
+                case 0: case 1: t = op; break;
+                case 4: _.label++; return { value: op[1], done: false };
+                case 5: _.label++; y = op[1]; op = [0]; continue;
+                case 7: op = _.ops.pop(); _.trys.pop(); continue;
+                default:
+                    if (!(t = _.trys, t = t.length > 0 && t[t.length - 1]) && (op[0] === 6 || op[0] === 2)) { _ = 0; continue; }
+                    if (op[0] === 3 && (!t || (op[1] > t[0] && op[1] < t[3]))) { _.label = op[1]; break; }
+                    if (op[0] === 6 && _.label < t[1]) { _.label = t[1]; t = op; break; }
+                    if (t && _.label < t[2]) { _.label = t[2]; _.ops.push(op); break; }
+                    if (t[2]) _.ops.pop();
+                    _.trys.pop(); continue;
+            }
+            op = body.call(thisArg, _);
+        } catch (e) { op = [6, e]; y = 0; } finally { f = t = 0; }
+        if (op[0] & 5) throw op[1]; return { value: op[0] ? op[1] : void 0, done: true };
+    }
+};
+var __read = (this && this.__read) || function (o, n) {
+    var m = typeof Symbol === "function" && o[Symbol.iterator];
+    if (!m) return o;
+    var i = m.call(o), r, ar = [], e;
+    try {
+        while ((n === void 0 || n-- > 0) && !(r = i.next()).done) ar.push(r.value);
+    }
+    catch (error) { e = { error: error }; }
+    finally {
+        try {
+            if (r && !r.done && (m = i["return"])) m.call(i);
+        }
+        finally { if (e) throw e.error; }
+    }
+    return ar;
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+var bun_test_1 = require("bun:test");
+var Sentry = __importStar(require("@sentry/bun"));
+var errors_1 = require("./errors");
+var permissions_1 = require("./permissions");
+(0, bun_test_1.describe)("permissionMiddleware", function () {
+    var allPermissions = {
+        create: [permissions_1.Permissions.IsAny],
+        delete: [permissions_1.Permissions.IsAny],
+        list: [permissions_1.Permissions.IsAny],
+        read: [permissions_1.Permissions.IsAny],
+        update: [permissions_1.Permissions.IsAny],
+    };
+    var buildReq = function (overrides) {
+        if (overrides === void 0) { overrides = {}; }
+        return __assign({ method: "GET", params: {}, user: { id: "user-1" } }, overrides);
+    };
+    (0, bun_test_1.it)("calls next immediately for OPTIONS requests", function () { return __awaiter(void 0, void 0, void 0, function () {
+        var model, middleware, next;
+        return __generator(this, function (_a) {
+            switch (_a.label) {
+                case 0:
+                    model = {
+                        collection: { findOne: (0, bun_test_1.mock)(function () { return __awaiter(void 0, void 0, void 0, function () { return __generator(this, function (_a) {
+                                return [2 /*return*/, null];
+                            }); }); }) },
+                        findById: (0, bun_test_1.mock)(function () { return ({ exec: (0, bun_test_1.mock)(function () { return __awaiter(void 0, void 0, void 0, function () { return __generator(this, function (_a) {
+                                return [2 /*return*/, null];
+                            }); }); }) }); }),
+                        modelName: "MockModel",
+                    };
+                    middleware = (0, permissions_1.permissionMiddleware)(model, { permissions: allPermissions });
+                    next = (0, bun_test_1.mock)(function () { });
+                    return [4 /*yield*/, middleware(buildReq({ method: "OPTIONS" }), {}, next)];
+                case 1:
+                    _a.sent();
+                    (0, bun_test_1.expect)(next).toHaveBeenCalledTimes(1);
+                    (0, bun_test_1.expect)(next.mock.calls[0]).toEqual([]);
+                    (0, bun_test_1.expect)(model.findById).toHaveBeenCalledTimes(0);
+                    return [2 /*return*/];
+            }
+        });
+    }); });
+    (0, bun_test_1.it)("returns APIError for unsupported HTTP methods", function () { return __awaiter(void 0, void 0, void 0, function () {
+        var model, middleware, next, _a, error;
+        return __generator(this, function (_b) {
+            switch (_b.label) {
+                case 0:
+                    model = {
+                        collection: { findOne: (0, bun_test_1.mock)(function () { return __awaiter(void 0, void 0, void 0, function () { return __generator(this, function (_a) {
+                                return [2 /*return*/, null];
+                            }); }); }) },
+                        findById: (0, bun_test_1.mock)(function () { return ({ exec: (0, bun_test_1.mock)(function () { return __awaiter(void 0, void 0, void 0, function () { return __generator(this, function (_a) {
+                                return [2 /*return*/, null];
+                            }); }); }) }); }),
+                        modelName: "MockModel",
+                    };
+                    middleware = (0, permissions_1.permissionMiddleware)(model, { permissions: allPermissions });
+                    next = (0, bun_test_1.mock)(function () { });
+                    return [4 /*yield*/, middleware(buildReq({ method: "TRACE" }), {}, next)];
+                case 1:
+                    _b.sent();
+                    (0, bun_test_1.expect)(next).toHaveBeenCalledTimes(1);
+                    _a = __read(next.mock.calls[0], 1), error = _a[0];
+                    (0, bun_test_1.expect)(error).toBeInstanceOf(errors_1.APIError);
+                    (0, bun_test_1.expect)(error.status).toBe(405);
+                    (0, bun_test_1.expect)(error.title).toContain("Method TRACE not allowed");
+                    return [2 /*return*/];
+            }
+        });
+    }); });
+    (0, bun_test_1.it)("wraps query execution failures in a 500 APIError", function () { return __awaiter(void 0, void 0, void 0, function () {
+        var exec, model, middleware, next, _a, error;
+        return __generator(this, function (_b) {
+            switch (_b.label) {
+                case 0:
+                    exec = (0, bun_test_1.mock)(function () { return __awaiter(void 0, void 0, void 0, function () {
+                        return __generator(this, function (_a) {
+                            throw new Error("query failed");
+                        });
+                    }); });
+                    model = {
+                        collection: { findOne: (0, bun_test_1.mock)(function () { return __awaiter(void 0, void 0, void 0, function () { return __generator(this, function (_a) {
+                                return [2 /*return*/, null];
+                            }); }); }) },
+                        findById: (0, bun_test_1.mock)(function () { return ({ exec: exec }); }),
+                        modelName: "MockModel",
+                    };
+                    middleware = (0, permissions_1.permissionMiddleware)(model, { permissions: allPermissions });
+                    next = (0, bun_test_1.mock)(function () { });
+                    return [4 /*yield*/, middleware(buildReq({ method: "GET", params: { id: "507f1f77bcf86cd799439011" } }), {}, next)];
+                case 1:
+                    _b.sent();
+                    (0, bun_test_1.expect)(exec).toHaveBeenCalledTimes(1);
+                    _a = __read(next.mock.calls[0], 1), error = _a[0];
+                    (0, bun_test_1.expect)(error).toBeInstanceOf(errors_1.APIError);
+                    (0, bun_test_1.expect)(error.status).toBe(500);
+                    (0, bun_test_1.expect)(error.title).toContain("GET failed on 507f1f77bcf86cd799439011");
+                    return [2 /*return*/];
+            }
+        });
+    }); });
+    (0, bun_test_1.it)("captures sentry message when document does not exist", function () { return __awaiter(void 0, void 0, void 0, function () {
+        var captureMessageSpy, model, middleware, next, _a, error;
+        return __generator(this, function (_b) {
+            switch (_b.label) {
+                case 0:
+                    captureMessageSpy = (0, bun_test_1.spyOn)(Sentry, "captureMessage");
+                    model = {
+                        collection: { findOne: (0, bun_test_1.mock)(function () { return __awaiter(void 0, void 0, void 0, function () { return __generator(this, function (_a) {
+                                return [2 /*return*/, null];
+                            }); }); }) },
+                        findById: (0, bun_test_1.mock)(function () { return ({ exec: (0, bun_test_1.mock)(function () { return __awaiter(void 0, void 0, void 0, function () { return __generator(this, function (_a) {
+                                return [2 /*return*/, null];
+                            }); }); }) }); }),
+                        modelName: "MockModel",
+                    };
+                    middleware = (0, permissions_1.permissionMiddleware)(model, { permissions: allPermissions });
+                    next = (0, bun_test_1.mock)(function () { });
+                    return [4 /*yield*/, middleware(buildReq({ method: "GET", params: { id: "507f1f77bcf86cd799439011" } }), {}, next)];
+                case 1:
+                    _b.sent();
+                    (0, bun_test_1.expect)(captureMessageSpy).toHaveBeenCalledWith("Document 507f1f77bcf86cd799439011 not found for model MockModel");
+                    _a = __read(next.mock.calls[0], 1), error = _a[0];
+                    (0, bun_test_1.expect)(error).toBeInstanceOf(errors_1.APIError);
+                    (0, bun_test_1.expect)(error.status).toBe(404);
+                    (0, bun_test_1.expect)(error.meta).toBeUndefined();
+                    captureMessageSpy.mockRestore();
+                    return [2 /*return*/];
+            }
+        });
+    }); });
+    (0, bun_test_1.it)("returns hidden reason metadata when document is deleted", function () { return __awaiter(void 0, void 0, void 0, function () {
+        var model, middleware, next, _a, error;
+        return __generator(this, function (_b) {
+            switch (_b.label) {
+                case 0:
+                    model = {
+                        collection: { findOne: (0, bun_test_1.mock)(function () { return __awaiter(void 0, void 0, void 0, function () { return __generator(this, function (_a) {
+                                return [2 /*return*/, ({ deleted: true })];
+                            }); }); }) },
+                        findById: (0, bun_test_1.mock)(function () { return ({ exec: (0, bun_test_1.mock)(function () { return __awaiter(void 0, void 0, void 0, function () { return __generator(this, function (_a) {
+                                return [2 /*return*/, null];
+                            }); }); }) }); }),
+                        modelName: "MockModel",
+                    };
+                    middleware = (0, permissions_1.permissionMiddleware)(model, { permissions: allPermissions });
+                    next = (0, bun_test_1.mock)(function () { });
+                    return [4 /*yield*/, middleware(buildReq({ method: "GET", params: { id: "507f1f77bcf86cd799439011" } }), {}, next)];
+                case 1:
+                    _b.sent();
+                    _a = __read(next.mock.calls[0], 1), error = _a[0];
+                    (0, bun_test_1.expect)(error).toBeInstanceOf(errors_1.APIError);
+                    (0, bun_test_1.expect)(error.status).toBe(404);
+                    (0, bun_test_1.expect)(error.meta).toEqual({ deleted: "true" });
+                    (0, bun_test_1.expect)(error.disableExternalErrorTracking).toBe(true);
+                    return [2 /*return*/];
+            }
+        });
+    }); });
+    (0, bun_test_1.it)("returns hidden reason metadata when document is disabled", function () { return __awaiter(void 0, void 0, void 0, function () {
+        var model, middleware, next, _a, error;
+        return __generator(this, function (_b) {
+            switch (_b.label) {
+                case 0:
+                    model = {
+                        collection: { findOne: (0, bun_test_1.mock)(function () { return __awaiter(void 0, void 0, void 0, function () { return __generator(this, function (_a) {
+                                return [2 /*return*/, ({ disabled: true })];
+                            }); }); }) },
+                        findById: (0, bun_test_1.mock)(function () { return ({ exec: (0, bun_test_1.mock)(function () { return __awaiter(void 0, void 0, void 0, function () { return __generator(this, function (_a) {
+                                return [2 /*return*/, null];
+                            }); }); }) }); }),
+                        modelName: "MockModel",
+                    };
+                    middleware = (0, permissions_1.permissionMiddleware)(model, { permissions: allPermissions });
+                    next = (0, bun_test_1.mock)(function () { });
+                    return [4 /*yield*/, middleware(buildReq({ method: "GET", params: { id: "507f1f77bcf86cd799439011" } }), {}, next)];
+                case 1:
+                    _b.sent();
+                    _a = __read(next.mock.calls[0], 1), error = _a[0];
+                    (0, bun_test_1.expect)(error).toBeInstanceOf(errors_1.APIError);
+                    (0, bun_test_1.expect)(error.status).toBe(404);
+                    (0, bun_test_1.expect)(error.meta).toEqual({ disabled: "true" });
+                    (0, bun_test_1.expect)(error.disableExternalErrorTracking).toBe(true);
+                    return [2 /*return*/];
+            }
+        });
+    }); });
+    (0, bun_test_1.it)("returns hidden reason metadata when document is archived", function () { return __awaiter(void 0, void 0, void 0, function () {
+        var model, middleware, next, _a, error;
+        return __generator(this, function (_b) {
+            switch (_b.label) {
+                case 0:
+                    model = {
+                        collection: { findOne: (0, bun_test_1.mock)(function () { return __awaiter(void 0, void 0, void 0, function () { return __generator(this, function (_a) {
+                                return [2 /*return*/, ({ archived: true })];
+                            }); }); }) },
+                        findById: (0, bun_test_1.mock)(function () { return ({ exec: (0, bun_test_1.mock)(function () { return __awaiter(void 0, void 0, void 0, function () { return __generator(this, function (_a) {
+                                return [2 /*return*/, null];
+                            }); }); }) }); }),
+                        modelName: "MockModel",
+                    };
+                    middleware = (0, permissions_1.permissionMiddleware)(model, { permissions: allPermissions });
+                    next = (0, bun_test_1.mock)(function () { });
+                    return [4 /*yield*/, middleware(buildReq({ method: "GET", params: { id: "507f1f77bcf86cd799439011" } }), {}, next)];
+                case 1:
+                    _b.sent();
+                    _a = __read(next.mock.calls[0], 1), error = _a[0];
+                    (0, bun_test_1.expect)(error).toBeInstanceOf(errors_1.APIError);
+                    (0, bun_test_1.expect)(error.status).toBe(404);
+                    (0, bun_test_1.expect)(error.meta).toEqual({ archived: "true" });
+                    (0, bun_test_1.expect)(error.disableExternalErrorTracking).toBe(true);
+                    return [2 /*return*/];
+            }
+        });
+    }); });
+    (0, bun_test_1.it)("returns plain not found when hidden document has no reason", function () { return __awaiter(void 0, void 0, void 0, function () {
+        var model, middleware, next, _a, error;
+        return __generator(this, function (_b) {
+            switch (_b.label) {
+                case 0:
+                    model = {
+                        collection: { findOne: (0, bun_test_1.mock)(function () { return __awaiter(void 0, void 0, void 0, function () { return __generator(this, function (_a) {
+                                return [2 /*return*/, ({ foo: "bar" })];
+                            }); }); }) },
+                        findById: (0, bun_test_1.mock)(function () { return ({ exec: (0, bun_test_1.mock)(function () { return __awaiter(void 0, void 0, void 0, function () { return __generator(this, function (_a) {
+                                return [2 /*return*/, null];
+                            }); }); }) }); }),
+                        modelName: "MockModel",
+                    };
+                    middleware = (0, permissions_1.permissionMiddleware)(model, { permissions: allPermissions });
+                    next = (0, bun_test_1.mock)(function () { });
+                    return [4 /*yield*/, middleware(buildReq({ method: "GET", params: { id: "507f1f77bcf86cd799439011" } }), {}, next)];
+                case 1:
+                    _b.sent();
+                    _a = __read(next.mock.calls[0], 1), error = _a[0];
+                    (0, bun_test_1.expect)(error).toBeInstanceOf(errors_1.APIError);
+                    (0, bun_test_1.expect)(error.status).toBe(404);
+                    (0, bun_test_1.expect)(error.meta).toBeUndefined();
+                    return [2 /*return*/];
+            }
+        });
+    }); });
+});

package/dist/populate.d.ts

@@ -7,9 +7,9 @@ export type PopulatePath = {
 export declare const fixMixedFields: (schema: any, properties: Record<string, any>) => void;
 export declare function getOpenApiSpecForModel(model: any, { populatePaths, extraModelProperties, }?: {
     populatePaths?: PopulatePath[];
-    extraModelProperties?: any;
+    extraModelProperties?: Record<string, unknown>;
 }): {
-    properties: any;
+    properties: Record<string, unknown>;
     required: string[];
 };
 export declare function unpopulate<T>(doc: Document<T>, path: string): Document<T>;

package/dist/syncConsents.js

@@ -176,7 +176,7 @@ var syncConsents = function (definitions_1) {
         args_1[_i - 1] = arguments[_i];
     }
     return __awaiter(void 0, __spreadArray([definitions_1], __read(args_1), false), void 0, function (definitions, options) {
-        var _a, deactivateRemoved, _b, dryRun, result, slugs, activeForms, activeBySlug, slugs_1, slugs_1_1, slug, def, existing, newVersion, e_1_1, activeBySlug_1, activeBySlug_1_1, _c, slug, form, e_2_1, summary;
+        var _a, deactivateRemoved, _b, dryRun, result, slugs, activeForms, activeBySlug, slugs_1, slugs_1_1, slug, def, existing, newVersion, e_1_1, activeBySlug_1, activeBySlug_1_1, _c, slug, e_2_1, summary;
         var e_1, _d, e_2, _e;
         var _f, _g, _h, _j;
         if (options === void 0) { options = {}; }
@@ -291,7 +291,7 @@ var syncConsents = function (definitions_1) {
                     _k.label = 16;
                 case 16:
                     if (!!activeBySlug_1_1.done) return [3 /*break*/, 20];
-                    _c = __read(activeBySlug_1_1.value, 2), slug = _c[0], form = _c[1];
+                    _c = __read(activeBySlug_1_1.value, 1), slug = _c[0];
                     if (!!definitions[slug]) return [3 /*break*/, 19];
                     logger_1.logger.info("syncConsents: deactivating \"".concat(slug, "\""), { dryRun: dryRun });
                     if (!!dryRun) return [3 /*break*/, 18];

package/dist/tests/bunSetup.js

@@ -70,30 +70,35 @@ var mongoose_1 = __importDefault(require("mongoose"));
 var winston_1 = __importDefault(require("winston"));
 var expressServer_1 = require("../expressServer");
 var logger_1 = require("../logger");
+var shouldConnectToTestDb = process.env.BUN_TEST_DISABLE_DB !== "true";
 // Connect to MongoDB once for all tests
-(0, bun_test_1.beforeAll)(function () { return __awaiter(void 0, void 0, void 0, function () {
-    return __generator(this, function (_a) {
-        switch (_a.label) {
-            case 0: return [4 /*yield*/, mongoose_1.default
-                    .connect("mongodb://127.0.0.1/terreno?&connectTimeoutMS=360000")
-                    .catch(logger_1.logger.catch)];
-            case 1:
-                _a.sent();
-                return [2 /*return*/];
-        }
-    });
-}); });
+if (shouldConnectToTestDb) {
+    (0, bun_test_1.beforeAll)(function () { return __awaiter(void 0, void 0, void 0, function () {
+        return __generator(this, function (_a) {
+            switch (_a.label) {
+                case 0: return [4 /*yield*/, mongoose_1.default
+                        .connect("mongodb://127.0.0.1/terreno?&connectTimeoutMS=360000")
+                        .catch(logger_1.logger.catch)];
+                case 1:
+                    _a.sent();
+                    return [2 /*return*/];
+            }
+        });
+    }); });
+}
 // Close MongoDB connection after all tests
-(0, bun_test_1.afterAll)(function () { return __awaiter(void 0, void 0, void 0, function () {
-    return __generator(this, function (_a) {
-        switch (_a.label) {
-            case 0: return [4 /*yield*/, mongoose_1.default.connection.close()];
-            case 1:
-                _a.sent();
-                return [2 /*return*/];
-        }
-    });
-}); });
+if (shouldConnectToTestDb) {
+    (0, bun_test_1.afterAll)(function () { return __awaiter(void 0, void 0, void 0, function () {
+        return __generator(this, function (_a) {
+            switch (_a.label) {
+                case 0: return [4 /*yield*/, mongoose_1.default.connection.close()];
+                case 1:
+                    _a.sent();
+                    return [2 /*return*/];
+            }
+        });
+    }); });
+}
 var logs = [];
 var SHOW_ALL_LOGS = process.env.SHOW_ALL_TEST_LOGS === "true";
 // Create a custom stream that captures logs

package/package.json

@@ -77,6 +77,9 @@
   "license": "Apache-2.0",
   "main": "dist/index.js",
   "name": "@terreno/api",
+  "publishConfig": {
+    "access": "public"
+  },
   "peerDependencies": {
     "mongoose": "^8.0.0"
   },
@@ -100,5 +103,5 @@
     "updateSnapshot": "bun test --update-snapshots"
   },
   "types": "dist/index.d.ts",
-  "version": "0.9.2"
+  "version": "0.10.0"
 }

package/src/api.ts

@@ -72,6 +72,30 @@ const COMPLEX_QUERY_PARAMS = ["$and", "$or"];
  */
 export type RESTMethod = "list" | "create" | "read" | "update" | "delete";
 
+/**
+ * Interface for the vendored @wesleytodd/openapi Express middleware.
+ * Provides methods for building OpenAPI documentation from Express routes.
+ */
+export interface OpenApiMiddleware {
+  /** The middleware itself is callable as Express middleware. */
+  (req: express.Request, res: express.Response, next: express.NextFunction): void;
+  /** Register a path-level OpenAPI schema, returning an Express middleware that attaches the schema to the route. */
+  path: (schema?: Record<string, unknown>) => express.RequestHandler;
+  /** Register or retrieve an OpenAPI component definition (schemas, responses, parameters, etc). */
+  component: (
+    type: string,
+    name?: string,
+    description?: Record<string, unknown>
+  ) => OpenApiMiddleware | {$ref: string} | Record<string, unknown> | undefined;
+  /** Shorthand for component("schemas", ...) */
+  schema: (
+    name?: string,
+    description?: Record<string, unknown>
+  ) => OpenApiMiddleware | {$ref: string} | Record<string, unknown> | undefined;
+  /** The generated OpenAPI document */
+  document: Record<string, unknown>;
+}
+
 /**
  * This is the main configuration.
  * @param T - the base document type. This should not include Mongoose models, just the types of the object.
@@ -110,8 +134,8 @@ export interface ModelRouterOptions<T> {
    */
   queryFilter?: (
     user?: User,
-    query?: Record<string, any>
-  ) => Record<string, any> | null | Promise<Record<string, any> | null>;
+    query?: Record<string, unknown>
+  ) => Record<string, unknown> | null | Promise<Record<string, unknown> | null>;
   /**
    * Transformers allow data to be transformed before actions are executed,
    * and serialized before being returned to the user.
@@ -137,7 +161,7 @@ export interface ModelRouterOptions<T> {
    * list queries. Accepts any Mongoose-style queries, and runs for all user types.
    *    defaultQueryParams: \{hidden: false\} // By default, don't show objects with hidden=true
    * These can be overridden by the user if not disallowed by queryFilter. */
-  defaultQueryParams?: {[key: string]: any};
+  defaultQueryParams?: Record<string, unknown>;
   /**
    * Manages Mongoose populations before returning from all methods (list, read, create, etc).
    * For each population:
@@ -161,14 +185,17 @@ export interface ModelRouterOptions<T> {
    *  or 500. */
   maxLimit?: number; // defaults to 500
   /** Custom route setup function. Receives the router and optionally the full options (including openApi). */
-  endpoints?: (router: any, options?: Partial<ModelRouterOptions<T>>) => void;
+  endpoints?: (router: express.Router, options?: Partial<ModelRouterOptions<T>>) => void;
   /**
    * Hook that runs after `transformer.transform` but before the object is created.
    * Can update the body fields based on the request or the user.
    * Return null to return a generic 403 error. Throw an APIError to return a 400 with specific
    * error information.
    */
-  preCreate?: (value: any, request: express.Request) => T | Promise<T> | null;
+  preCreate?: (
+    value: Partial<T> | (Partial<T> | undefined)[] | null | undefined,
+    request: express.Request
+  ) => T | Promise<T> | null;
   /**
    * Hook that runs after `transformer.transform` but before changes are made for update operations.
    * Can update the body fields based on the request or the user.
@@ -250,17 +277,17 @@ export interface ModelRouterOptions<T> {
   /**
    * The OpenAPI generator for this server. This is used to generate the OpenAPI documentation.
    */
-  openApi?: any;
+  openApi?: OpenApiMiddleware;
   /**
    * Overwrite parts of the configuration for the OpenAPI generator.
    * This will be merged with the generated configuration.
    */
   openApiOverwrite?: {
-    get?: any;
-    list?: any;
-    create?: any;
-    update?: any;
-    delete?: any;
+    get?: Record<string, unknown>;
+    list?: Record<string, unknown>;
+    create?: Record<string, unknown>;
+    update?: Record<string, unknown>;
+    delete?: Record<string, unknown>;
   };
   /**
    * Overwrite parts of the model properties for the OpenAPI generator.
@@ -268,7 +295,7 @@ export interface ModelRouterOptions<T> {
    * This is useful if you add custom properties to the model during serialize, for example,
    * that you want to be documented and typed in the SDK.
    */
-  openApiExtraModelProperties?: any;
+  openApiExtraModelProperties?: Record<string, unknown>;
   /**
    * Enable runtime validation of request bodies against the OpenAPI schema.
    * When enabled, requests that don't match the documented schema will return 400 errors.

package/src/errors.ts

@@ -120,11 +120,14 @@ export class APIError extends Error {
       this.meta.fields = fields;
     }
     this.error = error;
-    logger.error(
-      `APIError(${status}): ${title} ${detail ? detail : ""}${
-        data.error?.stack ? `\n${data.error?.stack}` : ""
-      }`
-    );
+    const logMessage = `APIError(${status}): ${title} ${detail ? detail : ""}${
+      data.error?.stack ? `\n${data.error?.stack}` : ""
+    }`;
+    if (data.disableExternalErrorTracking) {
+      logger.warn(logMessage);
+    } else {
+      logger.error(logMessage);
+    }
   }
 }
 

package/src/expressServer.test.ts

@@ -310,21 +310,14 @@ describe("expressServer", () => {
       );
     });
 
-    // Note: The "hourly" and "minutely" aliases have a bug - they convert the
-    // schedule to a cron expression but then use the original schedule string.
-    // This test documents that current (buggy) behavior.
-    it("hourly alias fails due to bug in implementation", () => {
+    it("accepts hourly alias", () => {
       const callback = () => {};
-      expect(() => cronjob("test-hourly-alias", "hourly", callback)).toThrow(
-        "Failed to create cronjob"
-      );
+      expect(() => cronjob("test-hourly-alias", "hourly", callback)).not.toThrow();
     });
 
-    it("minutely alias fails due to bug in implementation", () => {
+    it("accepts minutely alias", () => {
       const callback = () => {};
-      expect(() => cronjob("test-minutely-alias", "minutely", callback)).toThrow(
-        "Failed to create cronjob"
-      );
+      expect(() => cronjob("test-minutely-alias", "minutely", callback)).not.toThrow();
     });
   });
 

package/src/expressServer.ts

@@ -42,7 +42,7 @@ export function setupEnvironment(): void {
   }
 }
 
-export type AddRoutes = (router: Router, options?: Partial<ModelRouterOptions<any>>) => void;
+export type AddRoutes = (router: Router, options?: Partial<ModelRouterOptions<unknown>>) => void;
 
 const logRequestsFinished = (req: any, res: any, startTime: bigint) => {
   const options = (res.locals.loggingOptions ?? {}) as LoggingOptions;
@@ -340,15 +340,11 @@ export function cronjob(
   schedule: "hourly" | "minutely" | string,
   callback: () => void
 ) {
-  let _cronSchedule = schedule;
-  if (schedule === "hourly") {
-    _cronSchedule = "0 * * * *";
-  } else if (schedule === "minutely") {
-    _cronSchedule = "* * * * *";
-  }
-  logger.info(`Adding cronjob ${name}, running at: ${schedule}`);
+  const cronSchedule =
+    schedule === "hourly" ? "0 * * * *" : schedule === "minutely" ? "* * * * *" : schedule;
+  logger.info(`Adding cronjob ${name}, running at: ${cronSchedule}`);
   try {
-    new cron.CronJob(schedule, callback, null, true, "America/Chicago");
+    new cron.CronJob(cronSchedule, callback, null, true, "America/Chicago");
   } catch (error) {
     throw new Error(`Failed to create cronjob: ${error}`);
   }

package/src/openApi.test.ts

@@ -11,6 +11,10 @@ import {Permissions} from "./permissions";
 import {FoodModel, setupDb, UserModel} from "./tests";
 
 function getMessageSummaryOpenApiMiddleware(options: Partial<ModelRouterOptions<any>>): any {
+  if (!options.openApi) {
+    throw new Error("Expected openApi to be configured for test routes");
+  }
+
   return options.openApi.path({
     parameters: [
       {
@@ -177,7 +181,7 @@ describe("openApi", () => {
 });
 
 function addRoutesPopulate(router: Router, options?: Partial<ModelRouterOptions<any>>): void {
-  options?.openApi.component("schemas", "LimitedUser", {
+  options?.openApi?.component("schemas", "LimitedUser", {
     properties: {
       email: {
         description: "LimitedUser's email",