Mongoose find/update subdocument

So as you note, the default in mongoose is that when you "embed" data in an array like this you get an _id value for each array entry as part of it's own sub-document properties. You can actually use this value in order to determine the index of the item which you intend to update. The MongoDB way of doing this is the positional $ operator variable, which holds the "matched" position in the array:

Folder.findOneAndUpdate(    { "_id": folderId, "permissions._id": permission._id },    {         "$set": {            "permissions.$": permission        }    },    function(err,doc) {    });

That .findOneAndUpdate() method will return the modified document or otherwise you can just use .update() as a method if you don't need the document returned. The main parts are "matching" the element of the array to update and "identifying" that match with the positional $ as mentioned earlier.

Then of course you are using the $set operator so that only the elements you specify are actually sent "over the wire" to the server. You can take this further with "dot notation" and just specify the elements you actually want to update. As in:

Folder.findOneAndUpdate(    { "_id": folderId, "permissions._id": permission._id },    {         "$set": {            "permissions.$.role": permission.role        }    },    function(err,doc) {    });

So this is the flexibility that MongoDB provides, where you can be very "targeted" in how you actually update a document.

What this does do however is "bypass" any logic you might have built into your "mongoose" schema, such as "validation" or other "pre-save hooks". That is because the "optimal" way is a MongoDB "feature" and how it is designed. Mongoose itself tries to be a "convenience" wrapper over this logic. But if you are prepared to take some control yourself, then the updates can be made in the most optimal way.

So where possible to do so, keep your data "embedded" and don't use referenced models. It allows the atomic update of both "parent" and "child" items in simple updates where you don't need to worry about concurrency. Probably is one of the reasons you should have selected MongoDB in the first place.

In order to validate subdocuments when updating in Mongoose, you have to 'load' it as a Schema object, and then Mongoose will automatically trigger validation and hooks.

const userSchema = new mongoose.Schema({  // ...  addresses: [addressSchema],});

If you have an array of subdocuments, you can fetch the desired one with the id() method provided by Mongoose. Then you can update its fields individually, or if you want to update multiple fields at once then use the set() method.

User.findById(userId)  .then((user) => {    const address = user.addresses.id(addressId); // returns a matching subdocument    address.set(req.body); // updates the address while keeping its schema           // address.zipCode = req.body.zipCode; // individual fields can be set directly    return user.save(); // saves document with subdocuments and triggers validation  })  .then((user) => {    res.send({ user });  })  .catch(e => res.status(400).send(e));

Note that you don't really need the userId to find the User document, you can get it by searching for the one that has an address subdocument that matches addressId as follows:

User.findOne({  'addresses._id': addressId,})// .then() ... the same as the example above

Remember that in MongoDB the subdocument is saved only when the parent document is saved.

Read more on the topic on the official documentation.

If you don't want separate collection, just embed the permissionSchema into the folderSchema.

var folderSchema = new Schema({    name: { type: string },    permissions: [ {        role: { type: String },        create_folders: { type: Boolean },        create_contents: { type: Boolean }    } ]});

If you need separate collections, this is the best approach:

You could have a Permission model:

var mongoose = require('mongoose');var PermissionSchema = new Schema({  role: { type: String },  create_folders: { type: Boolean },  create_contents: { type: Boolean }});module.exports = mongoose.model('Permission', PermissionSchema);

And a Folder model with a reference to the permission document.You can reference another schema like this:

var mongoose = require('mongoose');var FolderSchema = new Schema({  name: { type: string },  permissions: [ { type: mongoose.Schema.Types.ObjectId, ref: 'Permission' } ]});module.exports = mongoose.model('Folder', FolderSchema);

And then call Folder.findOne().populate('permissions') to ask mongoose to populate the field permissions.

Now, the following:

savePermission: function (folderId, permission, callback) {    Folder.findOne({ _id: folderId }).populate('permissions').exec(function (err, data) {        var perm = _.findWhere(data.permissions, { _id: permission._id });                        _.extend(perm, permission);        data.markModified("permissions");        data.save(callback);    });}

The perm field will not be undefined (if the permission._id is actually in the permissions array), since it's been populated by Mongoose.