Mongoose 中间件：前置和后置钩子

Mongoose middleware (also called hooks) are functions that run before or after specific operations like save, find, updateOne, deleteOne, and more. They enable you to inject custom logic into the lifecycle of document and query operations without cluttering your route handlers. Common uses include hashing passwords before save, logging query times, enforcing soft deletes, and populating related data after find.

Mongoose has two distinct categories of middleware: Document middleware hooks into operations on a specific Document instance (save, validate, remove, init). Query middleware hooks into query operations invoked on the Model (find, findOne, updateOne, deleteOne, etc.). The key difference is what this refers to—in document middleware, this is the document; in query middleware, this is the query object.

The pre-save hook is the most common document middleware. It runs before a document is saved to MongoDB. The canonical use case is hashing passwords: when a user document is saved with a new or modified password, hash it with bcrypt before storing. The this.isModified('password') check prevents re-hashing an already-hashed password on unrelated saves.

Document middleware has access to tracking helpers: this.isNew is true when the document is being inserted for the first time (not updated). this.isModified(path) returns true if the specified field has been changed since the document was last saved or fetched. These helpers let you run hooks conditionally—only on creation, or only when a specific field changes.

Post-save hooks run after a document is successfully persisted. They receive the saved document as the first argument and (in older Mongoose) a next callback. Post hooks are ideal for side effects that should happen after a successful save: sending a welcome email, updating a search index, publishing an event to a message queue, or clearing a cache. Errors in post hooks do not roll back the save.

A classic query middleware pattern is implementing soft deletes. Instead of removing documents, set a deletedAt field. Then add a pre('find') hook that automatically adds { deletedAt: null } to every find query, ensuring deleted documents are never returned by default. This provides an audit trail while making the soft-delete logic transparent to the rest of the application.

You can use query middleware to automatically populate a reference field on every find. This ensures that a referenced document is always resolved without requiring callers to add .populate() to every query. While convenient, be careful—automatic population adds a second query for every find and can degrade performance if the reference is large or not always needed.

Mongoose does not enforce cascade deletes (deleting related documents when a parent is deleted) automatically. You can implement cascade behavior using document middleware. A pre-deleteOne hook on a User model can delete all posts, comments, and sessions belonging to that user before the user document itself is removed. This keeps referential integrity without foreign key constraints.

If a pre-hook function throws an error or rejects a Promise, the operation it precedes is aborted. This lets you perform validation or authorization checks in middleware and abort saves or queries by throwing. For example, a pre-save hook that validates business logic (not just schema validation) can throw an error that bubbles up to the .save() call's catch block in the application code.

Mongoose also supports middleware for aggregation pipelines. A pre-aggregate hook gives you access to the pipeline array before it is sent to MongoDB, allowing you to prepend stages (like filtering soft-deleted documents) or append stages (like injecting a default limit). Access the pipeline via this.pipeline() inside the hook function.

Not all write operations trigger document middleware. updateMany(), findOneAndUpdate(), replaceOne() called on the Model (not an instance) bypass document save hooks—they are query middleware and need separate hooks if you want to intercept them. For example, a pre-save password hashing hook does NOT run when you call User.updateOne({}, { $set: { password: plain } }). Always hash in the application code for query-based updates.

In this lesson you learned: pre hooks run before an operation and can abort it by throwing an error; post hooks run after and receive the result as an argument, document middleware (pre-save, pre-deleteOne) uses 'this' as the document, while query middleware uses 'this' as the Query object, and query-level write methods (updateOne, updateMany, findOneAndUpdate) bypass document middleware — always be aware of which hooks fire for each operation type. This completes the MongoDB & NoSQL Databases course track!