Why should you care?

Wrong filters return wrong carts, wrong tenants, or leak data across users. Filters are your access logic in the database layer.

See it live — copy this example

Open mongosh or MongoDB Compass, select database nosqlverse, then run the example. Change one field and run again.

db.orders.insertMany([
  { userId: 9, status: "placed", total: 1200, address: { city: "Pune" } },
  { userId: 9, status: "shipped", total: 800, address: { city: "Pune" } },
  { userId: 3, status: "placed", total: 500, address: { city: "Goa" } }
])
db.orders.find({
  userId: 9,
  status: { $in: ["placed", "shipped"] },
  "address.city": "Pune",
  total: { $gte: 1000 }
})

Run Example »

Edit the code below and click Run to see the result in Toolliyo’s live editor.

What happened?

• AND combines all top-level conditions.
• $in allows two statuses.
• Dot notation reaches city inside address.
• $gte keeps totals ≥ 1000 — only the first order matches.

Practice next

1. Insert the sample orders.
2. Run the filter and confirm one match.
3. Remove the total condition and see two Pune orders for user 9.
4. Add $or for city Pune or Goa.
5. Filter status: "placed" only.

Remember

Filters are plain objects with fields and $operators. Dot notation reaches nested fields. Multiple fields mean AND.

Tenant-safe order history

API always includes tenantId and userId in the filter so Customer A never sees Customer B.

Outcome: Authorization is enforced at query time, not only in the UI.