Mongoose Connection Authentication vs. MongoDB Driver Pooled Credential Persistence

Mongoose’s `mongoose.connect()` options let you specify `user`, `pass`, `authSource` and `authMechanism` to enforce least‑privilege access, while the underlying MongoDB driver maintains a pooled connection cache that may retain authentication state after credentials change.

The current behavior raises a security gap: unless the application forces a reconnect, a pooled connection can continue using stale credentials even after a password is marked expired, and Mongoose provides no built‑in mechanism to invalidate authentication automatically.

Key questions: How does Mongoose’s `authSource`/`authMechanism` enforce least‑privilege when the driver reuses pooled connections after a password change? Does the MongoDB driver automatically re‑authenticate a connection when the user’s credentials are marked expired, or must the application force a reconnect? What strategy should be used to detect and close stale connections in a Mongoose 6.x Node.js application?