Fix: Add strictFilter option to findOneAndUpdate with tests (Automattic#14913)

Author: maazahmed-mangotech

lib/query.js

@@ -3311,6 +3311,7 @@ function prepareDiscriminatorCriteria(query) {
  * - `maxTimeMS`: puts a time limit on the query - requires mongodb >= 2.6.0
  * - `runValidators`: if true, runs [update validators](https://mongoosejs.com/docs/validation.html#update-validators) on this command. Update validators validate the update operation against the model's schema.
  * - `setDefaultsOnInsert`: `true` by default. If `setDefaultsOnInsert` and `upsert` are true, mongoose will apply the [defaults](https://mongoosejs.com/docs/defaults.html) specified in the model's schema if a new document is created.
+ * - `strictFilter`: bool - if true, throws an error if the filter is empty (`{}`). Defaults to false.
  *
  * #### Example:
  *
@@ -3337,6 +3338,7 @@ function prepareDiscriminatorCriteria(query) {
  * @param {Boolean} [options.translateAliases=null] If set to `true`, translates any schema-defined aliases in `filter`, `projection`, `update`, and `distinct`. Throws an error if there are any conflicts where both alias and raw property are defined on the same object.
  * @param {Boolean} [options.overwriteDiscriminatorKey=false] Mongoose removes discriminator key updates from `update` by default, set `overwriteDiscriminatorKey` to `true` to allow updating the discriminator key
  * @param {Boolean} [options.overwriteImmutable=false] Mongoose removes updated immutable properties from `update` by default (excluding $setOnInsert). Set `overwriteImmutable` to `true` to allow updating immutable properties using other update operators.
+ * @param {Boolean} [options.strictFilter=false] If true, throws an error if the filter is empty (`{}`)
  * @see Tutorial https://mongoosejs.com/docs/tutorials/findoneandupdate.html
  * @see findAndModify command https://www.mongodb.com/docs/manual/reference/command/findAndModify/
  * @see ModifyResult https://mongodb.github.io/node-mongodb-native/4.9/interfaces/ModifyResult.html
@@ -3353,6 +3355,11 @@ Query.prototype.findOneAndUpdate = function(filter, doc, options) {
     throw new MongooseError('Query.prototype.findOneAndUpdate() no longer accepts a callback');
   }
 
+  // Check for empty filter with strictFilter option
+  if (options && options.strictFilter && filter && Object.keys(filter).length === 0) {
+    return Promise.reject(new Error('Empty filter not allowed in findOneAndUpdate with strictFilter enabled'));
+  }
+
   this.op = 'findOneAndUpdate';
   this._validateOp();
   this._validate();

test/query.test.js

@@ -4455,4 +4455,58 @@ describe('Query', function() {
       assert.strictEqual(target, null);
     });
   });
+
+  describe('findOneAndUpdate with strictFilter', function() {
+    let Person;
+    let _id;
+
+    beforeEach(async function() {
+      try {
+        const schema = new Schema({ name: String });
+        Person = db.model('Person', schema);
+        await Person.deleteMany({})
+        const person = await Person.create({ name: 'Alice' });
+        _id = person._id;
+      } catch (err) {
+        throw err;
+      }
+    });
+
+    it('throws error for empty filter when strictFilter is true', async function() {
+      await assert.rejects(
+        () => Person.findOneAndUpdate({}, { name: 'Updated' }, { strictFilter: true }),
+        /Empty filter not allowed in findOneAndUpdate with strictFilter enabled/
+      );
+    });
+    
+
+    it('updates first document when strictFilter is false', async function() {
+      const updated = await Person.findOneAndUpdate({}, { name: 'Updated' }, { new: true });
+      assert.strictEqual(updated.name, 'Updated');
+      const person = await Person.findById(_id);
+      assert.strictEqual(person.name, 'Updated');
+    });
+
+    it('updates with non-empty filter when strictFilter is true', async function() {
+      const updated = await Person.findOneAndUpdate(
+        { _id },
+        { name: 'Updated Alice' },
+        { strictFilter: true, new: true }
+      );
+      assert.strictEqual(updated.name, 'Updated Alice');
+      const person = await Person.findById(_id);
+      assert.strictEqual(person.name, 'Updated Alice');
+    });
+
+    it('handles undefined filter with strictFilter true', async function() {
+      const updated = await Person.findOneAndUpdate(
+        undefined,
+        { name: 'Updated' },
+        { strictFilter: true, new: true }
+      );
+      assert.strictEqual(updated.name, 'Updated');
+      const person = await Person.findById(_id);
+      assert.strictEqual(person.name, 'Updated');
+    });
+  });
 });