Description
In data.controller.js, the bulkInsertData handler first correctly does delete cleanData.isDeleted and delete cleanData.deletedAt to prevent injection, but then immediately spreads isDeleted: false, deletedAt: null back into the sanitized object (sanitize({ ...cleanData, isDeleted: false, deletedAt: null })). This means every bulk-inserted document gets isDeleted: false and deletedAt: null added explicitly, which is redundant (Mongoose schema already defaults them) and inconsistent with the single-insert path in insertData (lines 53-56), which only deletes but does not re-add these fields. This creates a schema-consistency divergence and could confuse RLS filters or analytics that inspect these fields.
Steps to Reproduce
Call POST /api/data/{collection}/bulk with a valid array.
Inspect the inserted documents in MongoDB.
Every bulk-inserted document has isDeleted: false and deletedAt: null as explicit stored fields.
A single-insert via POST /api/data/{collection} does NOT explicitly store these fields (relies on schema defaults).
Expected Behaviour
Both insertData and bulkInsertData should behave consistently: either both rely on Mongoose schema defaults, or both explicitly set the soft-delete fields. The current mixed behaviour is a latent bug.
Actual Behaviour
bulkInsertData explicitly writes isDeleted: false, deletedAt: null into every inserted document, while insertData does not. Documents from the two paths are structurally different in MongoDB.
Description
In data.controller.js, the bulkInsertData handler first correctly does delete cleanData.isDeleted and delete cleanData.deletedAt to prevent injection, but then immediately spreads isDeleted: false, deletedAt: null back into the sanitized object (sanitize({ ...cleanData, isDeleted: false, deletedAt: null })). This means every bulk-inserted document gets isDeleted: false and deletedAt: null added explicitly, which is redundant (Mongoose schema already defaults them) and inconsistent with the single-insert path in insertData (lines 53-56), which only deletes but does not re-add these fields. This creates a schema-consistency divergence and could confuse RLS filters or analytics that inspect these fields.
Steps to Reproduce
Call POST /api/data/{collection}/bulk with a valid array.
Inspect the inserted documents in MongoDB.
Every bulk-inserted document has isDeleted: false and deletedAt: null as explicit stored fields.
A single-insert via POST /api/data/{collection} does NOT explicitly store these fields (relies on schema defaults).
Expected Behaviour
Both insertData and bulkInsertData should behave consistently: either both rely on Mongoose schema defaults, or both explicitly set the soft-delete fields. The current mixed behaviour is a latent bug.
Actual Behaviour
bulkInsertData explicitly writes isDeleted: false, deletedAt: null into every inserted document, while insertData does not. Documents from the two paths are structurally different in MongoDB.