fix(scopes): scope is injected after checking for options.where (#8864)

lib/model.js

@@ -1771,6 +1771,7 @@ class Model {
   static aggregate(attribute, aggregateFunction, options) {
     options = Utils.cloneDeep(options);
     options = _.defaults(options, { attributes: [] });
+
     this._conformOptions(options, this);
     this._injectScope(options);
 
@@ -1786,6 +1787,7 @@ class Model {
     if (options.distinct) {
       aggregateColumn = this.sequelize.fn('DISTINCT', aggregateColumn);
     }
+
     options.attributes.push([this.sequelize.fn(aggregateFunction, aggregateColumn), aggregateFunction]);
 
     if (!options.dataType) {
@@ -2485,7 +2487,9 @@ class Model {
    * @return {Promise<Integer>} The number of destroyed rows
    */
   static destroy(options) {
-    let instances;
+    options = Utils.cloneDeep(options);
+
+    this._injectScope(options);
 
     if (!options || !(options.where || options.truncate)) {
       throw new Error('Missing where or truncate attribute in the options parameter of model.destroy.');
@@ -2495,7 +2499,6 @@ class Model {
       throw new Error('Expected plain object, array or sequelize method in the options.where parameter of model.destroy.');
     }
 
-    options = Utils.cloneDeep(options);
     options = _.defaults(options, {
       hooks: true,
       individualHooks: false,
@@ -2505,11 +2508,12 @@ class Model {
     });
 
     options.type = QueryTypes.BULKDELETE;
-    this._injectScope(options);
 
     Utils.mapOptionFieldNames(options, this);
     options.model = this;
 
+    let instances;
+
     return Promise.try(() => {
       // Run before hook
       if (options.hooks) {
@@ -2644,9 +2648,11 @@ class Model {
    * @return {Promise<Array<affectedCount,affectedRows>>}
    */
   static update(values, options) {
+    options = Utils.cloneDeep(options);
+
+    this._injectScope(options);
     this._optionsMustContainWhere(options);
 
-    options = Utils.cloneDeep(options);
     options = this._paranoidClause(this, _.defaults(options, {
       validate: true,
       hooks: true,
@@ -2658,8 +2664,6 @@ class Model {
 
     options.type = QueryTypes.BULKUPDATE;
 
-    this._injectScope(options);
-
     // Clone values so it doesn't get modified for caller scope
     values = _.clone(values);
 
@@ -2931,6 +2935,7 @@ class Model {
   */
   static increment(fields, options) {
     options = options || {};
+
     this._injectScope(options);
     this._optionsMustContainWhere(options);
 

test/integration/model/scope/destroy.test.js

@@ -89,6 +89,15 @@ describe(Support.getTestDialectTeaser('Model'), () => {
           expect(users[2].get('username')).to.equal('fred');
         });
       });
+
+      it('should work with empty where', function() {
+        return this.ScopeMe.scope('lowAccess').destroy().then(() => {
+          return this.ScopeMe.unscoped().findAll();
+        }).then(users => {
+          expect(users).to.have.length(1);
+          expect(users[0].get('username')).to.equal('tobi');
+        });
+      });
     });
   });
 });

test/integration/model/scope/update.test.js

@@ -92,6 +92,19 @@ describe(Support.getTestDialectTeaser('Model'), () => {
           expect(users[0].get('email')).to.equal('dan@sequelizejs.com');
         });
       });
+
+      it('should work with empty where', function() {
+        return this.ScopeMe.scope('lowAccess').update({
+          username: 'ruby'
+        }).then(() => {
+          return this.ScopeMe.unscoped().findAll({ where: { username: 'ruby' }});
+        }).then(users => {
+          expect(users).to.have.length(3);
+          users.forEach(user => {
+            expect(user.get('username')).to.equal('ruby');
+          });
+        });
+      });
     });
   });
 });