@c9up/atlas 0.1.9 → 0.1.11

package/src/testing/Factory.ts

@@ -26,16 +26,15 @@ export interface FactoryBuilder<T extends BaseEntity> {
 	/** Override specific fields for the next call (reset after consumption). */
 	merge(overrides: Partial<Record<string, unknown>>): FactoryBuilder<T>;
 
-	/**
-	 * Declare a named variation of this factory. States are stored on the
-	 * factory itself and don't mutate the caller — `apply()` returns a child
-	 * builder with the state active.
-	 */
+	/** Declare a named variation of this factory, stored on the factory's state map. */
 	state(name: string, fn: StateFn<Record<string, unknown>>): FactoryBuilder<T>;
 
 	/**
-	 * Activate one or more declared states for the next call. Multiple applies
-	 * compose (all applied states fire, in order).
+	 * Activate one or more declared states for the NEXT build. Multiple applies
+	 * compose (all fire, in order). NOTE: this mutates the builder's shared
+	 * pending state and returns the SAME builder for chaining — there is no
+	 * isolated child builder. The pending set is reset after each make/create
+	 * (audit 2026-06-13). `merge()` behaves the same way.
 	 */
 	apply(...stateNames: string[]): FactoryBuilder<T>;
 
@@ -120,13 +119,11 @@ export function factory<T extends BaseEntity>(
 		},
 
 		makeMany(count) {
-			// Re-evaluate defaults for each row so `Date.now()` / faker generate distinct values.
+			// Re-evaluate defaults for each row so `Date.now()` / faker generate
+			// distinct values. `buildData()` reads (never mutates) the pending
+			// overrides/states, so they stay stable across iterations on their own.
 			const rows: Record<string, unknown>[] = [];
-			const capturedOverrides = pendingOverrides;
-			const capturedStates = pendingStates;
 			for (let i = 0; i < count; i++) {
-				pendingOverrides = capturedOverrides;
-				pendingStates = capturedStates;
 				rows.push(buildData());
 			}
 			resetPending();

package/src/utils/safePath.ts

@@ -40,13 +40,19 @@ export function assertSafeName(
  * Resolve `fileName` inside `baseDir` and throw if the resulting path escapes
  * the base — guards against symlink / `../` traversal attacks when loading
  * migration or seeder files dynamically.
+ *
+ * Two layers: (1) a logical `path.resolve` check that catches `../` walks, and
+ * (2) a `realpath` check that follows symlinks — a symlink FILE sitting inside
+ * the base but pointing at `/etc/passwd` passes the logical check yet is caught
+ * here. When the file doesn't exist yet (ENOENT), only the logical check
+ * applies and the caller's own existence check produces the not-found error.
  */
-export function assertPathInsideBase(
+export async function assertPathInsideBase(
 	baseDir: string,
 	fileName: string,
 	errorCode: string,
 	kind: string,
-): string {
+): Promise<string> {
 	const resolved = path.resolve(baseDir, fileName);
 	const base = path.resolve(baseDir);
 	if (!resolved.startsWith(base + path.sep) && resolved !== base) {
@@ -55,5 +61,24 @@ export function assertPathInsideBase(
 			`${kind} path escapes directory: ${fileName}`,
 		);
 	}
+	// Symlink-aware check: resolve real targets and re-verify containment.
+	try {
+		const realBase = await fsp.realpath(base);
+		const realResolved = await fsp.realpath(resolved);
+		if (
+			!realResolved.startsWith(realBase + path.sep) &&
+			realResolved !== realBase
+		) {
+			throw new AtlasError(
+				errorCode,
+				`${kind} path escapes directory via symlink: ${fileName}`,
+			);
+		}
+	} catch (err) {
+		// File not yet created — the logical check above stands; let the caller's
+		// existence check report the missing file. Re-throw real traversal errors.
+		if (err instanceof AtlasError) throw err;
+		if ((err as NodeJS.ErrnoException).code !== "ENOENT") throw err;
+	}
 	return resolved;
 }