'/api/files' endpoint fails validation on files with __v property

[LaszloKecskes]

According to the git history, we have turned off the version key feature of mongoose on the file model. This feature appends the __v property to the files. New files now created do not have this property, but there was no migration, so files already in the database since before the change still do have it.

Now, we have set the ajv validation strict, and the /api/files endpoints fail on old files having this property, since it is not part of the file schema. This has not been detected, since the test have been kept up to date both in the unit tests and to nighmare e2e. Strictly speaking, the problem was the forgotten migration.

While discussing this, it was questioned whether removing the feature was a good idea in the first place. The task in this issue is:

1. Research about this mongoose feature.
2. Decide whether we want to:
   • Keep it as it is, and write a migration to remove the __v property from the file objects.
   • Re-enable it, and make sure that this property does not get to the front end to later fail on validation through save.
   • Any better solution that comes up during the research.
3. Implement the change.

[mfacar]

#4075 is the issue where the change was introduced, it seems like is the same problem we are having now, anyway, I think that conceptually it's not correct that the endpoint accepts the version of an object to be updated into the database since this is not a property that the user should define but something internally to the data management.

[LaszloKecskes]

#4075 is the issue where the change was introduced, it seems like is the same problem we are having now, anyway, I think that conceptually it's not correct that the endpoint accepts the version of an object to be updated into the database since this is not a property that the user should define but something internally to the data management.

That is a good point! Changed that option in the description of the issue.

[LaszloKecskes]

After reading the relevant parts in the mongoose docs, we will go with re-enabling the feature. According to @mfacar's suggestion, we will make sure we are not recreating the linked issue not by validating the __v property on the post, but by not sending it via the get, so the front-end never even sees this property.