@mikro-orm/core 7.0.0-dev.13 → 7.0.0-dev.131

package/metadata/MetadataProvider.d.ts

@@ -1,13 +1,22 @@
 import type { EntityMetadata } from '../typings.js';
 import type { Logger } from '../logging/Logger.js';
+import type { SyncCacheAdapter } from '../cache/CacheAdapter.js';
+import type { Platform } from '../platforms/Platform.js';
 export interface IConfiguration {
     get(key: string, defaultValue?: any): any;
     getLogger(): Logger;
+    getMetadataCacheAdapter(): SyncCacheAdapter;
+    getPlatform(): Platform;
 }
-export declare abstract class MetadataProvider {
+export declare class MetadataProvider {
     protected readonly config: IConfiguration;
     constructor(config: IConfiguration);
-    abstract loadEntityMetadata(meta: EntityMetadata, name: string): void;
+    loadEntityMetadata(meta: EntityMetadata): void;
     loadFromCache(meta: EntityMetadata, cache: EntityMetadata): void;
+    static useCache(): boolean;
     useCache(): boolean;
+    saveToCache(meta: EntityMetadata): void;
+    getCachedMetadata<T>(meta: Pick<EntityMetadata<T>, 'className' | 'path' | 'root'>, root: EntityMetadata<T>): EntityMetadata<T> | undefined;
+    combineCache(): void;
+    getCacheKey(meta: Pick<EntityMetadata, 'className' | 'path'>): string;
 }

package/metadata/MetadataProvider.js

@@ -1,20 +1,64 @@
 import { Utils } from '../utils/Utils.js';
+import { EntitySchema } from './EntitySchema.js';
 export class MetadataProvider {
     config;
     constructor(config) {
         this.config = config;
     }
+    loadEntityMetadata(meta) {
+        for (const prop of meta.props) {
+            /* v8 ignore next */
+            if (typeof prop.entity === 'string') {
+                prop.type = prop.entity;
+            }
+            else if (prop.entity) {
+                const tmp = prop.entity();
+                prop.type = Array.isArray(tmp) ? tmp.map(t => Utils.className(t)).sort().join(' | ') : Utils.className(tmp);
+                prop.target = tmp instanceof EntitySchema ? tmp.meta.class : tmp;
+            }
+            else if (!prop.type && !(prop.enum && (prop.items?.length ?? 0) > 0)) {
+                throw new Error(`Please provide either 'type' or 'entity' attribute in ${meta.className}.${prop.name}.`);
+            }
+        }
+    }
     loadFromCache(meta, cache) {
         Object.values(cache.properties).forEach(prop => {
             const metaProp = meta.properties[prop.name];
-            /* v8 ignore next 3 */
+            /* v8 ignore next */
             if (metaProp?.enum && Array.isArray(metaProp.items)) {
                 delete prop.items;
             }
         });
         Utils.mergeConfig(meta, cache);
     }
+    static useCache() {
+        return false;
+    }
     useCache() {
-        return this.config.get('metadataCache').enabled ?? false;
+        return this.config.get('metadataCache').enabled ?? MetadataProvider.useCache();
+    }
+    saveToCache(meta) {
+        //
+    }
+    getCachedMetadata(meta, root) {
+        if (!this.useCache()) {
+            return undefined;
+        }
+        const cache = meta.path && this.config.getMetadataCacheAdapter().get(this.getCacheKey(meta));
+        if (cache) {
+            this.loadFromCache(meta, cache);
+            meta.root = root;
+        }
+        return cache;
+    }
+    combineCache() {
+        const path = this.config.getMetadataCacheAdapter().combine?.();
+        // override the path in the options, so we can log it from the CLI in `cache:generate` command
+        if (path) {
+            this.config.get('metadataCache').combined = path;
+        }
+    }
+    getCacheKey(meta) {
+        return meta.className;
     }
 }

package/metadata/MetadataStorage.d.ts

@@ -1,25 +1,27 @@
-import { EntityMetadata, type Dictionary, type EntityData, type EntityName } from '../typings.js';
+import { type Dictionary, EntityMetadata, type EntityName } from '../typings.js';
 import type { EntityManager } from '../EntityManager.js';
 export declare class MetadataStorage {
     static readonly PATH_SYMBOL: unique symbol;
     private static readonly metadata;
     private readonly metadata;
+    private readonly idMap;
+    private readonly classNameMap;
+    private readonly uniqueNameMap;
     constructor(metadata?: Dictionary<EntityMetadata>);
     static getMetadata(): Dictionary<EntityMetadata>;
     static getMetadata<T = any>(entity: string, path: string): EntityMetadata<T>;
     static isKnownEntity(name: string): boolean;
-    static getMetadataFromDecorator<T = any>(target: T & Dictionary & {
-        [MetadataStorage.PATH_SYMBOL]?: string;
-    }): EntityMetadata<T>;
-    static init(): MetadataStorage;
     static clear(): void;
-    getAll(): Dictionary<EntityMetadata>;
-    getByDiscriminatorColumn<T>(meta: EntityMetadata<T>, data: EntityData<T>): EntityMetadata<T> | undefined;
-    get<T = any>(entityName: EntityName<T>, init?: boolean, validate?: boolean): EntityMetadata<T>;
+    getAll(): Map<EntityName, EntityMetadata>;
+    get<T = any>(entityName: EntityName<T>, init?: boolean): EntityMetadata<T>;
     find<T = any>(entityName: EntityName<T>): EntityMetadata<T> | undefined;
-    has(entity: string): boolean;
-    set(entity: string, meta: EntityMetadata): EntityMetadata;
-    reset(entity: string): void;
+    has<T>(entityName: EntityName<T>): boolean;
+    set<T>(entityName: EntityName<T>, meta: EntityMetadata): EntityMetadata;
+    reset<T>(entityName: EntityName<T>): void;
     decorate(em: EntityManager): void;
     [Symbol.iterator](): IterableIterator<EntityMetadata>;
+    getById<T>(id: number): EntityMetadata<T>;
+    getByClassName<T = any, V extends boolean = true>(className: string, validate?: V): V extends true ? EntityMetadata<T> : EntityMetadata<T> | undefined;
+    getByUniqueName<T = any, V extends boolean = true>(uniqueName: string, validate?: V): V extends true ? EntityMetadata<T> : EntityMetadata<T> | undefined;
+    private validate;
 }

package/metadata/MetadataStorage.js

@@ -2,12 +2,28 @@ import { EntityMetadata } from '../typings.js';
 import { Utils } from '../utils/Utils.js';
 import { MetadataError } from '../errors.js';
 import { EntityHelper } from '../entity/EntityHelper.js';
+import { EntitySchema } from './EntitySchema.js';
+function getGlobalStorage(namespace) {
+    const key = `mikro-orm-${namespace}`;
+    globalThis[key] = globalThis[key] || {};
+    return globalThis[key];
+}
 export class MetadataStorage {
     static PATH_SYMBOL = Symbol('MetadataStorage.PATH_SYMBOL');
-    static metadata = Utils.getGlobalStorage('metadata');
-    metadata;
+    static metadata = getGlobalStorage('metadata');
+    metadata = new Map();
+    idMap;
+    classNameMap;
+    uniqueNameMap;
     constructor(metadata = {}) {
-        this.metadata = Utils.copy(metadata, false);
+        this.idMap = {};
+        this.uniqueNameMap = {};
+        this.classNameMap = Utils.copy(metadata, false);
+        for (const meta of Object.values(this.classNameMap)) {
+            this.idMap[meta._id] = meta;
+            this.uniqueNameMap[meta.uniqueName] = meta;
+            this.metadata.set(meta.class, meta);
+        }
     }
     static getMetadata(entity, path) {
         const key = entity && path ? entity + '-' + Utils.hash(path) : null;
@@ -22,63 +38,80 @@ export class MetadataStorage {
     static isKnownEntity(name) {
         return !!Object.values(this.metadata).find(meta => meta.className === name);
     }
-    static getMetadataFromDecorator(target) {
-        if (!Object.hasOwn(target, MetadataStorage.PATH_SYMBOL)) {
-            Object.defineProperty(target, MetadataStorage.PATH_SYMBOL, { value: Utils.lookupPathFromDecorator(target.name), writable: true });
-        }
-        return MetadataStorage.getMetadata(target.name, target[MetadataStorage.PATH_SYMBOL]);
-    }
-    static init() {
-        return new MetadataStorage(MetadataStorage.metadata);
-    }
     static clear() {
         Object.keys(this.metadata).forEach(k => delete this.metadata[k]);
     }
     getAll() {
         return this.metadata;
     }
-    getByDiscriminatorColumn(meta, data) {
-        const value = data[meta.root.discriminatorColumn];
-        if (!value) {
-            return undefined;
-        }
-        const type = meta.root.discriminatorMap[value];
-        return this.metadata[type];
-    }
-    get(entityName, init = false, validate = true) {
-        entityName = Utils.className(entityName);
-        if (validate && !init && !this.has(entityName)) {
-            throw MetadataError.missingMetadata(entityName);
+    get(entityName, init = false) {
+        const exists = this.find(entityName);
+        if (exists) {
+            return exists;
         }
-        if (init && !this.has(entityName)) {
-            this.metadata[entityName] = new EntityMetadata();
+        const className = Utils.className(entityName);
+        if (!init) {
+            throw MetadataError.missingMetadata(className);
         }
-        return this.metadata[entityName];
+        const meta = new EntityMetadata({ class: entityName, name: className });
+        this.set(entityName, meta);
+        return meta;
     }
     find(entityName) {
         if (!entityName) {
             return;
         }
-        entityName = Utils.className(entityName);
-        return this.metadata[entityName];
+        const meta = this.metadata.get(entityName);
+        if (meta) {
+            return meta;
+        }
+        if (entityName instanceof EntitySchema) {
+            return this.metadata.get(entityName.meta.class) ?? entityName.meta;
+        }
+        return this.classNameMap[Utils.className(entityName)];
     }
-    has(entity) {
-        return entity in this.metadata;
+    has(entityName) {
+        return this.metadata.has(entityName);
     }
-    set(entity, meta) {
-        return this.metadata[entity] = meta;
+    set(entityName, meta) {
+        this.metadata.set(entityName, meta);
+        this.idMap[meta._id] = meta;
+        this.uniqueNameMap[meta.uniqueName] = meta;
+        this.classNameMap[Utils.className(entityName)] = meta;
+        return meta;
     }
-    reset(entity) {
-        delete this.metadata[entity];
+    reset(entityName) {
+        const meta = this.find(entityName);
+        if (meta) {
+            this.metadata.delete(meta.class);
+            delete this.idMap[meta._id];
+            delete this.uniqueNameMap[meta.uniqueName];
+            delete this.classNameMap[meta.className];
+        }
     }
     decorate(em) {
-        Object.values(this.metadata)
+        [...this.metadata.values()]
             .filter(meta => meta.prototype)
             .forEach(meta => EntityHelper.decorate(meta, em));
     }
     *[Symbol.iterator]() {
-        for (const meta of Object.values(this.metadata)) {
+        for (const meta of this.metadata.values()) {
             yield meta;
         }
     }
+    getById(id) {
+        return this.idMap[id];
+    }
+    getByClassName(className, validate = true) {
+        return this.validate(this.classNameMap[className], className, validate);
+    }
+    getByUniqueName(uniqueName, validate = true) {
+        return this.validate(this.uniqueNameMap[uniqueName], uniqueName, validate);
+    }
+    validate(meta, id, validate) {
+        if (!meta && validate) {
+            throw MetadataError.missingMetadata(id);
+        }
+        return meta;
+    }
 }

package/metadata/MetadataValidator.d.ts

@@ -1,18 +1,11 @@
-import type { EntityMetadata } from '../typings.js';
+import type { EntityMetadata, EntityName } from '../typings.js';
 import { type MetadataDiscoveryOptions } from '../utils/Configuration.js';
-import { ReferenceKind } from '../enums.js';
 import type { MetadataStorage } from './MetadataStorage.js';
 /**
  * @internal
  */
 export declare class MetadataValidator {
-    /**
-     * Validate there is only one property decorator. This disallows using `@Property()` together with e.g. `@ManyToOne()`
-     * on the same property. One should use only `@ManyToOne()` in such case.
-     * We allow the existence of the property in metadata if the reference type is the same, this should allow things like HMR to work.
-     */
-    static validateSingleDecorator(meta: EntityMetadata, propertyName: string, reference: ReferenceKind): void;
-    validateEntityDefinition<T>(metadata: MetadataStorage, name: string, options: MetadataDiscoveryOptions): void;
+    validateEntityDefinition<T>(metadata: MetadataStorage, name: EntityName<T>, options: MetadataDiscoveryOptions): void;
     validateDiscovered(discovered: EntityMetadata[], options: MetadataDiscoveryOptions): void;
     private validateReference;
     private validateBidirectional;
@@ -21,4 +14,13 @@ export declare class MetadataValidator {
     private validateIndexes;
     private validateDuplicateFieldNames;
     private validateVersionField;
+    /**
+     * Validates that entity properties do not use dangerous names that could lead to
+     * prototype pollution vulnerabilities. This validation ensures that property names
+     * cannot be exploited to modify object prototypes when values are assigned during
+     * entity hydration or persistence operations.
+     *
+     * @internal
+     */
+    private validatePropertyNames;
 }

package/metadata/MetadataValidator.js

@@ -1,20 +1,22 @@
 import { Utils } from '../utils/Utils.js';
 import { MetadataError } from '../errors.js';
 import { ReferenceKind } from '../enums.js';
+/**
+ * List of property names that could lead to prototype pollution vulnerabilities.
+ * These names should never be used as entity property names because they could
+ * allow malicious code to modify object prototypes when property values are assigned.
+ *
+ * - `__proto__`: Could modify the prototype chain
+ * - `constructor`: Could modify the constructor property
+ * - `prototype`: Could modify the prototype object
+ *
+ * @internal
+ */
+const DANGEROUS_PROPERTY_NAMES = ['__proto__', 'constructor', 'prototype'];
 /**
  * @internal
  */
 export class MetadataValidator {
-    /**
-     * Validate there is only one property decorator. This disallows using `@Property()` together with e.g. `@ManyToOne()`
-     * on the same property. One should use only `@ManyToOne()` in such case.
-     * We allow the existence of the property in metadata if the reference type is the same, this should allow things like HMR to work.
-     */
-    static validateSingleDecorator(meta, propertyName, reference) {
-        if (meta.properties[propertyName] && meta.properties[propertyName].kind !== reference) {
-            throw MetadataError.multipleDecorators(meta.className, propertyName);
-        }
-    }
     validateEntityDefinition(metadata, name, options) {
         const meta = metadata.get(name);
         if (meta.virtual || meta.expression) {
@@ -36,13 +38,14 @@ export class MetadataValidator {
         this.validateDuplicateFieldNames(meta, options);
         this.validateIndexes(meta, meta.indexes ?? [], 'index');
         this.validateIndexes(meta, meta.uniques ?? [], 'unique');
+        this.validatePropertyNames(meta);
         for (const prop of Utils.values(meta.properties)) {
             if (prop.kind !== ReferenceKind.SCALAR) {
-                this.validateReference(meta, prop, metadata, options);
-                this.validateBidirectional(meta, prop, metadata);
+                this.validateReference(meta, prop, options);
+                this.validateBidirectional(meta, prop);
             }
-            else if (metadata.has(prop.type)) {
-                throw MetadataError.propertyTargetsEntityType(meta, prop, metadata.get(prop.type));
+            else if (metadata.getByClassName(prop.type, false)) {
+                throw MetadataError.propertyTargetsEntityType(meta, prop, metadata.getByClassName(prop.type));
             }
         }
     }
@@ -50,17 +53,13 @@ export class MetadataValidator {
         if (discovered.length === 0 && options.warnWhenNoEntities) {
             throw MetadataError.noEntityDiscovered();
         }
-        const duplicates = Utils.findDuplicates(discovered.map(meta => meta.className));
-        if (duplicates.length > 0 && options.checkDuplicateEntities) {
-            throw MetadataError.duplicateEntityDiscovered(duplicates);
-        }
         const tableNames = discovered.filter(meta => !meta.abstract && meta === meta.root && (meta.tableName || meta.collection) && meta.schema !== '*');
         const duplicateTableNames = Utils.findDuplicates(tableNames.map(meta => {
             const tableName = meta.tableName || meta.collection;
             return (meta.schema ? '.' + meta.schema : '') + tableName;
         }));
-        if (duplicateTableNames.length > 0 && options.checkDuplicateTableNames && options.checkDuplicateEntities) {
-            throw MetadataError.duplicateEntityDiscovered(duplicateTableNames, 'table names');
+        if (duplicateTableNames.length > 0 && options.checkDuplicateTableNames) {
+            throw MetadataError.duplicateEntityDiscovered(duplicateTableNames);
         }
         // validate we found at least one entity (not just abstract/base entities)
         if (discovered.filter(meta => meta.name).length === 0 && options.warnWhenNoEntities) {
@@ -71,7 +70,7 @@ export class MetadataValidator {
             .replace(/\[]$/, '') // remove array suffix
             .replace(/\((.*)\)/, '$1'); // unwrap union types
         const name = (p) => {
-            if (typeof p === 'function') {
+            if (typeof p === 'function' && !p.prototype) {
                 return Utils.className(p());
             }
             return Utils.className(p);
@@ -95,12 +94,12 @@ export class MetadataValidator {
             }
         });
     }
-    validateReference(meta, prop, metadata, options) {
+    validateReference(meta, prop, options) {
         // references do have types
         if (!prop.type) {
             throw MetadataError.fromWrongTypeDefinition(meta, prop);
         }
-        const targetMeta = metadata.find(prop.type);
+        const targetMeta = prop.targetMeta;
         // references do have type of known entity
         if (!targetMeta) {
             throw MetadataError.fromWrongTypeDefinition(meta, prop);
@@ -112,30 +111,27 @@ export class MetadataValidator {
             throw MetadataError.nonPersistentCompositeProp(meta, prop);
         }
     }
-    validateBidirectional(meta, prop, metadata) {
+    validateBidirectional(meta, prop) {
         if (prop.inversedBy) {
-            const inverse = metadata.get(prop.type).properties[prop.inversedBy];
-            this.validateOwningSide(meta, prop, inverse, metadata);
+            this.validateOwningSide(meta, prop);
         }
         else if (prop.mappedBy) {
-            const inverse = metadata.get(prop.type).properties[prop.mappedBy];
-            this.validateInverseSide(meta, prop, inverse, metadata);
+            this.validateInverseSide(meta, prop);
         }
-        else {
+        else if (prop.kind === ReferenceKind.ONE_TO_MANY && !prop.mappedBy) {
             // 1:m property has `mappedBy`
-            if (prop.kind === ReferenceKind.ONE_TO_MANY && !prop.mappedBy) {
-                throw MetadataError.fromMissingOption(meta, prop, 'mappedBy');
-            }
+            throw MetadataError.fromMissingOption(meta, prop, 'mappedBy');
         }
     }
-    validateOwningSide(meta, prop, inverse, metadata) {
+    validateOwningSide(meta, prop) {
+        const inverse = prop.targetMeta.properties[prop.inversedBy];
         // has correct `inversedBy` on owning side
         if (!inverse) {
             throw MetadataError.fromWrongReference(meta, prop, 'inversedBy');
         }
-        const targetClassName = metadata.find(inverse.type)?.root.className;
+        const targetClass = inverse.targetMeta?.root.class;
         // has correct `inversedBy` reference type
-        if (inverse.type !== meta.className && targetClassName !== meta.root.className) {
+        if (inverse.type !== meta.className && targetClass !== meta.root.class) {
             throw MetadataError.fromWrongReference(meta, prop, 'inversedBy', inverse);
         }
         // inverse side is not defined as owner
@@ -143,13 +139,14 @@ export class MetadataValidator {
             throw MetadataError.fromWrongOwnership(meta, prop, 'inversedBy');
         }
     }
-    validateInverseSide(meta, prop, owner, metadata) {
+    validateInverseSide(meta, prop) {
+        const owner = prop.targetMeta.properties[prop.mappedBy];
         // has correct `mappedBy` on inverse side
         if (prop.mappedBy && !owner) {
             throw MetadataError.fromWrongReference(meta, prop, 'mappedBy');
         }
         // has correct `mappedBy` reference type
-        if (owner.type !== meta.className && metadata.find(owner.type)?.root.className !== meta.root.className) {
+        if (owner.type !== meta.className && owner.targetMeta?.root.class !== meta.root.class) {
             throw MetadataError.fromWrongReference(meta, prop, 'mappedBy', owner);
         }
         // owning side is not defined as inverse
@@ -192,7 +189,7 @@ export class MetadataValidator {
                     return [prop.embedded ? prop.embedded.join('.') : prop.name, prop.fieldNames[0]];
                 });
             });
-            throw MetadataError.duplicateFieldName(meta.className, pairs);
+            throw MetadataError.duplicateFieldName(meta.class, pairs);
         }
     }
     validateVersionField(meta) {
@@ -209,4 +206,19 @@ export class MetadataValidator {
             throw MetadataError.invalidVersionFieldType(meta);
         }
     }
+    /**
+     * Validates that entity properties do not use dangerous names that could lead to
+     * prototype pollution vulnerabilities. This validation ensures that property names
+     * cannot be exploited to modify object prototypes when values are assigned during
+     * entity hydration or persistence operations.
+     *
+     * @internal
+     */
+    validatePropertyNames(meta) {
+        for (const prop of Utils.values(meta.properties)) {
+            if (DANGEROUS_PROPERTY_NAMES.includes(prop.name)) {
+                throw MetadataError.dangerousPropertyName(meta, prop);
+            }
+        }
+    }
 }

package/metadata/discover-entities.d.ts

@@ -0,0 +1,5 @@
+import { type Constructor } from '../typings.js';
+import { EntitySchema } from './EntitySchema.js';
+export declare function discoverEntities(paths: string | string[], options?: {
+    baseDir?: string;
+}): Promise<Iterable<EntitySchema | Constructor>>;

package/metadata/discover-entities.js

@@ -0,0 +1,40 @@
+import { basename } from 'node:path';
+import { fs } from '../utils/fs-utils.js';
+import { Utils } from '../utils/Utils.js';
+import { MetadataStorage } from './MetadataStorage.js';
+import { EntitySchema } from './EntitySchema.js';
+async function getEntityClassOrSchema(filepath, allTargets, baseDir) {
+    const path = fs.normalizePath(baseDir, filepath);
+    const exports = await fs.dynamicImport(path);
+    const targets = Object.values(exports);
+    // ignore class implementations that are linked from an EntitySchema
+    for (const item of targets) {
+        if (item instanceof EntitySchema) {
+            for (const item2 of targets) {
+                if (item.meta.class === item2) {
+                    targets.splice(targets.indexOf(item2), 1);
+                }
+            }
+        }
+    }
+    for (const item of targets) {
+        const validTarget = item instanceof EntitySchema || (item instanceof Function && MetadataStorage.isKnownEntity(item.name));
+        if (validTarget && !allTargets.has(item)) {
+            allTargets.set(item, path);
+        }
+    }
+}
+export async function discoverEntities(paths, options) {
+    paths = Utils.asArray(paths).map(path => fs.normalizePath(path));
+    const baseDir = fs.absolutePath(options?.baseDir ?? process.cwd());
+    const files = fs.glob(paths, fs.normalizePath(baseDir));
+    const found = new Map();
+    for (const filepath of files) {
+        const filename = basename(filepath);
+        if (!filename.match(/\.[cm]?[jt]s$/) || filename.match(/\.d\.[cm]?ts/)) {
+            continue;
+        }
+        await getEntityClassOrSchema(filepath, found, baseDir);
+    }
+    return found.keys();
+}

package/metadata/index.d.ts

@@ -1,6 +1,6 @@
+export * from './types.js';
 export * from './EntitySchema.js';
 export * from './MetadataDiscovery.js';
 export * from './MetadataStorage.js';
 export * from './MetadataProvider.js';
 export * from './MetadataValidator.js';
-export * from './ReflectMetadataProvider.js';

package/metadata/index.js

@@ -1,6 +1,6 @@
+export * from './types.js';
 export * from './EntitySchema.js';
 export * from './MetadataDiscovery.js';
 export * from './MetadataStorage.js';
 export * from './MetadataProvider.js';
 export * from './MetadataValidator.js';
-export * from './ReflectMetadataProvider.js';