Allow passing subdocument with { defaults: false } to query filter

[g-ongenae]

Prerequisites

• I have written a descriptive issue title
• I have searched existing issues to ensure the bug has not already been reported

Mongoose version

7.1.1

Node.js version

18.16.0

MongoDB server version

5.4.0

Typescript version (if applicable)

4.2.4

Description

Sub-document in filter is converted to model and gets default values set.

So a filter: { bookHolder: {} } // works also with { bookHolder: { isReading: true } }
Get converted: { bookHolder: { comments: [] } } // a mongoose document

This conversion ends up returning incorrect results from the find.

Steps to Reproduce

On a collection Book

{
  "bookHolder": {
    "isReading": boolean,
    "bookedAt": Date,
    "maxBookingDate": Date,
    "comments": { "postedAt": Date, "message": string }[] // default: []
  }
}

Do:

await this.collection.find({ bookHolder: { isReading: true } }).exec();

(I will create a sample app to reproduce it later.)

Expected Behavior

The request filter is not converted to a mongoose object.
Default values are not set in the filter.
The result of the request is not impacted by default values of the schema/collection.

[vkarpov15]

This is currently expected behavior. Mongoose will cast and apply defaults when you do an exact equality match on a subdocument, because otherwise you would have to explicitly define defaults in your query filter yourself.

Keep in mind that collection.find({ bookHolder: { isReading: true } }) means "find all documents where bookHolder is exactly deep equal to the object { isReading: true }". You created a document through Mongoose with defaults set, you would need the defaults in your query filter.

More often than not, you want to do collection.find({ 'bookHolder.isReading': true }), which means "find all documents where bookHolder is an object with an isReading property that is equal to true".

That being said, it is problematic that Mongoose doesn't have a functioning workaround for skipping applying defaults on subdocuments. My recommended workaround would be to explicitly create an instance of the bookHolder subdocument with { defaults: false } as follows:

'use strict';

const mongoose = require('mongoose');
mongoose.set('debug', true);

run().catch(err => console.log(err));

async function run() {
  const schema = mongoose.Schema({
    title: String,
    bookHolder: mongoose.Schema({
      isReading: Boolean,
      tags: [String]
    })
  });
  const Test = mongoose.model('Test', schema);

  await mongoose.connect('mongodb://127.0.0.1:27017/mongoose_test');
  await mongoose.connection.dropDatabase();

  const BookHolder = schema.path('bookHolder').caster;

  await Test.create({ title: 'foo', bookHolder: { isReading: true } });

  // Create a new BookHolder subdocument, skip applying defaults
  const bookHolder = new BookHolder(
    { isReading: true },
    null,
    null,
    { defaults: false }
  );
  const doc = await Test.findOne({ bookHolder });
  console.log(doc);
}

But, unfortunately, that doesn't currently work because of some internal logic Mongoose uses for copying query filters. We're working on a fix.

[ghost91-]

@vkarpov15 The problem still exists for us in 7.4.0 (and 7.3.4): There are still circular references in the filter object that dd-trace tries to stringify.

This is now a major problem for us, since there is no version of mongoose we can upgrade to, to avoid GHSA-9m93-w8w6-76hh, that does not cause our service to crash.

[vkarpov15]

@ghost91- I don't see how your issue relates to OP's, or even what your issue is. Can you please open a new issue and follow the issue template?