@aaroncadillac/crudify-mongo 3.1.0 → 3.1.1

package/CHANGELOG.md

@@ -8,6 +8,10 @@ All notable changes to this project are documented here. The format follows [Kee
 
 - **`additionalRoutes` was removed** (deprecated since the 2.x line, both the function and the array form). Passing it now throws a `TypeError` at registration pointing to the replacement. Migrate to `routes(api, ctx)` or `actions`. Because this is a breaking change on top of the published 3.0.0, the next release that includes it must be a **major** version.
 
+### Fixed
+
+- **Bulk `POST` ignored schema defaults when validating.** The array form validated each item with the static `Model.validate(data)`, which does not apply `default`s, so a bulk without a field that has a `default` (and is `required`, e.g. `status`) answered `400` while the same document sent alone worked. Each item is now built once with `new Model(data)`, validated with `doc.validate()` (defaults applied) and the same documents are passed to `Model.create(docs, { validateBeforeSave: false })` (or `insertMany`), so nothing is built or validated twice. Everything is still validated before writing (an invalid item inserts nothing), save hooks run once per document, and `createScope` checks are untouched. Release as a patch (`[patch]`).
+
 ## [3.1.0] - 2026-10-22
 
 ### Added

package/README.md

@@ -75,7 +75,7 @@ Without any configuration:
 - `options` only honour `page`, `limit` and `sort`. `limit` defaults to 50 and is capped at 100; `populate`, `select`, `lean` and `pagination: false` from the client are ignored.
 - Writes drop `_id`, `__v` and the timestamps, accept no update operators besides `$set` / `$unset`, and refuse operators nested inside values.
 - Fields with `select: false` in your schema cannot be filtered or sorted on (it would be a search oracle).
-- Bulk creation goes through `Model.create`, so `pre('save')` / `post('save')` hooks always run, and an invalid item inserts nothing.
+- Bulk creation goes through `Model.create`, so `pre('save')` / `post('save')` hooks always run, schema defaults are applied before validating, and an invalid item inserts nothing.
 - Errors are mapped to a fixed shape. Duplicate keys become a generic `409`; unexpected errors become `500 Internal error` (the detail goes to your logs, never to the client).
 - Invalid ids answer `404` without touching the database.
 

package/crudify.js

@@ -233,9 +233,10 @@ const createHandlers = (c, ctx) => {
       const data = []
       for (const item of isBulk ? req.body : [req.body]) data.push(await prepare(item, req, rules))
       let docs
-      if (isBulk) { // validate everything first: an invalid item inserts nothing
-        await Promise.all(data.map(d => Model.validate(d)))
-        docs = await (c.bulk.insertMany ? Model.insertMany(data) : Model.create(data)) // create() runs save hooks
+      if (isBulk) { // build each document once (applies schema defaults) and validate all before writing: an invalid item inserts nothing
+        const built = data.map(d => new Model(d))
+        await Promise.all(built.map(d => d.validate()))
+        docs = await (c.bulk.insertMany ? Model.insertMany(built) : Model.create(built, { validateBeforeSave: false })) // create() runs save hooks; already validated
       } else docs = await Model.create(data[0])
       if (hooks.afterCreate) await hooks.afterCreate(docs, req)
       reply.code(201)

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@aaroncadillac/crudify-mongo",
-  "version": "3.1.0",
+  "version": "3.1.1",
   "description": "A secure-by-default CRUD generator for Fastify and Mongoose, with hooks, scoping and a built-in query sanitizer",
   "keywords": [
     "fastify",