title: ExpressJS and MongooseJS: can I query array values in a subdocument?
body: <p>I've got a web api written using expressjs and mongoosejs.</p>
  
  <p>The main schema in the app contains a subdocument, <code>permissions</code>, which contains array fields. Those arrays contain ids of users who can perform an action on that document. </p>
  
  <p>I'm trying to limit results of a query on that collection by the values in the <code>read</code> subdocument array field:</p>
  
  <p>Here's the main schema:</p>
  
  <pre><code>var MainSchema = new Schema({
      uri: { type: String, required: false },
      user: { type: String, required: false },
      groups: [String],           
      tags: [String],
      permissions: {
          read: [String],
          update: [String],
          delete: [String]
      }
  });
  </code></pre>
  
  <p>I want to return documents that have a specific value in the <code>permissions.read</code> array or where that array is empty.</p>
  
  <p>My code doesn't throw an error, but doesn't limit the results; I still get documents that don't match the given value, and aren't empty.</p>
  
  <p>Here's what I've got:</p>
  
  <pre><code>var MainModel = mongoose.model('MainSchema', MainSchema);
  
  app.get('/api/search', function (req, res) {
      var query = MainModel.find({'uri': req.query.uri }); 
  
      // This works fine
      if (req.query.groups) {
          query.where('groups').in(req.query.groups);
      }
      else if (req.query.user) {
          query.where('user').equals(req.query.user);
      }
  
      // How can I return only documents that match req.query.user or ""?
      query.where('permissions.read').in([req.query.user, ""]);
  
      query.exec(function (err, results) {
        if (!err) {
          return res.send(results);
        } else {
          return console.log(err);
        }
      });
  });
  </code></pre>
  
  <p>I have a hunch that the <code>where</code> clause is not testing the value of each of the elements of <code>permissions.read</code> against each of the values of the array passed to the <code>in</code> clause.</p>
  
  <p>Thanks.</p>
  
  <p><strong>EDIT</strong>: Here's a document that shouldn't be returned, but is (note, permissions.read array includes a value that's not the current user's ID):</p>
  
  <pre><code>{
      "user": "firstname@gmail.com",
      "uri": "http://localhost:3000/documents/test",
      "permissions": {
        "delete": [
          "firstname@gmail.com"
        ],
        "update": [
          "firstname@gmail.com"
        ],
        "read": [
          "firstname@gmail.com"
        ]
      },
      "tags": [],
      "groups": [
        "demo",
        "2013"
      ]
  }
  </code></pre>
  
  <p><strong>EDITED</strong>: Corrected Model/Schema confusion, which wasn't in my code, but was left out in the copy/paste. Thanks.</p>