Mongoose 6

Apply the Node.js 22 prompt first. These rules target Mongoose 6 and were checked against 6.13.11 with its pinned MongoDB Node.js driver 4.17.2. Mongoose declares Node.js >= 12.0.0, but this tag's test matrix covers 12, 14, 16, and 18; validate the deployed Node.js 22 and MongoDB combination rather than treating that minimum as a compatibility guarantee.

Query filters and tenant boundaries

• Build filters from named, validated values; never pass request objects directly to find(), findOne(), countDocuments(), updates, or deletes. Reject objects and arrays where a scalar is expected before Mongoose casting can interpret them as operators or an implicit $in.
• Set strictQuery: 'throw' on schemas used for scoped access. The Mongoose 6 default follows strict, normally true, and silently strips unknown filter paths; a misspelled tenant field can otherwise widen a query. This setting does not reject an already empty filter or validate ownership.
• Require a valid identifier and trusted tenant/owner scope before issuing an object operation; reject missing, null, or undefined scope values and never recover from a cast or strict-mode error by retrying with {}. Use typeof id === 'string' and mongoose.isObjectIdOrHexString(id) for external ObjectId strings; isValidObjectId() also accepts numbers and 12-character strings.
• Put tenant and any required soft-delete or ownership predicates in every relevant filter, including distinct(), exists(), counts, and each bulk operation. Use countDocuments(scopedFilter) for tenant counts;