@terreno/api 0.9.3 → 0.10.0

package/bunfig.unit.toml

@@ -0,0 +1,3 @@
+[test]
+root = "./src"
+preload = []

package/dist/expressServer.js

@@ -341,16 +341,10 @@ function setupServer(options) {
 }
 // Convenience method to execute cronjobs with an always-running server.
 function cronjob(name, schedule, callback) {
-    var _cronSchedule = schedule;
-    if (schedule === "hourly") {
-        _cronSchedule = "0 * * * *";
-    }
-    else if (schedule === "minutely") {
-        _cronSchedule = "* * * * *";
-    }
-    logger_1.logger.info("Adding cronjob ".concat(name, ", running at: ").concat(schedule));
+    var cronSchedule = schedule === "hourly" ? "0 * * * *" : schedule === "minutely" ? "* * * * *" : schedule;
+    logger_1.logger.info("Adding cronjob ".concat(name, ", running at: ").concat(cronSchedule));
     try {
-        new cron_1.default.CronJob(schedule, callback, null, true, "America/Chicago");
+        new cron_1.default.CronJob(cronSchedule, callback, null, true, "America/Chicago");
     }
     catch (error) {
         throw new Error("Failed to create cronjob: ".concat(error));

package/dist/expressServer.test.js

@@ -383,16 +383,13 @@ var tests_1 = require("./tests");
             var callback = function () { };
             (0, bun_test_1.expect)(function () { return (0, expressServer_1.cronjob)("test-invalid", "invalid-cron", callback); }).toThrow("Failed to create cronjob");
         });
-        // Note: The "hourly" and "minutely" aliases have a bug - they convert the
-        // schedule to a cron expression but then use the original schedule string.
-        // This test documents that current (buggy) behavior.
-        (0, bun_test_1.it)("hourly alias fails due to bug in implementation", function () {
+        (0, bun_test_1.it)("accepts hourly alias", function () {
             var callback = function () { };
-            (0, bun_test_1.expect)(function () { return (0, expressServer_1.cronjob)("test-hourly-alias", "hourly", callback); }).toThrow("Failed to create cronjob");
+            (0, bun_test_1.expect)(function () { return (0, expressServer_1.cronjob)("test-hourly-alias", "hourly", callback); }).not.toThrow();
         });
-        (0, bun_test_1.it)("minutely alias fails due to bug in implementation", function () {
+        (0, bun_test_1.it)("accepts minutely alias", function () {
             var callback = function () { };
-            (0, bun_test_1.expect)(function () { return (0, expressServer_1.cronjob)("test-minutely-alias", "minutely", callback); }).toThrow("Failed to create cronjob");
+            (0, bun_test_1.expect)(function () { return (0, expressServer_1.cronjob)("test-minutely-alias", "minutely", callback); }).not.toThrow();
         });
     });
     (0, bun_test_1.describe)("createRouter routePathMiddleware", function () {

package/dist/openApi.test.js

@@ -74,6 +74,9 @@ var expressServer_1 = require("./expressServer");
 var permissions_1 = require("./permissions");
 var tests_1 = require("./tests");
 function getMessageSummaryOpenApiMiddleware(options) {
+    if (!options.openApi) {
+        throw new Error("Expected openApi to be configured for test routes");
+    }
     return options.openApi.path({
         parameters: [
             {

package/dist/openApiEtag.test.js

@@ -45,6 +45,14 @@ var buildResponse = function () {
         (0, bun_test_1.expect)(next).toHaveBeenCalledTimes(1);
         (0, bun_test_1.expect)(res.json).toBe(originalJson);
     });
+    (0, bun_test_1.it)("skips GET requests for non-openapi.json paths", function () {
+        var req = buildRequest({ method: "GET", path: "/health" });
+        var _a = buildResponse(), res = _a.res, originalJson = _a.originalJson;
+        var next = (0, bun_test_1.mock)(function () { });
+        (0, openApiEtag_1.openApiEtagMiddleware)(req, res, next);
+        (0, bun_test_1.expect)(next).toHaveBeenCalledTimes(1);
+        (0, bun_test_1.expect)(res.json).toBe(originalJson);
+    });
     (0, bun_test_1.it)("sets ETag and returns json body when no matching If-None-Match header is provided", function () {
         var req = buildRequest();
         var _a = buildResponse(), res = _a.res, originalJson = _a.originalJson, set = _a.set, status = _a.status, end = _a.end;

package/dist/permissions.middleware.test.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/permissions.middleware.test.js

@@ -0,0 +1,341 @@
+"use strict";
+var __assign = (this && this.__assign) || function () {
+    __assign = Object.assign || function(t) {
+        for (var s, i = 1, n = arguments.length; i < n; i++) {
+            s = arguments[i];
+            for (var p in s) if (Object.prototype.hasOwnProperty.call(s, p))
+                t[p] = s[p];
+        }
+        return t;
+    };
+    return __assign.apply(this, arguments);
+};
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, generator) {
+    function adopt(value) { return value instanceof P ? value : new P(function (resolve) { resolve(value); }); }
+    return new (P || (P = Promise))(function (resolve, reject) {
+        function fulfilled(value) { try { step(generator.next(value)); } catch (e) { reject(e); } }
+        function rejected(value) { try { step(generator["throw"](value)); } catch (e) { reject(e); } }
+        function step(result) { result.done ? resolve(result.value) : adopt(result.value).then(fulfilled, rejected); }
+        step((generator = generator.apply(thisArg, _arguments || [])).next());
+    });
+};
+var __generator = (this && this.__generator) || function (thisArg, body) {
+    var _ = { label: 0, sent: function() { if (t[0] & 1) throw t[1]; return t[1]; }, trys: [], ops: [] }, f, y, t, g = Object.create((typeof Iterator === "function" ? Iterator : Object).prototype);
+    return g.next = verb(0), g["throw"] = verb(1), g["return"] = verb(2), typeof Symbol === "function" && (g[Symbol.iterator] = function() { return this; }), g;
+    function verb(n) { return function (v) { return step([n, v]); }; }
+    function step(op) {
+        if (f) throw new TypeError("Generator is already executing.");
+        while (g && (g = 0, op[0] && (_ = 0)), _) try {
+            if (f = 1, y && (t = op[0] & 2 ? y["return"] : op[0] ? y["throw"] || ((t = y["return"]) && t.call(y), 0) : y.next) && !(t = t.call(y, op[1])).done) return t;
+            if (y = 0, t) op = [op[0] & 2, t.value];
+            switch (op[0]) {
+                case 0: case 1: t = op; break;
+                case 4: _.label++; return { value: op[1], done: false };
+                case 5: _.label++; y = op[1]; op = [0]; continue;
+                case 7: op = _.ops.pop(); _.trys.pop(); continue;
+                default:
+                    if (!(t = _.trys, t = t.length > 0 && t[t.length - 1]) && (op[0] === 6 || op[0] === 2)) { _ = 0; continue; }
+                    if (op[0] === 3 && (!t || (op[1] > t[0] && op[1] < t[3]))) { _.label = op[1]; break; }
+                    if (op[0] === 6 && _.label < t[1]) { _.label = t[1]; t = op; break; }
+                    if (t && _.label < t[2]) { _.label = t[2]; _.ops.push(op); break; }
+                    if (t[2]) _.ops.pop();
+                    _.trys.pop(); continue;
+            }
+            op = body.call(thisArg, _);
+        } catch (e) { op = [6, e]; y = 0; } finally { f = t = 0; }
+        if (op[0] & 5) throw op[1]; return { value: op[0] ? op[1] : void 0, done: true };
+    }
+};
+var __read = (this && this.__read) || function (o, n) {
+    var m = typeof Symbol === "function" && o[Symbol.iterator];
+    if (!m) return o;
+    var i = m.call(o), r, ar = [], e;
+    try {
+        while ((n === void 0 || n-- > 0) && !(r = i.next()).done) ar.push(r.value);
+    }
+    catch (error) { e = { error: error }; }
+    finally {
+        try {
+            if (r && !r.done && (m = i["return"])) m.call(i);
+        }
+        finally { if (e) throw e.error; }
+    }
+    return ar;
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+var bun_test_1 = require("bun:test");
+var Sentry = __importStar(require("@sentry/bun"));
+var errors_1 = require("./errors");
+var permissions_1 = require("./permissions");
+(0, bun_test_1.describe)("permissionMiddleware", function () {
+    var allPermissions = {
+        create: [permissions_1.Permissions.IsAny],
+        delete: [permissions_1.Permissions.IsAny],
+        list: [permissions_1.Permissions.IsAny],
+        read: [permissions_1.Permissions.IsAny],
+        update: [permissions_1.Permissions.IsAny],
+    };
+    var buildReq = function (overrides) {
+        if (overrides === void 0) { overrides = {}; }
+        return __assign({ method: "GET", params: {}, user: { id: "user-1" } }, overrides);
+    };
+    (0, bun_test_1.it)("calls next immediately for OPTIONS requests", function () { return __awaiter(void 0, void 0, void 0, function () {
+        var model, middleware, next;
+        return __generator(this, function (_a) {
+            switch (_a.label) {
+                case 0:
+                    model = {
+                        collection: { findOne: (0, bun_test_1.mock)(function () { return __awaiter(void 0, void 0, void 0, function () { return __generator(this, function (_a) {
+                                return [2 /*return*/, null];
+                            }); }); }) },
+                        findById: (0, bun_test_1.mock)(function () { return ({ exec: (0, bun_test_1.mock)(function () { return __awaiter(void 0, void 0, void 0, function () { return __generator(this, function (_a) {
+                                return [2 /*return*/, null];
+                            }); }); }) }); }),
+                        modelName: "MockModel",
+                    };
+                    middleware = (0, permissions_1.permissionMiddleware)(model, { permissions: allPermissions });
+                    next = (0, bun_test_1.mock)(function () { });
+                    return [4 /*yield*/, middleware(buildReq({ method: "OPTIONS" }), {}, next)];
+                case 1:
+                    _a.sent();
+                    (0, bun_test_1.expect)(next).toHaveBeenCalledTimes(1);
+                    (0, bun_test_1.expect)(next.mock.calls[0]).toEqual([]);
+                    (0, bun_test_1.expect)(model.findById).toHaveBeenCalledTimes(0);
+                    return [2 /*return*/];
+            }
+        });
+    }); });
+    (0, bun_test_1.it)("returns APIError for unsupported HTTP methods", function () { return __awaiter(void 0, void 0, void 0, function () {
+        var model, middleware, next, _a, error;
+        return __generator(this, function (_b) {
+            switch (_b.label) {
+                case 0:
+                    model = {
+                        collection: { findOne: (0, bun_test_1.mock)(function () { return __awaiter(void 0, void 0, void 0, function () { return __generator(this, function (_a) {
+                                return [2 /*return*/, null];
+                            }); }); }) },
+                        findById: (0, bun_test_1.mock)(function () { return ({ exec: (0, bun_test_1.mock)(function () { return __awaiter(void 0, void 0, void 0, function () { return __generator(this, function (_a) {
+                                return [2 /*return*/, null];
+                            }); }); }) }); }),
+                        modelName: "MockModel",
+                    };
+                    middleware = (0, permissions_1.permissionMiddleware)(model, { permissions: allPermissions });
+                    next = (0, bun_test_1.mock)(function () { });
+                    return [4 /*yield*/, middleware(buildReq({ method: "TRACE" }), {}, next)];
+                case 1:
+                    _b.sent();
+                    (0, bun_test_1.expect)(next).toHaveBeenCalledTimes(1);
+                    _a = __read(next.mock.calls[0], 1), error = _a[0];
+                    (0, bun_test_1.expect)(error).toBeInstanceOf(errors_1.APIError);
+                    (0, bun_test_1.expect)(error.status).toBe(405);
+                    (0, bun_test_1.expect)(error.title).toContain("Method TRACE not allowed");
+                    return [2 /*return*/];
+            }
+        });
+    }); });
+    (0, bun_test_1.it)("wraps query execution failures in a 500 APIError", function () { return __awaiter(void 0, void 0, void 0, function () {
+        var exec, model, middleware, next, _a, error;
+        return __generator(this, function (_b) {
+            switch (_b.label) {
+                case 0:
+                    exec = (0, bun_test_1.mock)(function () { return __awaiter(void 0, void 0, void 0, function () {
+                        return __generator(this, function (_a) {
+                            throw new Error("query failed");
+                        });
+                    }); });
+                    model = {
+                        collection: { findOne: (0, bun_test_1.mock)(function () { return __awaiter(void 0, void 0, void 0, function () { return __generator(this, function (_a) {
+                                return [2 /*return*/, null];
+                            }); }); }) },
+                        findById: (0, bun_test_1.mock)(function () { return ({ exec: exec }); }),
+                        modelName: "MockModel",
+                    };
+                    middleware = (0, permissions_1.permissionMiddleware)(model, { permissions: allPermissions });
+                    next = (0, bun_test_1.mock)(function () { });
+                    return [4 /*yield*/, middleware(buildReq({ method: "GET", params: { id: "507f1f77bcf86cd799439011" } }), {}, next)];
+                case 1:
+                    _b.sent();
+                    (0, bun_test_1.expect)(exec).toHaveBeenCalledTimes(1);
+                    _a = __read(next.mock.calls[0], 1), error = _a[0];
+                    (0, bun_test_1.expect)(error).toBeInstanceOf(errors_1.APIError);
+                    (0, bun_test_1.expect)(error.status).toBe(500);
+                    (0, bun_test_1.expect)(error.title).toContain("GET failed on 507f1f77bcf86cd799439011");
+                    return [2 /*return*/];
+            }
+        });
+    }); });
+    (0, bun_test_1.it)("captures sentry message when document does not exist", function () { return __awaiter(void 0, void 0, void 0, function () {
+        var captureMessageSpy, model, middleware, next, _a, error;
+        return __generator(this, function (_b) {
+            switch (_b.label) {
+                case 0:
+                    captureMessageSpy = (0, bun_test_1.spyOn)(Sentry, "captureMessage");
+                    model = {
+                        collection: { findOne: (0, bun_test_1.mock)(function () { return __awaiter(void 0, void 0, void 0, function () { return __generator(this, function (_a) {
+                                return [2 /*return*/, null];
+                            }); }); }) },
+                        findById: (0, bun_test_1.mock)(function () { return ({ exec: (0, bun_test_1.mock)(function () { return __awaiter(void 0, void 0, void 0, function () { return __generator(this, function (_a) {
+                                return [2 /*return*/, null];
+                            }); }); }) }); }),
+                        modelName: "MockModel",
+                    };
+                    middleware = (0, permissions_1.permissionMiddleware)(model, { permissions: allPermissions });
+                    next = (0, bun_test_1.mock)(function () { });
+                    return [4 /*yield*/, middleware(buildReq({ method: "GET", params: { id: "507f1f77bcf86cd799439011" } }), {}, next)];
+                case 1:
+                    _b.sent();
+                    (0, bun_test_1.expect)(captureMessageSpy).toHaveBeenCalledWith("Document 507f1f77bcf86cd799439011 not found for model MockModel");
+                    _a = __read(next.mock.calls[0], 1), error = _a[0];
+                    (0, bun_test_1.expect)(error).toBeInstanceOf(errors_1.APIError);
+                    (0, bun_test_1.expect)(error.status).toBe(404);
+                    (0, bun_test_1.expect)(error.meta).toBeUndefined();
+                    captureMessageSpy.mockRestore();
+                    return [2 /*return*/];
+            }
+        });
+    }); });
+    (0, bun_test_1.it)("returns hidden reason metadata when document is deleted", function () { return __awaiter(void 0, void 0, void 0, function () {
+        var model, middleware, next, _a, error;
+        return __generator(this, function (_b) {
+            switch (_b.label) {
+                case 0:
+                    model = {
+                        collection: { findOne: (0, bun_test_1.mock)(function () { return __awaiter(void 0, void 0, void 0, function () { return __generator(this, function (_a) {
+                                return [2 /*return*/, ({ deleted: true })];
+                            }); }); }) },
+                        findById: (0, bun_test_1.mock)(function () { return ({ exec: (0, bun_test_1.mock)(function () { return __awaiter(void 0, void 0, void 0, function () { return __generator(this, function (_a) {
+                                return [2 /*return*/, null];
+                            }); }); }) }); }),
+                        modelName: "MockModel",
+                    };
+                    middleware = (0, permissions_1.permissionMiddleware)(model, { permissions: allPermissions });
+                    next = (0, bun_test_1.mock)(function () { });
+                    return [4 /*yield*/, middleware(buildReq({ method: "GET", params: { id: "507f1f77bcf86cd799439011" } }), {}, next)];
+                case 1:
+                    _b.sent();
+                    _a = __read(next.mock.calls[0], 1), error = _a[0];
+                    (0, bun_test_1.expect)(error).toBeInstanceOf(errors_1.APIError);
+                    (0, bun_test_1.expect)(error.status).toBe(404);
+                    (0, bun_test_1.expect)(error.meta).toEqual({ deleted: "true" });
+                    (0, bun_test_1.expect)(error.disableExternalErrorTracking).toBe(true);
+                    return [2 /*return*/];
+            }
+        });
+    }); });
+    (0, bun_test_1.it)("returns hidden reason metadata when document is disabled", function () { return __awaiter(void 0, void 0, void 0, function () {
+        var model, middleware, next, _a, error;
+        return __generator(this, function (_b) {
+            switch (_b.label) {
+                case 0:
+                    model = {
+                        collection: { findOne: (0, bun_test_1.mock)(function () { return __awaiter(void 0, void 0, void 0, function () { return __generator(this, function (_a) {
+                                return [2 /*return*/, ({ disabled: true })];
+                            }); }); }) },
+                        findById: (0, bun_test_1.mock)(function () { return ({ exec: (0, bun_test_1.mock)(function () { return __awaiter(void 0, void 0, void 0, function () { return __generator(this, function (_a) {
+                                return [2 /*return*/, null];
+                            }); }); }) }); }),
+                        modelName: "MockModel",
+                    };
+                    middleware = (0, permissions_1.permissionMiddleware)(model, { permissions: allPermissions });
+                    next = (0, bun_test_1.mock)(function () { });
+                    return [4 /*yield*/, middleware(buildReq({ method: "GET", params: { id: "507f1f77bcf86cd799439011" } }), {}, next)];
+                case 1:
+                    _b.sent();
+                    _a = __read(next.mock.calls[0], 1), error = _a[0];
+                    (0, bun_test_1.expect)(error).toBeInstanceOf(errors_1.APIError);
+                    (0, bun_test_1.expect)(error.status).toBe(404);
+                    (0, bun_test_1.expect)(error.meta).toEqual({ disabled: "true" });
+                    (0, bun_test_1.expect)(error.disableExternalErrorTracking).toBe(true);
+                    return [2 /*return*/];
+            }
+        });
+    }); });
+    (0, bun_test_1.it)("returns hidden reason metadata when document is archived", function () { return __awaiter(void 0, void 0, void 0, function () {
+        var model, middleware, next, _a, error;
+        return __generator(this, function (_b) {
+            switch (_b.label) {
+                case 0:
+                    model = {
+                        collection: { findOne: (0, bun_test_1.mock)(function () { return __awaiter(void 0, void 0, void 0, function () { return __generator(this, function (_a) {
+                                return [2 /*return*/, ({ archived: true })];
+                            }); }); }) },
+                        findById: (0, bun_test_1.mock)(function () { return ({ exec: (0, bun_test_1.mock)(function () { return __awaiter(void 0, void 0, void 0, function () { return __generator(this, function (_a) {
+                                return [2 /*return*/, null];
+                            }); }); }) }); }),
+                        modelName: "MockModel",
+                    };
+                    middleware = (0, permissions_1.permissionMiddleware)(model, { permissions: allPermissions });
+                    next = (0, bun_test_1.mock)(function () { });
+                    return [4 /*yield*/, middleware(buildReq({ method: "GET", params: { id: "507f1f77bcf86cd799439011" } }), {}, next)];
+                case 1:
+                    _b.sent();
+                    _a = __read(next.mock.calls[0], 1), error = _a[0];
+                    (0, bun_test_1.expect)(error).toBeInstanceOf(errors_1.APIError);
+                    (0, bun_test_1.expect)(error.status).toBe(404);
+                    (0, bun_test_1.expect)(error.meta).toEqual({ archived: "true" });
+                    (0, bun_test_1.expect)(error.disableExternalErrorTracking).toBe(true);
+                    return [2 /*return*/];
+            }
+        });
+    }); });
+    (0, bun_test_1.it)("returns plain not found when hidden document has no reason", function () { return __awaiter(void 0, void 0, void 0, function () {
+        var model, middleware, next, _a, error;
+        return __generator(this, function (_b) {
+            switch (_b.label) {
+                case 0:
+                    model = {
+                        collection: { findOne: (0, bun_test_1.mock)(function () { return __awaiter(void 0, void 0, void 0, function () { return __generator(this, function (_a) {
+                                return [2 /*return*/, ({ foo: "bar" })];
+                            }); }); }) },
+                        findById: (0, bun_test_1.mock)(function () { return ({ exec: (0, bun_test_1.mock)(function () { return __awaiter(void 0, void 0, void 0, function () { return __generator(this, function (_a) {
+                                return [2 /*return*/, null];
+                            }); }); }) }); }),
+                        modelName: "MockModel",
+                    };
+                    middleware = (0, permissions_1.permissionMiddleware)(model, { permissions: allPermissions });
+                    next = (0, bun_test_1.mock)(function () { });
+                    return [4 /*yield*/, middleware(buildReq({ method: "GET", params: { id: "507f1f77bcf86cd799439011" } }), {}, next)];
+                case 1:
+                    _b.sent();
+                    _a = __read(next.mock.calls[0], 1), error = _a[0];
+                    (0, bun_test_1.expect)(error).toBeInstanceOf(errors_1.APIError);
+                    (0, bun_test_1.expect)(error.status).toBe(404);
+                    (0, bun_test_1.expect)(error.meta).toBeUndefined();
+                    return [2 /*return*/];
+            }
+        });
+    }); });
+});

package/dist/syncConsents.js

@@ -176,7 +176,7 @@ var syncConsents = function (definitions_1) {
         args_1[_i - 1] = arguments[_i];
     }
     return __awaiter(void 0, __spreadArray([definitions_1], __read(args_1), false), void 0, function (definitions, options) {
-        var _a, deactivateRemoved, _b, dryRun, result, slugs, activeForms, activeBySlug, slugs_1, slugs_1_1, slug, def, existing, newVersion, e_1_1, activeBySlug_1, activeBySlug_1_1, _c, slug, form, e_2_1, summary;
+        var _a, deactivateRemoved, _b, dryRun, result, slugs, activeForms, activeBySlug, slugs_1, slugs_1_1, slug, def, existing, newVersion, e_1_1, activeBySlug_1, activeBySlug_1_1, _c, slug, e_2_1, summary;
         var e_1, _d, e_2, _e;
         var _f, _g, _h, _j;
         if (options === void 0) { options = {}; }
@@ -291,7 +291,7 @@ var syncConsents = function (definitions_1) {
                     _k.label = 16;
                 case 16:
                     if (!!activeBySlug_1_1.done) return [3 /*break*/, 20];
-                    _c = __read(activeBySlug_1_1.value, 2), slug = _c[0], form = _c[1];
+                    _c = __read(activeBySlug_1_1.value, 1), slug = _c[0];
                     if (!!definitions[slug]) return [3 /*break*/, 19];
                     logger_1.logger.info("syncConsents: deactivating \"".concat(slug, "\""), { dryRun: dryRun });
                     if (!!dryRun) return [3 /*break*/, 18];

package/dist/tests/bunSetup.js

@@ -70,30 +70,35 @@ var mongoose_1 = __importDefault(require("mongoose"));
 var winston_1 = __importDefault(require("winston"));
 var expressServer_1 = require("../expressServer");
 var logger_1 = require("../logger");
+var shouldConnectToTestDb = process.env.BUN_TEST_DISABLE_DB !== "true";
 // Connect to MongoDB once for all tests
-(0, bun_test_1.beforeAll)(function () { return __awaiter(void 0, void 0, void 0, function () {
-    return __generator(this, function (_a) {
-        switch (_a.label) {
-            case 0: return [4 /*yield*/, mongoose_1.default
-                    .connect("mongodb://127.0.0.1/terreno?&connectTimeoutMS=360000")
-                    .catch(logger_1.logger.catch)];
-            case 1:
-                _a.sent();
-                return [2 /*return*/];
-        }
-    });
-}); });
+if (shouldConnectToTestDb) {
+    (0, bun_test_1.beforeAll)(function () { return __awaiter(void 0, void 0, void 0, function () {
+        return __generator(this, function (_a) {
+            switch (_a.label) {
+                case 0: return [4 /*yield*/, mongoose_1.default
+                        .connect("mongodb://127.0.0.1/terreno?&connectTimeoutMS=360000")
+                        .catch(logger_1.logger.catch)];
+                case 1:
+                    _a.sent();
+                    return [2 /*return*/];
+            }
+        });
+    }); });
+}
 // Close MongoDB connection after all tests
-(0, bun_test_1.afterAll)(function () { return __awaiter(void 0, void 0, void 0, function () {
-    return __generator(this, function (_a) {
-        switch (_a.label) {
-            case 0: return [4 /*yield*/, mongoose_1.default.connection.close()];
-            case 1:
-                _a.sent();
-                return [2 /*return*/];
-        }
-    });
-}); });
+if (shouldConnectToTestDb) {
+    (0, bun_test_1.afterAll)(function () { return __awaiter(void 0, void 0, void 0, function () {
+        return __generator(this, function (_a) {
+            switch (_a.label) {
+                case 0: return [4 /*yield*/, mongoose_1.default.connection.close()];
+                case 1:
+                    _a.sent();
+                    return [2 /*return*/];
+            }
+        });
+    }); });
+}
 var logs = [];
 var SHOW_ALL_LOGS = process.env.SHOW_ALL_TEST_LOGS === "true";
 // Create a custom stream that captures logs

package/package.json

@@ -103,5 +103,5 @@
     "updateSnapshot": "bun test --update-snapshots"
   },
   "types": "dist/index.d.ts",
-  "version": "0.9.3"
+  "version": "0.10.0"
 }

package/src/expressServer.test.ts

@@ -310,21 +310,14 @@ describe("expressServer", () => {
       );
     });
 
-    // Note: The "hourly" and "minutely" aliases have a bug - they convert the
-    // schedule to a cron expression but then use the original schedule string.
-    // This test documents that current (buggy) behavior.
-    it("hourly alias fails due to bug in implementation", () => {
+    it("accepts hourly alias", () => {
       const callback = () => {};
-      expect(() => cronjob("test-hourly-alias", "hourly", callback)).toThrow(
-        "Failed to create cronjob"
-      );
+      expect(() => cronjob("test-hourly-alias", "hourly", callback)).not.toThrow();
     });
 
-    it("minutely alias fails due to bug in implementation", () => {
+    it("accepts minutely alias", () => {
       const callback = () => {};
-      expect(() => cronjob("test-minutely-alias", "minutely", callback)).toThrow(
-        "Failed to create cronjob"
-      );
+      expect(() => cronjob("test-minutely-alias", "minutely", callback)).not.toThrow();
     });
   });
 

package/src/expressServer.ts

@@ -340,15 +340,11 @@ export function cronjob(
   schedule: "hourly" | "minutely" | string,
   callback: () => void
 ) {
-  let _cronSchedule = schedule;
-  if (schedule === "hourly") {
-    _cronSchedule = "0 * * * *";
-  } else if (schedule === "minutely") {
-    _cronSchedule = "* * * * *";
-  }
-  logger.info(`Adding cronjob ${name}, running at: ${schedule}`);
+  const cronSchedule =
+    schedule === "hourly" ? "0 * * * *" : schedule === "minutely" ? "* * * * *" : schedule;
+  logger.info(`Adding cronjob ${name}, running at: ${cronSchedule}`);
   try {
-    new cron.CronJob(schedule, callback, null, true, "America/Chicago");
+    new cron.CronJob(cronSchedule, callback, null, true, "America/Chicago");
   } catch (error) {
     throw new Error(`Failed to create cronjob: ${error}`);
   }

package/src/openApi.test.ts

@@ -11,7 +11,11 @@ import {Permissions} from "./permissions";
 import {FoodModel, setupDb, UserModel} from "./tests";
 
 function getMessageSummaryOpenApiMiddleware(options: Partial<ModelRouterOptions<any>>): any {
-  return options.openApi!.path({
+  if (!options.openApi) {
+    throw new Error("Expected openApi to be configured for test routes");
+  }
+
+  return options.openApi.path({
     parameters: [
       {
         in: "query",

package/src/openApiEtag.test.ts

@@ -61,6 +61,17 @@ describe("openApiEtagMiddleware", () => {
     expect(res.json).toBe(originalJson);
   });
 
+  it("skips GET requests for non-openapi.json paths", () => {
+    const req = buildRequest({method: "GET", path: "/health"});
+    const {res, originalJson} = buildResponse();
+    const next = mock(() => {}) as NextFunction;
+
+    openApiEtagMiddleware(req, res, next);
+
+    expect(next).toHaveBeenCalledTimes(1);
+    expect(res.json).toBe(originalJson);
+  });
+
   it("sets ETag and returns json body when no matching If-None-Match header is provided", () => {
     const req = buildRequest();
     const {res, originalJson, set, status, end} = buildResponse();

package/src/permissions.middleware.test.ts

@@ -0,0 +1,197 @@
+import {describe, expect, it, mock, spyOn} from "bun:test";
+import * as Sentry from "@sentry/bun";
+import type express from "express";
+
+import {APIError} from "./errors";
+import {Permissions, permissionMiddleware} from "./permissions";
+
+describe("permissionMiddleware", () => {
+  const allPermissions = {
+    create: [Permissions.IsAny],
+    delete: [Permissions.IsAny],
+    list: [Permissions.IsAny],
+    read: [Permissions.IsAny],
+    update: [Permissions.IsAny],
+  };
+
+  const buildReq = (overrides: Record<string, unknown> = {}): express.Request => {
+    return {
+      method: "GET",
+      params: {},
+      user: {id: "user-1"},
+      ...overrides,
+    } as unknown as express.Request;
+  };
+
+  it("calls next immediately for OPTIONS requests", async () => {
+    const model = {
+      collection: {findOne: mock(async () => null)},
+      findById: mock(() => ({exec: mock(async () => null)})),
+      modelName: "MockModel",
+    } as any;
+    const middleware = permissionMiddleware(model, {permissions: allPermissions});
+    const next = mock(() => {});
+
+    await middleware(buildReq({method: "OPTIONS"}), {} as express.Response, next as any);
+
+    expect(next).toHaveBeenCalledTimes(1);
+    expect((next as any).mock.calls[0]).toEqual([]);
+    expect(model.findById).toHaveBeenCalledTimes(0);
+  });
+
+  it("returns APIError for unsupported HTTP methods", async () => {
+    const model = {
+      collection: {findOne: mock(async () => null)},
+      findById: mock(() => ({exec: mock(async () => null)})),
+      modelName: "MockModel",
+    } as any;
+    const middleware = permissionMiddleware(model, {permissions: allPermissions});
+    const next = mock(() => {});
+
+    await middleware(buildReq({method: "TRACE"}), {} as express.Response, next as any);
+
+    expect(next).toHaveBeenCalledTimes(1);
+    const [error] = (next as any).mock.calls[0];
+    expect(error).toBeInstanceOf(APIError);
+    expect(error.status).toBe(405);
+    expect(error.title).toContain("Method TRACE not allowed");
+  });
+
+  it("wraps query execution failures in a 500 APIError", async () => {
+    const exec = mock(async () => {
+      throw new Error("query failed");
+    });
+    const model = {
+      collection: {findOne: mock(async () => null)},
+      findById: mock(() => ({exec})),
+      modelName: "MockModel",
+    } as any;
+    const middleware = permissionMiddleware(model, {permissions: allPermissions});
+    const next = mock(() => {});
+
+    await middleware(
+      buildReq({method: "GET", params: {id: "507f1f77bcf86cd799439011"}}),
+      {} as express.Response,
+      next as any
+    );
+
+    expect(exec).toHaveBeenCalledTimes(1);
+    const [error] = (next as any).mock.calls[0];
+    expect(error).toBeInstanceOf(APIError);
+    expect(error.status).toBe(500);
+    expect(error.title).toContain("GET failed on 507f1f77bcf86cd799439011");
+  });
+
+  it("captures sentry message when document does not exist", async () => {
+    const captureMessageSpy = spyOn(Sentry, "captureMessage");
+    const model = {
+      collection: {findOne: mock(async () => null)},
+      findById: mock(() => ({exec: mock(async () => null)})),
+      modelName: "MockModel",
+    } as any;
+    const middleware = permissionMiddleware(model, {permissions: allPermissions});
+    const next = mock(() => {});
+
+    await middleware(
+      buildReq({method: "GET", params: {id: "507f1f77bcf86cd799439011"}}),
+      {} as express.Response,
+      next as any
+    );
+
+    expect(captureMessageSpy).toHaveBeenCalledWith(
+      "Document 507f1f77bcf86cd799439011 not found for model MockModel"
+    );
+    const [error] = (next as any).mock.calls[0];
+    expect(error).toBeInstanceOf(APIError);
+    expect(error.status).toBe(404);
+    expect(error.meta).toBeUndefined();
+    captureMessageSpy.mockRestore();
+  });
+
+  it("returns hidden reason metadata when document is deleted", async () => {
+    const model = {
+      collection: {findOne: mock(async () => ({deleted: true}))},
+      findById: mock(() => ({exec: mock(async () => null)})),
+      modelName: "MockModel",
+    } as any;
+    const middleware = permissionMiddleware(model, {permissions: allPermissions});
+    const next = mock(() => {});
+
+    await middleware(
+      buildReq({method: "GET", params: {id: "507f1f77bcf86cd799439011"}}),
+      {} as express.Response,
+      next as any
+    );
+
+    const [error] = (next as any).mock.calls[0];
+    expect(error).toBeInstanceOf(APIError);
+    expect(error.status).toBe(404);
+    expect(error.meta).toEqual({deleted: "true"});
+    expect(error.disableExternalErrorTracking).toBe(true);
+  });
+
+  it("returns hidden reason metadata when document is disabled", async () => {
+    const model = {
+      collection: {findOne: mock(async () => ({disabled: true}))},
+      findById: mock(() => ({exec: mock(async () => null)})),
+      modelName: "MockModel",
+    } as any;
+    const middleware = permissionMiddleware(model, {permissions: allPermissions});
+    const next = mock(() => {});
+
+    await middleware(
+      buildReq({method: "GET", params: {id: "507f1f77bcf86cd799439011"}}),
+      {} as express.Response,
+      next as any
+    );
+
+    const [error] = (next as any).mock.calls[0];
+    expect(error).toBeInstanceOf(APIError);
+    expect(error.status).toBe(404);
+    expect(error.meta).toEqual({disabled: "true"});
+    expect(error.disableExternalErrorTracking).toBe(true);
+  });
+
+  it("returns hidden reason metadata when document is archived", async () => {
+    const model = {
+      collection: {findOne: mock(async () => ({archived: true}))},
+      findById: mock(() => ({exec: mock(async () => null)})),
+      modelName: "MockModel",
+    } as any;
+    const middleware = permissionMiddleware(model, {permissions: allPermissions});
+    const next = mock(() => {});
+
+    await middleware(
+      buildReq({method: "GET", params: {id: "507f1f77bcf86cd799439011"}}),
+      {} as express.Response,
+      next as any
+    );
+
+    const [error] = (next as any).mock.calls[0];
+    expect(error).toBeInstanceOf(APIError);
+    expect(error.status).toBe(404);
+    expect(error.meta).toEqual({archived: "true"});
+    expect(error.disableExternalErrorTracking).toBe(true);
+  });
+
+  it("returns plain not found when hidden document has no reason", async () => {
+    const model = {
+      collection: {findOne: mock(async () => ({foo: "bar"}))},
+      findById: mock(() => ({exec: mock(async () => null)})),
+      modelName: "MockModel",
+    } as any;
+    const middleware = permissionMiddleware(model, {permissions: allPermissions});
+    const next = mock(() => {});
+
+    await middleware(
+      buildReq({method: "GET", params: {id: "507f1f77bcf86cd799439011"}}),
+      {} as express.Response,
+      next as any
+    );
+
+    const [error] = (next as any).mock.calls[0];
+    expect(error).toBeInstanceOf(APIError);
+    expect(error.status).toBe(404);
+    expect(error.meta).toBeUndefined();
+  });
+});

package/src/syncConsents.ts

@@ -237,7 +237,7 @@ export const syncConsents = async (
 
   // Deactivate forms that are no longer in definitions
   if (deactivateRemoved) {
-    for (const [slug, form] of activeBySlug) {
+    for (const [slug] of activeBySlug) {
       if (!definitions[slug]) {
         logger.info(`syncConsents: deactivating "${slug}"`, {dryRun});
         if (!dryRun) {

package/src/tests/bunSetup.ts

@@ -6,17 +6,23 @@ import winston from "winston";
 import {setupEnvironment} from "../expressServer";
 import {logger, winstonLogger} from "../logger";
 
+const shouldConnectToTestDb = process.env.BUN_TEST_DISABLE_DB !== "true";
+
 // Connect to MongoDB once for all tests
-beforeAll(async () => {
-  await mongoose
-    .connect("mongodb://127.0.0.1/terreno?&connectTimeoutMS=360000")
-    .catch(logger.catch);
-});
+if (shouldConnectToTestDb) {
+  beforeAll(async () => {
+    await mongoose
+      .connect("mongodb://127.0.0.1/terreno?&connectTimeoutMS=360000")
+      .catch(logger.catch);
+  });
+}
 
 // Close MongoDB connection after all tests
-afterAll(async () => {
-  await mongoose.connection.close();
-});
+if (shouldConnectToTestDb) {
+  afterAll(async () => {
+    await mongoose.connection.close();
+  });
+}
 
 let logs: string[] = [];