mongoose 6.4.2 → 6.4.5

package/.eslintrc.json

@@ -187,6 +187,7 @@
       "error"
     ],
     "no-empty": "off",
-    "eol-last": "warn"
+    "eol-last": "warn",
+    "no-multiple-empty-lines": ["warn", { "max": 2 }]
   }
 }

package/lib/aggregate.js

@@ -481,7 +481,8 @@ Aggregate.prototype.sortByCount = function(arg) {
  *
  * @see $lookup https://docs.mongodb.org/manual/reference/operator/aggregation/lookup/#pipe._S_lookup
  * @param {Object} options to $lookup as described in the above link
- * @return {Aggregate}* @api public
+ * @return {Aggregate}
+ * @api public
  */
 
 Aggregate.prototype.lookup = function(options) {
@@ -1051,7 +1052,7 @@ Aggregate.prototype.catch = function(reject) {
  * You do not need to call this function explicitly, the JavaScript runtime
  * will call it for you.
  *
- * #### Example
+ * #### Example:
  *
  *     const agg = Model.aggregate([{ $match: { age: { $gte: 25 } } }]);
  *     for await (const doc of agg) {

package/lib/connection.js

@@ -93,7 +93,7 @@ Connection.prototype.__proto__ = EventEmitter.prototype;
  *
  * Each state change emits its associated event name.
  *
- * #### Example
+ * #### Example:
  *
  *     conn.on('connected', callback);
  *     conn.on('disconnected', callback);
@@ -193,7 +193,7 @@ Connection.prototype.collections;
 /**
  * The name of the database this connection points to.
  *
- * #### Example
+ * #### Example:
  *
  *     mongoose.createConnection('mongodb://localhost:27017/mydb').name; // "mydb"
  *
@@ -210,7 +210,7 @@ Connection.prototype.name;
  * a map from model names to models. Contains all models that have been
  * added to this connection using [`Connection#model()`](/docs/api/connection.html#connection_Connection-model).
  *
- * #### Example
+ * #### Example:
  *
  *     const conn = mongoose.createConnection();
  *     const Test = conn.model('Test', mongoose.Schema({ name: String }));
@@ -230,7 +230,7 @@ Connection.prototype.models;
  * A number identifier for this connection. Used for debugging when
  * you have [multiple connections](/docs/connections.html#multiple_connections).
  *
- * #### Example
+ * #### Example:
  *
  *     // The default connection has `id = 0`
  *     mongoose.connection.id; // 0
@@ -274,7 +274,7 @@ Object.defineProperty(Connection.prototype, 'plugins', {
  * The host name portion of the URI. If multiple hosts, such as a replica set,
  * this will contain the first host name in the URI
  *
- * #### Example
+ * #### Example:
  *
  *     mongoose.createConnection('mongodb://localhost:27017/mydb').host; // "localhost"
  *
@@ -294,7 +294,7 @@ Object.defineProperty(Connection.prototype, 'host', {
  * The port portion of the URI. If multiple hosts, such as a replica set,
  * this will contain the port from the first host name in the URI.
  *
- * #### Example
+ * #### Example:
  *
  *     mongoose.createConnection('mongodb://localhost:27017/mydb').port; // 27017
  *
@@ -313,7 +313,7 @@ Object.defineProperty(Connection.prototype, 'port', {
 /**
  * The username specified in the URI
  *
- * #### Example
+ * #### Example:
  *
  *     mongoose.createConnection('mongodb://val:psw@localhost:27017/mydb').user; // "val"
  *
@@ -332,7 +332,7 @@ Object.defineProperty(Connection.prototype, 'user', {
 /**
  * The password specified in the URI
  *
- * #### Example
+ * #### Example:
  *
  *     mongoose.createConnection('mongodb://val:psw@localhost:27017/mydb').pass; // "psw"
  *
@@ -1452,7 +1452,7 @@ Connection.prototype.setClient = function setClient(client) {
  *
  * @param {Object} options
  * @param {Boolean} options.continueOnError `false` by default. If set to `true`, mongoose will not throw an error if one model syncing failed, and will return an object where the keys are the names of the models, and the values are the results/errors for each model.
- * @returns
+ * @return {Promise} Returns a Promise, when the Promise resolves the value is a list of the dropped indexes.
  */
 Connection.prototype.syncIndexes = async function syncIndexes(options = {}) {
   const result = {};

package/lib/cursor/AggregationCursor.js

@@ -107,7 +107,7 @@ if (Symbol.asyncIterator != null) {
  * Registers a transform function which subsequently maps documents retrieved
  * via the streams interface or `.next()`
  *
- * #### Example
+ * #### Example:
  *
  *     // Map documents returned by `data` events
  *     Thing.
@@ -132,6 +132,7 @@ if (Symbol.asyncIterator != null) {
  *
  * @param {Function} fn
  * @return {AggregationCursor}
+ * @memberOf AggregationCursor
  * @api public
  * @method map
  */
@@ -226,7 +227,7 @@ AggregationCursor.prototype.eachAsync = function(fn, opts, callback) {
  * You do not need to call this function explicitly, the JavaScript runtime
  * will call it for you.
  *
- * #### Example
+ * #### Example:
  *
  *     // Async iterator without explicitly calling `cursor()`. Mongoose still
  *     // creates an AggregationCursor instance internally.

package/lib/cursor/QueryCursor.js

@@ -112,7 +112,7 @@ QueryCursor.prototype._read = function() {
  * Registers a transform function which subsequently maps documents retrieved
  * via the streams interface or `.next()`
  *
- * #### Example
+ * #### Example:
  *
  *     // Map documents returned by `data` events
  *     Thing.
@@ -137,6 +137,7 @@ QueryCursor.prototype._read = function() {
  *
  * @param {Function} fn
  * @return {QueryCursor}
+ * @memberOf QueryCursor
  * @api public
  * @method map
  */
@@ -211,7 +212,7 @@ QueryCursor.prototype.next = function(callback) {
  * will wait for the promise to resolve before iterating on to the next one.
  * Returns a promise that resolves when done.
  *
- * #### Example
+ * #### Example:
  *
  *     // Iterate over documents asynchronously
  *     Thing.
@@ -300,7 +301,7 @@ QueryCursor.prototype._transformForAsyncIterator = function() {
  * You do not need to call this function explicitly, the JavaScript runtime
  * will call it for you.
  *
- * #### Example
+ * #### Example:
  *
  *     // Works without using `cursor()`
  *     for await (const doc of Model.find([{ $sort: { name: 1 } }])) {
@@ -320,7 +321,7 @@ QueryCursor.prototype._transformForAsyncIterator = function() {
  * support async iterators.
  *
  * @method Symbol.asyncIterator
- * @memberOf Query
+ * @memberOf QueryCursor
  * @instance
  * @api public
  */

package/lib/document.js

@@ -300,7 +300,35 @@ Object.defineProperty(Document.prototype, '$locals', {
 
 
 /**
- * Boolean flag specifying if the document is new.
+ * Boolean flag specifying if the document is new. If you create a document
+ * using `new`, this document will be considered "new". `$isNew` is how
+ * Mongoose determines whether `save()` should use `insertOne()` to create
+ * a new document or `updateOne()` to update an existing document.
+ *
+ * #### Example:
+ *     const user = new User({ name: 'John Smith' });
+ *     user.$isNew; // true
+ *
+ *     await user.save(); // Sends an `insertOne` to MongoDB
+ *
+ * On the other hand, if you load an existing document from the database
+ * using `findOne()` or another [query operation](/docs/queries.html),
+ * `$isNew` will be false.
+ *
+ * #### Example:
+ *     const user = await User.findOne({ name: 'John Smith' });
+ *     user.$isNew; // false
+ *
+ * For subdocuments, `$isNew` is true if either the parent has `$isNew` set,
+ * or if you create a new subdocument.
+ *
+ * #### Example:
+ *     // Assume `Group` has a document array `users`
+ *     const group = await Group.findOne();
+ *     group.users[0].$isNew; // false
+ *
+ *     group.users.push({ name: 'John Smith' });
+ *     group.users[1].$isNew; // true
  *
  * @api public
  * @property $isNew
@@ -311,7 +339,7 @@ Object.defineProperty(Document.prototype, '$locals', {
 Document.prototype.$isNew;
 
 /**
- * Boolean flag specifying if the document is new.
+ * Legacy alias for `$isNew`.
  *
  * @api public
  * @property isNew
@@ -1409,7 +1437,11 @@ Document.prototype.$set = function $set(path, val, type, options) {
       // later in `$__set()` because we don't take `_doc` when we iterate through
       // a single nested doc. That's to make sure we get the correct context.
       // Otherwise we would double-call the setter, see gh-7196.
-      val = schema.applySetters(val, this, false, priorVal, options);
+      if (options != null && options.overwriteImmutable) {
+        val = schema.applySetters(val, this, false, priorVal, { overwriteImmutable: true });
+      } else {
+        val = schema.applySetters(val, this, false, priorVal);
+      }
     }
 
     if (Array.isArray(val) &&
@@ -1718,7 +1750,7 @@ Document.prototype.$__setValue = function(path, val) {
 /**
  * Returns the value of a path.
  *
- * #### Example
+ * #### Example:
  *
  *     // path
  *     doc.get('age') // 47
@@ -1891,7 +1923,7 @@ Document.prototype.$ignore = function(path) {
  * A path `a` may be in `modifiedPaths()` but not in `directModifiedPaths()`
  * because a child of `a` was directly modified.
  *
- * #### Example
+ * #### Example:
  *     const schema = new Schema({ foo: String, nested: { bar: String } });
  *     const Model = mongoose.model('Test', schema);
  *     await Model.create({ foo: 'original', nested: { bar: 'original' } });
@@ -2047,7 +2079,7 @@ Document.prototype[documentModifiedPaths] = Document.prototype.modifiedPaths;
  *
  * If `path` is given, checks if a path or any full path containing `path` as part of its path chain has been modified.
  *
- * #### Example
+ * #### Example:
  *
  *     doc.set('documents.0.title', 'changed');
  *     doc.isModified()                      // true
@@ -2093,7 +2125,7 @@ Document.prototype[documentIsModified] = Document.prototype.isModified;
 /**
  * Checks if a path is set to its default.
  *
- * #### Example
+ * #### Example:
  *
  *     MyModel = mongoose.model('test', { name: { type: String, default: 'Val '} });
  *     const m = new MyModel();
@@ -2157,13 +2189,13 @@ Document.prototype.$isDeleted = function(val) {
 /**
  * Returns true if `path` was directly set and modified, else false.
  *
- * #### Example
+ * #### Example:
  *
  *     doc.set('documents.0.title', 'changed');
  *     doc.isDirectModified('documents.0.title') // true
  *     doc.isDirectModified('documents') // false
  *
- * @param {String|Array<String>} path
+ * @param {String|String[]} path
  * @return {Boolean}
  * @api public
  */
@@ -2213,13 +2245,13 @@ Document.prototype.isInit = function(path) {
 /**
  * Checks if `path` was selected in the source query which initialized this document.
  *
- * #### Example
+ * #### Example:
  *
  *     const doc = await Thing.findOne().select('name');
  *     doc.isSelected('name') // true
  *     doc.isSelected('age')  // false
  *
- * @param {String|Array<String>} path
+ * @param {String|String[]} path
  * @return {Boolean}
  * @api public
  */
@@ -2294,7 +2326,7 @@ Document.prototype.$__isSelected = Document.prototype.isSelected;
  * Checks if `path` was explicitly selected. If no projection, always returns
  * true.
  *
- * #### Example
+ * #### Example:
  *
  *     Thing.findOne().select('nested.name').exec(function (err, doc) {
  *        doc.isDirectSelected('nested.name') // true
@@ -3106,7 +3138,7 @@ function _checkImmutableSubpaths(subdoc, schematype, priorVal) {
 /**
  * Checks if a path is invalid
  *
- * @param {String|Array<String>} path the field to check
+ * @param {String|String[]} path the field to check
  * @method $isValid
  * @memberOf Document
  * @instance
@@ -3636,7 +3668,7 @@ Document.prototype.$toObject = function(options, json) {
  *
  *     schema.set('toObject', { virtuals: true })
  *
- * #### Transform
+ * #### Transform:
  *
  * We may need to perform a transformation of the resulting object based on some criteria, say to remove some sensitive information or return a custom object. In this case we set the optional `transform` function.
  *
@@ -3648,7 +3680,7 @@ Document.prototype.$toObject = function(options, json) {
  * - `ret` The plain object representation which has been converted
  * - `options` The options in use (either schema options or the options passed inline)
  *
- * #### Example
+ * #### Example:
  *
  *     // specify the transform schema option
  *     if (!schema.options.toObject) schema.options.toObject = {};
@@ -4338,7 +4370,7 @@ Document.prototype.$populated = Document.prototype.populated;
  *     doc.$assertPopulated('other path'); // throws an error
  *
  *
- * @param {String|Array<String>} path
+ * @param {String|String[]} path
  * @return {Document} this
  * @memberOf Document
  * @method $assertPopulated

package/lib/error/index.js

@@ -56,7 +56,7 @@ module.exports = exports = MongooseError;
  * @see Error.messages #error_messages_MongooseError-messages
  * @api public
  * @memberOf Error
- * @static messages
+ * @static
  */
 
 MongooseError.messages = require('./messages');
@@ -73,7 +73,7 @@ MongooseError.Messages = MongooseError.messages;
  *
  * @api public
  * @memberOf Error
- * @static DocumentNotFoundError
+ * @static
  */
 
 MongooseError.DocumentNotFoundError = require('./notFound');
@@ -84,7 +84,7 @@ MongooseError.DocumentNotFoundError = require('./notFound');
  *
  * @api public
  * @memberOf Error
- * @static CastError
+ * @static
  */
 
 MongooseError.CastError = require('./cast');
@@ -96,7 +96,7 @@ MongooseError.CastError = require('./cast');
  *
  * @api public
  * @memberOf Error
- * @static ValidationError
+ * @static
  */
 
 MongooseError.ValidationError = require('./validation');
@@ -131,7 +131,7 @@ MongooseError.ValidationError = require('./validation');
  *
  * @api public
  * @memberOf Error
- * @static ValidatorError
+ * @static
  */
 
 MongooseError.ValidatorError = require('./validator');
@@ -143,7 +143,7 @@ MongooseError.ValidatorError = require('./validator');
  *
  * @api public
  * @memberOf Error
- * @static VersionError
+ * @static
  */
 
 MongooseError.VersionError = require('./version');
@@ -155,7 +155,7 @@ MongooseError.VersionError = require('./version');
  *
  * @api public
  * @memberOf Error
- * @static ParallelSaveError
+ * @static
  */
 
 MongooseError.ParallelSaveError = require('./parallelSave');
@@ -166,7 +166,7 @@ MongooseError.ParallelSaveError = require('./parallelSave');
  *
  * @api public
  * @memberOf Error
- * @static OverwriteModelError
+ * @static
  */
 
 MongooseError.OverwriteModelError = require('./overwriteModel');
@@ -176,7 +176,7 @@ MongooseError.OverwriteModelError = require('./overwriteModel');
  *
  * @api public
  * @memberOf Error
- * @static MissingSchemaError
+ * @static
  */
 
 MongooseError.MissingSchemaError = require('./missingSchema');
@@ -187,7 +187,7 @@ MongooseError.MissingSchemaError = require('./missingSchema');
  *
  * @api public
  * @memberOf Error
- * @static MongooseServerSelectionError
+ * @static
  */
 
 MongooseError.MongooseServerSelectionError = require('./serverSelection');
@@ -198,7 +198,7 @@ MongooseError.MongooseServerSelectionError = require('./serverSelection');
  *
  * @api public
  * @memberOf Error
- * @static DivergentArrayError
+ * @static
  */
 
 MongooseError.DivergentArrayError = require('./divergentArray');
@@ -210,7 +210,7 @@ MongooseError.DivergentArrayError = require('./divergentArray');
  *
  * @api public
  * @memberOf Error
- * @static StrictModeError
+ * @static
  */
 
 MongooseError.StrictModeError = require('./strict');

package/lib/error/messages.js

@@ -16,8 +16,8 @@
  *
  * Click the "show code" link below to see all defaults.
  *
- * @static messages
- * @receiver MongooseError
+ * @static
+ * @memberOf MongooseError
  * @api public
  */
 

package/lib/helpers/query/castUpdate.js

@@ -155,12 +155,12 @@ function castPipelineOperator(op, val) {
  * according to its schema.
  *
  * @param {Schema} schema
- * @param {Object} obj - part of a query
- * @param {String} op - the atomic operator ($pull, $set, etc)
+ * @param {Object} obj part of a query
+ * @param {String} op the atomic operator ($pull, $set, etc)
  * @param {Object} options
  * @param {Boolean|String} [options.strict]
  * @param {Query} context
- * @param {String} pref - path prefix (internal only)
+ * @param {String} pref path prefix (internal only)
  * @return {Bool} true if this path has keys to update
  * @api private
  */
@@ -451,7 +451,7 @@ const overwriteOps = {
  *
  * @param {SchemaType} schema
  * @param {Object} val
- * @param {String} op - the atomic operator ($pull, $set, etc)
+ * @param {String} op the atomic operator ($pull, $set, etc)
  * @param {String} $conditional
  * @param {Query} context
  * @api private

package/lib/helpers/timestamps/setDocumentTimestamps.js

@@ -0,0 +1,26 @@
+'use strict';
+
+module.exports = function setDocumentTimestamps(doc, timestampOption, currentTime, createdAt, updatedAt) {
+  const skipUpdatedAt = timestampOption != null && timestampOption.updatedAt === false;
+  const skipCreatedAt = timestampOption != null && timestampOption.createdAt === false;
+
+  const defaultTimestamp = currentTime != null ?
+    currentTime() :
+    doc.ownerDocument().constructor.base.now();
+
+  if (!skipCreatedAt &&
+      (doc.isNew || doc.$isSubdocument) &&
+      createdAt &&
+      !doc.$__getValue(createdAt) &&
+      doc.$__isSelected(createdAt)) {
+    doc.$set(createdAt, defaultTimestamp, undefined, { overwriteImmutable: true });
+  }
+
+  if (!skipUpdatedAt && updatedAt && (doc.isNew || doc.$isModified())) {
+    let ts = defaultTimestamp;
+    if (doc.isNew && createdAt != null) {
+      ts = doc.$__getValue(createdAt);
+    }
+    doc.$set(updatedAt, ts);
+  }
+};

package/lib/helpers/timestamps/setupTimestamps.js

@@ -4,6 +4,7 @@ const applyTimestampsToChildren = require('../update/applyTimestampsToChildren')
 const applyTimestampsToUpdate = require('../update/applyTimestampsToUpdate');
 const get = require('../get');
 const handleTimestampOption = require('../schema/handleTimestampOption');
+const setDocumentTimestamps = require('./setDocumentTimestamps');
 const symbols = require('../../schema/symbols');
 
 module.exports = function setupTimestamps(schema, timestamps) {
@@ -44,24 +45,7 @@ module.exports = function setupTimestamps(schema, timestamps) {
       return next();
     }
 
-    const skipUpdatedAt = timestampOption != null && timestampOption.updatedAt === false;
-    const skipCreatedAt = timestampOption != null && timestampOption.createdAt === false;
-
-    const defaultTimestamp = currentTime != null ?
-      currentTime() :
-      this.ownerDocument().constructor.base.now();
-
-    if (!skipCreatedAt && (this.isNew || this.$isSubdocument) && createdAt && !this.$__getValue(createdAt) && this.$__isSelected(createdAt)) {
-      this.$set(createdAt, defaultTimestamp, undefined, { overwriteImmutable: true });
-    }
-
-    if (!skipUpdatedAt && updatedAt && (this.isNew || this.$isModified())) {
-      let ts = defaultTimestamp;
-      if (this.isNew && createdAt != null) {
-        ts = this.$__getValue(createdAt);
-      }
-      this.$set(updatedAt, ts);
-    }
+    setDocumentTimestamps(this, timestampOption, currentTime, createdAt, updatedAt);
 
     next();
   });
@@ -76,6 +60,18 @@ module.exports = function setupTimestamps(schema, timestamps) {
     if (updatedAt && !this.get(updatedAt)) {
       this.$set(updatedAt, ts);
     }
+
+    if (this.$isSubdocument) {
+      return this;
+    }
+
+    const subdocs = this.$getAllSubdocs();
+    for (const subdoc of subdocs) {
+      if (subdoc.initializeTimestamps) {
+        subdoc.initializeTimestamps();
+      }
+    }
+
     return this;
   };
 

package/lib/helpers/topology/isAtlas.js

@@ -2,25 +2,30 @@
 
 const getConstructorName = require('../getConstructorName');
 
+/**
+ * @typedef { import('mongodb').TopologyDescription } TopologyDescription
+ */
+
+/**
+ * Checks if topologyDescription contains servers connected to an atlas instance
+ *
+ * @param  {TopologyDescription} topologyDescription
+ * @returns {boolean}
+ */
 module.exports = function isAtlas(topologyDescription) {
   if (getConstructorName(topologyDescription) !== 'TopologyDescription') {
     return false;
   }
 
-  const hostnames = Array.from(topologyDescription.servers.keys());
-
-  if (hostnames.length === 0) {
+  if (topologyDescription.servers.size === 0) {
     return false;
   }
 
-  for (let i = 0, il = hostnames.length; i < il; ++i) {
-    const url = new URL(hostnames[i]);
-    if (
-      url.hostname.endsWith('.mongodb.net') === false ||
-      url.port !== '27017'
-    ) {
+  for (const server of topologyDescription.servers.values()) {
+    if (server.host.endsWith('.mongodb.net') === false || server.port !== 27017) {
       return false;
     }
   }
+
   return true;
 };

package/lib/index.js

@@ -172,6 +172,7 @@ Mongoose.prototype.setDriver = function setDriver(driver) {
 
   const Connection = driver.getConnection();
   _mongoose.connections = [new Connection(_mongoose)];
+  _mongoose.connections[0].models = _mongoose.models;
 
   return _mongoose;
 };
@@ -203,6 +204,7 @@ Mongoose.prototype.setDriver = function setDriver(driver) {
  * - 'overwriteModels': Set to `true` to default to overwriting models with the same name when calling `mongoose.model()`, as opposed to throwing an `OverwriteModelError`.
  * - 'returnOriginal': If `false`, changes the default `returnOriginal` option to `findOneAndUpdate()`, `findByIdAndUpdate`, and `findOneAndReplace()` to false. This is equivalent to setting the `new` option to `true` for `findOneAndX()` calls by default. Read our [`findOneAndUpdate()` tutorial](/docs/tutorials/findoneandupdate.html) for more information.
  * - 'runValidators': `false` by default. Set to true to enable [update validators](/docs/validation.html#update-validators) for all validators by default.
+ * - 'sanitizeFilter': `false` by default. Set to true to enable the [sanitization of the query filters](/docs/api.html#mongoose_Mongoose-sanitizeFilter) against query selector injection attacks by wrapping any nested objects that have a property whose name starts with `$` in a `$eq`.
  * - 'selectPopulatedPaths': `true` by default. Set to false to opt out of Mongoose adding all fields that you `populate()` to your `select()`. The schema-level option `selectPopulatedPaths` overwrites this one.
  * - 'strict': `true` by default, may be `false`, `true`, or `'throw'`. Sets the default strict mode for schemas.
  * - 'strictQuery': same value as 'strict' by default (`true`), may be `false`, `true`, or `'throw'`. Sets the default [strictQuery](/docs/guide.html#strictQuery) mode for schemas.
@@ -761,6 +763,8 @@ Mongoose.prototype.Aggregate = Aggregate;
 /**
  * The Mongoose Collection constructor
  *
+ * @memberOf Mongoose
+ * @instance
  * @method Collection
  * @api public
  */
@@ -799,7 +803,7 @@ Object.defineProperty(Mongoose.prototype, 'Connection', {
 /**
  * The Mongoose version
  *
- * #### Example
+ * #### Example:
  *
  *     console.log(mongoose.version); // '5.x.x'
  *
@@ -1044,7 +1048,7 @@ Mongoose.prototype.isObjectIdOrHexString = function(v) {
  *
  * @param {Object} options
  * @param {Boolean} options.continueOnError `false` by default. If set to `true`, mongoose will not throw an error if one model syncing failed, and will return an object where the keys are the names of the models, and the values are the results/errors for each model.
- * @returns
+ * @return {Promise} Returns a Promise, when the Promise resolves the value is a list of the dropped indexes.
  */
 Mongoose.prototype.syncIndexes = function(options) {
   const _mongoose = this instanceof Mongoose ? this : mongoose;