Use the MongoDB Node.js driver with DaloyJS

import { z } from "zod";

// 24 hex characters. Validate in the params schema so a malformed id never
// reaches new ObjectId(), which throws a BSONError (a 500) on bad input.
export const ObjectIdSchema = z.string().regex(/^[a-f\d]{24}$/i, "Invalid id");

// Fields a client may write. Primitives only: see "Operator injection" below.
export const UserFields = z.object({
  email: z.email().max(254),
  name: z.string().max(200).nullable(),
});
export type UserFields = z.infer<typeof UserFields>;

// What is stored. The driver adds `_id: ObjectId` to read results (WithId<T>).
export interface UserDoc extends UserFields {
  createdAt: Date;
}

// What goes over the wire. Dates are ISO strings: z.coerce.date() has no
// representation in the generated OpenAPI document.
export const UserSchema = UserFields.extend({
  id: ObjectIdSchema,
  createdAt: z.iso.datetime(),
});

import { MongoClient } from "mongodb";
import type { App } from "@daloyjs/core";
import type { UserDoc } from "./schemas.ts";

export const client = new MongoClient(process.env.MONGODB_URI!, {
  appName: "users-api", // shows up in server logs and Atlas metrics
  maxPoolSize: 10, // per process; size against the cluster's connection limit
  serverSelectionTimeoutMS: 5_000, // fail fast instead of hanging requests
});

const database = client.db(process.env.MONGODB_DB ?? "app");
export const db = {
  client,
  users: database.collection<UserDoc>("users"),
};

// Call with the root app, not through app.register(): a decoration made
// inside a registered plugin is visible only to that plugin's own routes.
export async function mongoPlugin(app: App) {
  await client.connect(); // surface bad credentials at boot, not on the first request
  app.decorate("db", db);
  app.onClose(async () => {
    await client.close();
  });
}

// same module as the plugin above
declare module "@daloyjs/core" {
  interface AppState {
    db: typeof db;
  }
}

import { z } from "zod";
import { MongoServerError, ObjectId } from "mongodb";
import type { WithId } from "mongodb";
import { App, ConflictError, NotFoundError } from "@daloyjs/core";
import { serve } from "@daloyjs/core/node";
import { mongoPlugin } from "./db/mongo.ts";
import { ObjectIdSchema, UserFields, UserSchema } from "./db/schemas.ts";
import type { UserDoc } from "./db/schemas.ts";

const app = new App();
await mongoPlugin(app);

const toUser = (doc: WithId<UserDoc>) => ({
  id: doc._id.toHexString(),
  email: doc.email,
  name: doc.name,
  createdAt: doc.createdAt.toISOString(),
});

app.get(
  "/users/:id",
  {
    operationId: "getUser",
    request: { params: z.object({ id: ObjectIdSchema }) },
    responses: {
      200: { description: "Found", body: UserSchema },
      404: { description: "Not found" },
    },
  },
  async ({ params, state }) => {
    const user = await state.db.users.findOne({ _id: new ObjectId(params.id) });
    if (!user) throw new NotFoundError("User not found");
    return { status: 200, body: toUser(user) };
  },
);

app.post(
  "/users",
  {
    operationId: "createUser",
    request: { body: UserFields.extend({ name: UserFields.shape.name.optional() }) },
    responses: {
      201: { description: "Created", body: UserSchema },
      409: { description: "Email already in use" },
    },
  },
  async ({ body, state }) => {
    // Build the document field by field: never insert the request body itself.
    const doc: UserDoc = { email: body.email, name: body.name ?? null, createdAt: new Date() };
    try {
      const { insertedId } = await state.db.users.insertOne(doc);
      return { status: 201, body: toUser({ _id: insertedId, ...doc }) };
    } catch (err) {
      // 11000 is a duplicate key on a unique index (see "Indexes" below).
      if (err instanceof MongoServerError && err.code === 11000) {
        throw new ConflictError("Email already in use");
      }
      throw err;
    }
  },
);

app.patch(
  "/users/:id",
  {
    operationId: "updateUser",
    request: {
      params: z.object({ id: ObjectIdSchema }),
      body: z.strictObject({ name: UserFields.shape.name }),
    },
    responses: {
      200: { description: "Updated", body: UserSchema },
      404: { description: "Not found" },
    },
  },
  async ({ params, body, state }) => {
    // The update document is built in code: $set names exactly one field.
    const user = await state.db.users.findOneAndUpdate(
      { _id: new ObjectId(params.id) },
      { $set: { name: body.name } },
      { returnDocument: "after" },
    );
    if (!user) throw new NotFoundError("User not found");
    return { status: 200, body: toUser(user) };
  },
);

app.delete(
  "/users/:id",
  {
    operationId: "deleteUser",
    request: { params: z.object({ id: ObjectIdSchema }) },
    responses: {
      204: { description: "Deleted" },
      404: { description: "Not found" },
    },
  },
  async ({ params, state }) => {
    const { deletedCount } = await state.db.users.deleteOne({ _id: new ObjectId(params.id) });
    if (deletedCount === 0) throw new NotFoundError("User not found");
    return { status: 204, body: undefined };
  },
);

await app.ready();
serve(app, { port: 3000 });

import { z } from "zod";
import { isForbiddenObjectKey } from "@daloyjs/core";

// Keys a client may use in a free-form map: no "$" prefix (operators), no "."
// (dotted paths into nested fields), and none of the prototype-pollution names.
const SafeKey = z
  .string()
  .min(1)
  .max(64)
  .regex(/^[^$.][^.]*$/, "Keys may not start with $ or contain .")
  .refine((key) => !isForbiddenObjectKey(key), "Reserved key");

// Flat string values only: nested objects could smuggle operators back in.
export const MetadataSchema = z.record(SafeKey, z.string().max(500));

import { ConflictError } from "@daloyjs/core";

handler: async ({ body, state }) => {
  const session = state.db.client.startSession();
  try {
    const orderId = await session.withTransaction(async () => {
      const stock = await state.db.inventory.updateOne(
        { sku: body.sku, stock: { $gte: body.qty } },
        { $inc: { stock: -body.qty } },
        { session },
      );
      if (stock.modifiedCount === 0) throw new ConflictError("Not enough stock");

      const { insertedId } = await state.db.orders.insertOne(
        { sku: body.sku, qty: body.qty, createdAt: new Date() },
        { session },
      );
      return insertedId;
    });
    return { status: 201, body: { id: orderId.toHexString(), sku: body.sku, qty: body.qty } };
  } finally {
    await session.endSession();
  }
}

import { MongoClient } from "mongodb";

const client = new MongoClient(process.env.MONGODB_ADMIN_URI!);
try {
  const users = client.db(process.env.MONGODB_DB ?? "app").collection("users");
  await users.createIndex({ email: 1 }, { unique: true, name: "users_email_unique" });
  await users.createIndex({ createdAt: -1, _id: -1 }, { name: "users_created_at_id" });
} finally {
  await client.close();
}

node scripts/ensure-indexes.ts

import { ObjectId } from "mongodb";
import { BadRequestError, decodeCursor, encodeCursor, paginationQuery } from "@daloyjs/core";

const CursorSchema = z.strictObject({ id: ObjectIdSchema });

// inside a route with request: { query: paginationQuery({ maxLimit: 100 }) }
let filter = {};
if (query.cursor) {
  const parsed = CursorSchema.safeParse(decodeCursor(query.cursor));
  if (!parsed.success) throw new BadRequestError("Invalid pagination cursor.");
  filter = { _id: { $lt: new ObjectId(parsed.data.id) } }; // operator chosen in code
}
const docs = await state.db.users
  .find(filter)
  .sort({ _id: -1 })
  .limit(query.limit + 1)
  .toArray();
const page = docs.slice(0, query.limit);
const last = docs.length > query.limit ? page[page.length - 1] : undefined;
const nextCursor = last ? encodeCursor({ id: last._id.toHexString() }) : null;

import { MongoClient } from "mongodb";
import { App } from "@daloyjs/core";
import type { UserDoc } from "./db/schemas.ts";

// Module scope: created on cold start, reused by every warm invocation.
const client = new MongoClient(process.env.MONGODB_URI!, {
  maxPoolSize: 2,
  maxIdleTimeMS: 60_000,
  serverSelectionTimeoutMS: 5_000,
});
await client.connect();

const app = new App();
app.decorate("db", { client, users: client.db("app").collection<UserDoc>("users") });

// ...register routes, then export the adapter handler for your platform