fix(35): fix rollback incorrectly restoring nested objects when $set targets a dotted path

[hugop95]

• Issues:
  • Fixes Rollback incorrectly restores nested objects when $set targets a dotted path #35
  • https://github.com/360Learning/platform/issues/82294

This fix, alongside making sure that the platform gets the latest version of mongo-bulk-data-migration, should ensure that https://github.com/360Learning/platform/pull/82247#pullrequestreview-4525537020 works.

Description

When a migration uses $set with a dotted path (e.g. 'a.b') to overwrite an existing nested object, the rollback restores that field to a wrong value.

Instead of restoring the original nested structure, it produces a flat object with a dotted key in the field name:

// Expected after rollback
{ channels: { email: true } }

// Received after rollback
{ 'channels.email': true }

Why it happened

During rollback, computeRollbackQuery needs to figure out what value to $set back for each key the migration changed.

For a $set: { 'a.b': newValue }, the backup stores the full original document (e.g. { a: { b: { channels: { email: true } } } }). Internally, the backup is flattened into leaf paths for processing, so a.b.channels.email: true becomes one entry.

The bug was in how those leaf paths were reassembled. The code was slicing off the prefix (a.b) to get the remaining path (channels.email) and using that as a plain JS object key:

// ❌
rollbackSet['a.b'] = { 'channels.email': true }

Instead of looking up the original value directly from the backup:

// ✅
rollbackSet['a.b'] = _.get(backup, 'a.b')

[orca-security-eu]

Orca Security Scan Summary

Status	Check	Issues by priority
Passed	Infrastructure as Code	0   0   0   0	View in Orca
Passed	SAST	0   0   0   0	View in Orca
Passed	Secrets	0   0   0   0	View in Orca
Passed	Vulnerabilities	0   0   0   0	View in Orca

[hugop95]

Hi @pp0rtal 👋

I noticed this issue while reviewing a usage of one of our migration scripts (https://github.com/360Learning/platform/pull/82247#pullrequestreview-4525537020).

I've tested in local and that fix allows https://github.com/360Learning/platform/pull/82247 to be unblocked and merged as it is 👍

There is also another similar PR using that script coming soon (cf https://github.com/360Learning/platform/pull/81907#discussion_r3438557511).

---

The long story short is: we ideally would like to have this merged and used by the platform by the release on next week. 😁

I've allowed myself to bump the package.json and update the changelog, feel free to adjust as needed.

Feel free to merge if everything looks good to you!

[pp0rtal]

@hugop95 Perfect fix!
Safe to go, No need to wait. I'll publish right now, so you can bump MDBM version in your PR

Thank you for taking the time to fix this tool!

[pp0rtal]

@hugop95 Ofc we need lodash for nested support here (like for other cases)