Payload api not respecting schema , fields in db but not in schema are sent as api response

[geminigeek]

Describe the Bug

hi,
Payload api (mongodb) is not respecting schema , all keys for a record in db are sent as response which are not defined in collection fields , this is a good feature but it should be enabled behind a flag not by default !

to explain in simple term if i have few extra keys for a db record, which are not defined in a collection fields, those keys are also sent in payload api response !

Link to the code that reproduces this issue

not required

Reproduction Steps

1. add a key for a record in db (mongodb compass or some thing else) which is not defined in payload collection field
2. fetch that record with payload api the key which you added in db will be sent with api response. this should not be enabled by default , its ok to have this behind a flag/option

Which area(s) are affected? (Select all that apply)

area: core

Environment Info

Binaries:
  Node: 22.11.0
  npm: 10.9.0
  Yarn: 1.22.22
  pnpm: 9.13.0
Relevant Packages:
  payload: 3.22.0
  next: 15.1.5
  @payloadcms/db-mongodb: 3.22.0
  @payloadcms/email-nodemailer: 3.22.0
  @payloadcms/graphql: 3.22.0
  @payloadcms/next/utilities: 3.22.0
  @payloadcms/payload-cloud: 3.22.0
  @payloadcms/richtext-lexical: 3.22.0
  @payloadcms/translations: 3.22.0
  @payloadcms/ui/shared: 3.22.0
  react: 19.0.0
  react-dom: 19.0.0
Operating System:
  Platform: linux
  Arch: x64
  Version: #47-Ubuntu SMP PREEMPT_DYNAMIC Fri Sep 27 21:40:26 UTC 2024
  Available memory (MB): 112478
  Available CPU cores: 12

[github-actions]

Please add a reproduction in order for us to be able to investigate.

Depending on the quality of reproduction steps, this issue may be closed if no reproduction is provided.

Why was this issue marked with the invalid-reproduction label?

To be able to investigate, we need access to a reproduction to identify what triggered the issue. We prefer a link to a public GitHub repository created with create-payload-app@beta -t blank or a forked/branched version of this repository with tests added (more info in the reproduction-guide).

To make sure the issue is resolved as quickly as possible, please make sure that the reproduction is as minimal as possible. This means that you should remove unnecessary code, files, and dependencies that do not contribute to the issue. Ensure your reproduction does not depend on secrets, 3rd party registries, private dependencies, or any other data that cannot be made public. Avoid a reproduction including a whole monorepo (unless relevant to the issue). The easier it is to reproduce the issue, the quicker we can help.

Please test your reproduction against the latest version of Payload to make sure your issue has not already been fixed.

I added a link, why was it still marked?

Ensure the link is pointing to a codebase that is accessible (e.g. not a private repository). "example.com", "n/a", "will add later", etc. are not acceptable links -- we need to see a public codebase. See the above section for accepted links.

Useful Resources

• Reproduction Guide
• Contributing to Payload

[jmikrut]

I just reproduced this and I tend to agree - fields that are not known by Payload should not be surfaced by default. I believe this has started when we stopped using Mongoose models to query and now use MongoDB directly.

@r1tsuu I believe we could make this a flag as suggested, but I would like your input here!

[r1tsuu]

I believe this has started when we stopped using Mongoose models to query and now use MongoDB directly.

This isn't related because we reverted that change at the time. This behavior with MongoDB has been always existed because Mongoose doesn't strip non known fields by default for read operations, only for data in write operations, but I think we can add a flag