fix: make clear() idempotent without dropping TTL index (plan#runtime)

Author: mingchuno

CHANGELOG.md

@@ -10,6 +10,7 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 - **Compatibility:** Supported/tested matrix: Node 20/22/24 + MongoDB driver 5.x–7.x + MongoDB server 4.4–8.0 (peer range remains `>=5.0.0`).
 - **Packaging:** npm package now ships dual ESM/CJS bundles via `tsdown`, with an explicit exports map and cleaned type declarations (`.d.ts`/`.d.cts`).
 - **Types:** `MongoStore` and option hooks are strongly typed to avoid `any` leaks.
+- **Fixed:** `store.clear()` now uses `deleteMany({})` instead of `collection.drop()`, preserving TTL indexes and treating `NamespaceNotFound` as success so clears are idempotent.
 
 ## [5.1.0] - 2023-10-14
 

docs/PLANS.md

@@ -19,6 +19,7 @@
 
 - Runtime & API Quality
   - store.clear() issues collection.drop(), which wipes the TTL index required for autoRemove: 'native' and throws NamespaceNotFound for empty stores (src/lib/MongoStore.ts:530-535). Switch to deleteMany({}) (keeping indexes) and swallow the namespace error so clear() is idempotent.
+    - [done 2025-11-18] Swapped drop() for deleteMany(), swallowing NamespaceNotFound and adding coverage to ensure TTL index survives clear() (agent: Codex)
   - Decryption failures call the callback twice because the rejection handler just invokes callback(err) and then execution continues to the success path (src/lib/MongoStore.ts:314-326). Re-throw inside the catch or guard against multiple invocations to avoid “callback was already called” regressions.
   - Session TTL math ignores cookie.maxAge; it only respects cookie.expires or a global default in both set() and touch(), so rolling sessions expire too early (src/lib/MongoStore.ts:355-368, 435-439). Mirror express-session's logic: prefer maxAge, fall back to expires, then to ttl.
   - close() always shuts down the underlying MongoClient, even if the user supplied their own client/promise, which can tear down the rest of the app's DB connections (src/lib/MongoStore.ts:188-210, 541-543). Track whether the store created the client and only close in that case; otherwise just clear timers.

src/lib/MongoStore.spec.ts

@@ -173,6 +173,25 @@ test.serial('set with no stringify', async (t) => {
   t.is(await storePromise.length(), 0)
 })
 
+test.serial('clear preserves TTL index and is idempotent', async (t) => {
+  ;({ store, storePromise } = createStoreHelper({ autoRemove: 'native' }))
+  const collection = await store.collectionP
+  await collection.insertOne({
+    _id: 'clear-ttl-index',
+    session: makeData(),
+    expires: new Date(Date.now() + 1000),
+  })
+  const indexesBefore = await collection.listIndexes().toArray()
+  t.true(indexesBefore.some((idx) => idx.name === 'expires_1'))
+
+  await t.notThrowsAsync(() => storePromise.clear())
+
+  const indexesAfter = await collection.listIndexes().toArray()
+  t.true(indexesAfter.some((idx) => idx.name === 'expires_1'))
+
+  await t.notThrowsAsync(() => storePromise.clear())
+})
+
 test.serial('test destory event', async (t) => {
   ;({ store, storePromise } = createStoreHelper())
   const orgSession = makeData()

src/lib/MongoStore.ts

@@ -530,9 +530,25 @@ export default class MongoStore<
   clear(callback: (err: any) => void = noop): void {
     debug('MongoStore#clear()')
     this.collectionP
-      .then((collection) => collection.drop())
+      .then((collection) =>
+        collection.deleteMany(
+          {},
+          { writeConcern: this.options.writeOperationOptions }
+        )
+      )
       .then(() => callback(null))
-      .catch((err) => callback(err))
+      .catch((err: unknown) => {
+        const message = (err as Error | undefined)?.message ?? ''
+        // NamespaceNotFound (code 26) occurs if the collection was dropped earlier; treat as success to keep clear() idempotent.
+        if (
+          (err as { code?: number })?.code === 26 ||
+          /ns not found/i.test(message)
+        ) {
+          callback(null)
+          return
+        }
+        callback(err)
+      })
   }
 
   /**