u/KalamKiTakat

A lot of Express + Mongoose code has a route like this:

app.post("/signup", async (req, res) =&gt; {
  const user = await User.create(req.body);
  res.status(201).json(user);
});

If the User schema has fields like role or credits, anyone can send { "role": "admin" } and Mongoose saves it, because it's a valid field of the model. The usual fix is a Zod or Joi schema for every route, which means writing every rule twice and keeping both copies in sync.

So I built mongoose-guard. You list the fields a route accepts, and it uses the Mongoose schema you already have for everything else:

import { guard } from "mongoose-guard/express";

app.post("/signup", guard(User, { allow: ["name", "email", "password"] }), signup);

Send role: "admin" to that route and the request never reaches your handler. The client gets a 400:

{"errors":[{"code":"forbidden_field","path":"role","message":"Field is not allowed"}]}

What it does:

Rejects fields that aren't in the allow list, or strips them if you'd rather not fail the request
Checks types strictly. Mongoose would quietly cast "25" to 25; this reports it as a type error
Rejects __proto__, $where, $gt and dotted keys anywhere in the body
Runs your schema's own validators (required, min, enum, match, custom and async ones) through Mongoose itself, so nothing is reimplemented
Handles nested objects, sub-schemas, arrays and Maps, with error paths like addresses.1.city
Has a partial: true mode for PATCH routes

What it doesn't do: it only validates request bodies, not query strings or route params. It doesn't convert form strings to numbers. It won't run on edge runtimes, because Mongoose can't. For a login form, or anything without a model behind it, Zod is still the better tool.

It works with Express 4 and 5, Mongoose 8 and 9, and anything that gives you a standard Request (Next.js route handlers, Hono, Remix, SvelteKit). MIT licensed, no runtime dependencies.

It's 0.1.0, so I'd like to hear where it breaks, or where the allow-list approach doesn't fit how you structure your routes.

Follow these steps.

Install & Sign In: Add the desktop browser extension (Chrome or Firefox) and sign in with Google or GitHub to open your workspace.
Upload Your Résumé: Upload your résumé file so Odigra can parse your profile.
Review & Refine Profile: Check and adjust the extracted target roles, skills, seniority, and location/eligibility preferences before crawling begins.
Launch Matching: Start the live search, the extension crawls supported job sources in your browser session and discards obvious mismatches automatically.
Review & Apply: Inspect the ranked list with fit scores and explanations, then click the original job links to apply.

Visit https://odigra.com/ Please let me know if I need to improve anything. Thanks

I built mongoose-guard: Express middleware that validates request bodies against your existing Mongoose schema

I made this extension to search multiple websites and find relevant jobs for your resume.