CODEWITHSUNDEEP
node.jsmongodbmongoose
Leia
Leia

Reputation: 357

Mongoose {strict: throw} doesn't throw error

I tried to find the answer to this question everywhere, but it seems I'm out of luck.

I have a very simple mongoose model

var userObject = {
    profile: {
        username: {
            type: String,
            required: true,
            lowercase: true
        },
        firstname: {
            type: String,
            required: true
        },
        lastname: {
            type: String,
            required: true
        },
        img: {
            type: String,
            required: true,
            match: /^(https?:\/\/)/i
        },
        email: {
            type: String,
            match: /^[a-zA-Z0-9.!#$%&’*+/=?^_`{|}~-]+@[a-zA-Z0-9-]+(?:\.[a-zA-Z0-9-]+)*$/,
            required: true
        },
        singupdate: {
            type: Date,
            default: Date.now
        }
    }
};

And, when I create the schema I choose the option to throw an error when I add properties not in the model.

new mongoose.Schema(userObject, { strict: "throw" });

This is how I tried to catch the error. When I add valid properties the process runs and I recibe the docs created, but when I add invalid properties, the process never exits, and the logs never appear on the console.

try {
    User.create(users, function(err, docs) {
        console.log("err: " + err);
        console.log("docs: " + docs);
    });
} catch (e) {
    console.log(e.message);
}

What am I doing wrong?

Upvotes: 5

Views: 4448

Answers (3)

Mike
Mike

Reputation: 24363

As the other answers mention, setting strict only affects keys that are actually in the model's schema. So if you want to have it throw an error when trying to set invalid fields, you need to check whether the key exists in the model's schema. Here's an example of how you can do that:

const obj = await MyModel.findOne(...)
for (const key in req.body) {
  if (typeof Property.schema.obj[key] === 'undefined') {
    throw new Error(`Invalid property: ${key}`)
  }
  obj[key] = req.body[key]
}
obj.save()

Here's a way to do this with Document middleware (as long as the property names don't start with $ or _). However, I couldn't figure out how to get the updated values before they are truncated in Query middleware. If someone can figure it out, feel free to update this answer.

mySchema.pre('validate', async function () {
  for (const key of Object.keys(this)) {
    if (!/^\$|_/.test(key) && typeof MyModel.schema.obj[key] === 'undefined') {
      throw new Error(`Invalid property: ${key}`)
    }
  }
})

Upvotes: 0

dcsan
dcsan

Reputation: 12275

The docs say:

https://mongoosejs.com/docs/guide.html#strict

The strict option, (enabled by default), ensures that values passed to our model constructor that were not specified in our schema do not get saved to the db

The strict option may also be set to "throw" which will cause errors to be produced instead of dropping the bad data.

But it doesn't mean what you think it means.

NOTE: Any key/val set on the instance that does not exist in your schema is always ignored, regardless of schema option.

So 'Bad data' just encompasses data that is in the schema but wrong format. Any extra data NOT in the schema will just be silently deleted, causing maximum hair-loss and violating POLA.

Upvotes: 4

Bertrand Martel
Bertrand Martel

Reputation: 45352

If you add properties that are not part of the model, from mongoose doc :

The strict option, (enabled by default), ensures that values passed to our model constructor that were not specified in our schema do not get saved to the db

It is working like this even with strict:throw, so you don't have to worry about additional fields not referenced in the model.

Concerning the exception not triggered, Aaron Heckmann talks about this in this post regarding that an exception that is not triggered on a save with strict : throw :

This is more a misunderstanding of how mongoose works. the 'strict' option enables validation of keys/values that are attempting to be stored in the db. schemas create getters/setters on document instances that delagate to the doc.{g,s}et() methods which are validated. attaching adhoc data to a mongoose document instance doesn't trigger get/set() and as such doesn't warrant validation since there's no way that day can get saved to the db.

As the additional fields are not part of the model, they don't trigger those validation so no exception is triggered (and of course those fields are not saved in the database)

Exceptions will be thrown only if your fields that belong to the model fail this validation

Upvotes: 3

Related Questions