Concerns about unintended deletion with deleteMany when field not found

[soomyProd]

Hi community !

I recently encountered a situation where the use of deleteMany in Mongoose could lead to unintended deletions when a field specified in the query is not found in the schema.

Consider the following scenario:

await Participation.deleteMany({ user_id: req.params.id });

If the field user_id does not exist in the schema, the query seems to match all documents in the collection, resulting in the deletion of all documents, which could be critical.

I understand that Mongoose operates based on the queries it receives, but I wanted to bring attention to the potential risk this behavior poses in terms of unintended data loss. This situation might be common among developers, especially those transitioning between different projects with different schema conventions.

I would like to open a discussion on whether there could be a way to handle such cases more gracefully, perhaps by throwing a warning or error when a field in the query is not found in the schema, or by providing a mechanism to check the validity of the fields before performing the delete operation.

Has anyone else experienced similar concerns? What are your thoughts on potential improvements in this area?

[vkarpov15]

This behavior is configured by the strictQuery option, and the behavior of "ignore fields in filter that aren't in the schema" was only the default behavior in Mongoose 6. Mongoose 7 and later don't have that behavior enabled by default.

If you want to disable this behavior in Mongoose 6, just do the following. Or upgrade to Mongoose 7.

mongoose.set('strictQuery', false);