'strict: throw' does not work for inner _id properties

[sebastian-nowak]

Even though strict is set to throw for all schemas, it does not throw for inner _id properties. The following code fails on 5.4.9:

#!/usr/bin/env node
(async function () {
  const mongoose = require('mongoose');

  mongoose.plugin((schema) => {
    schema.options.versionKey = false;
    schema.options.minimize = false;
    schema.options.strict = 'throw';
    schema.options.strictQuery = 'throw';
  });

  mongoose.connect('mongodb://localhost:27017/test', {useNewUrlParser: true});

  const schema = new mongoose.Schema({
    inner: {
      type: new mongoose.Schema({
        _id: false, // _id is disabled here
        something: {
          type: Boolean,
          required: true
        }
      }),
      require: true
    }
  });
  const Model = mongoose.model('test', schema);

  const instance = new Model({
    inner: {
      _id: mongoose.Types.ObjectId(), // property not allowed but it will validate
      something: true
    }
  });
  await instance.save(); // should fail but does not

  console.log('This message should not appear (but it will)');
})();

[vkarpov15]

As a workaround, do this:

  const schema = new mongoose.Schema({
    inner: {
      type: new mongoose.Schema({
        something: {
          type: Boolean,
          required: true
        }
      }, { _id: false }),
      require: true
    }
  });

Setting _id: false in the schema path definition as opposed to as a schema option is an odd meme that's managed to find its way into a lot of codebases despite never being documented or fully supported. We'll make it work for this case 👍