Bulk operations update/delete wrong documents

[teunmooij]

Link to reproduction

https://github.com/teunmooij/payload

To Reproduce

Link is for my test app in my own repo, but it's basically the payload demo project, updated to latest payload version (v1.6.26).

• Start payload (npm run testbed)
• Login to create api key
• Fire bulk delete (or patch) request with invalid where parameter, like:

curl -X 'DELETE' \
'http://localhost:3000/api/categories?where=%2Fsomething' \
-H 'accept: application/json' \
-H 'Authorization: users API-Key 908d73f0-788e-40d8-a445-2a14b1437a8d'

Describe the Bug

Expected:

When I give an invalid where clause in the bulk patch or delete, I'd expect a 400 status and no updates

Actual

All the documents in the given collection are deleted (or updated)

Payload Version

1.6.26

[DanRibbens]

When I give an invalid where clause in the bulk patch or delete, I'd expect a 400 status and no updates

I agree with your expectation, though I'm going to convert this to a discussion and treat it as a new feature request instead of a bug. The thinking here is that we need to add validation to all requests with a where clause to throw the expected error.

Thanks for reporting @teunmooij! I will take care of this.

[teunmooij]

Hi @DanRibbens, thanks for the quick reply.
I love the idea of the new bulk endpoints that you've created and can't wait to also have an out-of-the-box bulk insert one. However if I risk deleting my entire collection with a single simple typo, I'd be a bit hesitant to use them.

[DanRibbens]

Very valid point! This is very high priority for me.

[DanRibbens]

I forgot to update this thread. This was fixed in v1.7.0. When you give an incorrect field within a where query, you will get an error rather than that query constraint being removed.