How to generate random ID instead of auto increment in Mongoose - node.js

Question

I am creating an app where customers can scan codes, and when scanned, it opens a website which basically redeems that code. The problem is that all these codes have an auto-incremented ID, so the customer could just redeem all possible codes just by increasing the ID number in the url.. Is there a way to generate random uuid's in mongoose instead of the default auto incremented ObjectID?

Answer 1

You can achieve what you are looking for by the below command:
var mongoose = require('mongoose');
var id = mongoose.Types.ObjectId('4edd40c86762e0fb12000003');
where 4edd40c86762e0fb12000003 is the custom ObjectId you desire for.
To generate a completely random non-incrementing string, use the below code.
let randomString = _.times(16, () = (Math.random()*0xF<<0).toString(24)).join('');
var id = mongoose.Types.ObjectId(randomString);
Make sure that you are Inserting/Updating is a valid ObjectId on length 24 and a duplicate of the same ObjectId doesn't exist in another document in the same collection.
To generate a random ObjectId, use the below code.
var mongoose = require('mongoose');
var id = mongoose.Types.ObjectId();
Note: A random ObjectId will be created if you don't pass any value to the parameter
Furthermore, you can insert any custom _id key inside MongoDB of any recognized MongoDB types, as long as its' unique in that collection, it will work.
Example:
db.col.insertMany([{"_id": 1}, {"_id": 2}])
db.col.insertMany([{"_id": "Product1"}, {"_id": "Product2"}])
will work just fine.

Answer 2

Instead of replacing the entire unique ObjectId with a random number, could you append a random number when printing out the code?
For example, parseInt(Math.floor(Math.random()*65536),16) will give you a random 4-character code. Store that as a validator when writing the document to the database, and append it to the ObjectId when generating the scannable token.
When the user scans the code, you can use the first 24 characters to look up the document, then verify that the last 4 characters match the validator. No external libraries required.
If you want to get even fancier, append a check digit or checksum on the code (such as is done with credit card numbers) so that the client side can sometimes determine that a code is invalid without even consulting the database.