@mikro-orm/core 7.0.0-dev.23 → 7.0.0-dev.230

package/metadata/MetadataProvider.d.ts

@@ -1,13 +1,22 @@
 import type { EntityMetadata } from '../typings.js';
 import type { Logger } from '../logging/Logger.js';
+import type { SyncCacheAdapter } from '../cache/CacheAdapter.js';
+import type { Platform } from '../platforms/Platform.js';
 export interface IConfiguration {
     get(key: string, defaultValue?: any): any;
     getLogger(): Logger;
+    getMetadataCacheAdapter(): SyncCacheAdapter;
+    getPlatform(): Platform;
 }
-export declare abstract class MetadataProvider {
+export declare class MetadataProvider {
     protected readonly config: IConfiguration;
     constructor(config: IConfiguration);
-    abstract loadEntityMetadata(meta: EntityMetadata, name: string): void;
+    loadEntityMetadata(meta: EntityMetadata): void;
     loadFromCache(meta: EntityMetadata, cache: EntityMetadata): void;
+    static useCache(): boolean;
     useCache(): boolean;
+    saveToCache(meta: EntityMetadata): void;
+    getCachedMetadata<T>(meta: Pick<EntityMetadata<T>, 'className' | 'path' | 'root'>, root: EntityMetadata<T>): EntityMetadata<T> | undefined;
+    combineCache(): void;
+    getCacheKey(meta: Pick<EntityMetadata, 'className' | 'path'>): string;
 }

package/metadata/MetadataProvider.js

@@ -1,20 +1,64 @@
 import { Utils } from '../utils/Utils.js';
+import { EntitySchema } from './EntitySchema.js';
 export class MetadataProvider {
     config;
     constructor(config) {
         this.config = config;
     }
+    loadEntityMetadata(meta) {
+        for (const prop of meta.props) {
+            /* v8 ignore next */
+            if (typeof prop.entity === 'string') {
+                prop.type = prop.entity;
+            }
+            else if (prop.entity) {
+                const tmp = prop.entity();
+                prop.type = Array.isArray(tmp) ? tmp.map(t => Utils.className(t)).sort().join(' | ') : Utils.className(tmp);
+                prop.target = tmp instanceof EntitySchema ? tmp.meta.class : tmp;
+            }
+            else if (!prop.type && !((prop.enum || prop.array) && (prop.items?.length ?? 0) > 0)) {
+                throw new Error(`Please provide either 'type' or 'entity' attribute in ${meta.className}.${prop.name}.`);
+            }
+        }
+    }
     loadFromCache(meta, cache) {
         Object.values(cache.properties).forEach(prop => {
             const metaProp = meta.properties[prop.name];
-            /* v8 ignore next 3 */
+            /* v8 ignore next */
             if (metaProp?.enum && Array.isArray(metaProp.items)) {
                 delete prop.items;
             }
         });
         Utils.mergeConfig(meta, cache);
     }
+    static useCache() {
+        return false;
+    }
     useCache() {
-        return this.config.get('metadataCache').enabled ?? false;
+        return this.config.get('metadataCache').enabled ?? MetadataProvider.useCache();
+    }
+    saveToCache(meta) {
+        //
+    }
+    getCachedMetadata(meta, root) {
+        if (!this.useCache()) {
+            return undefined;
+        }
+        const cache = meta.path && this.config.getMetadataCacheAdapter().get(this.getCacheKey(meta));
+        if (cache) {
+            this.loadFromCache(meta, cache);
+            meta.root = root;
+        }
+        return cache;
+    }
+    combineCache() {
+        const path = this.config.getMetadataCacheAdapter().combine?.();
+        // override the path in the options, so we can log it from the CLI in `cache:generate` command
+        if (path) {
+            this.config.get('metadataCache').combined = path;
+        }
+    }
+    getCacheKey(meta) {
+        return meta.className;
     }
 }

package/metadata/MetadataStorage.d.ts

@@ -1,25 +1,27 @@
-import { EntityMetadata, type Dictionary, type EntityData, type EntityName } from '../typings.js';
+import { type Dictionary, EntityMetadata, type EntityName } from '../typings.js';
 import type { EntityManager } from '../EntityManager.js';
 export declare class MetadataStorage {
     static readonly PATH_SYMBOL: unique symbol;
     private static readonly metadata;
     private readonly metadata;
+    private readonly idMap;
+    private readonly classNameMap;
+    private readonly uniqueNameMap;
     constructor(metadata?: Dictionary<EntityMetadata>);
     static getMetadata(): Dictionary<EntityMetadata>;
     static getMetadata<T = any>(entity: string, path: string): EntityMetadata<T>;
     static isKnownEntity(name: string): boolean;
-    static getMetadataFromDecorator<T = any>(target: T & Dictionary & {
-        [MetadataStorage.PATH_SYMBOL]?: string;
-    }): EntityMetadata<T>;
-    static init(): MetadataStorage;
     static clear(): void;
-    getAll(): Dictionary<EntityMetadata>;
-    getByDiscriminatorColumn<T>(meta: EntityMetadata<T>, data: EntityData<T>): EntityMetadata<T> | undefined;
-    get<T = any>(entityName: EntityName<T>, init?: boolean, validate?: boolean): EntityMetadata<T>;
+    getAll(): Map<EntityName, EntityMetadata>;
+    get<T = any>(entityName: EntityName<T>, init?: boolean): EntityMetadata<T>;
     find<T = any>(entityName: EntityName<T>): EntityMetadata<T> | undefined;
-    has(entity: string): boolean;
-    set(entity: string, meta: EntityMetadata): EntityMetadata;
-    reset(entity: string): void;
+    has<T>(entityName: EntityName<T>): boolean;
+    set<T>(entityName: EntityName<T>, meta: EntityMetadata): EntityMetadata;
+    reset<T>(entityName: EntityName<T>): void;
     decorate(em: EntityManager): void;
     [Symbol.iterator](): IterableIterator<EntityMetadata>;
+    getById<T>(id: number): EntityMetadata<T>;
+    getByClassName<T = any, V extends boolean = true>(className: string, validate?: V): V extends true ? EntityMetadata<T> : EntityMetadata<T> | undefined;
+    getByUniqueName<T = any, V extends boolean = true>(uniqueName: string, validate?: V): V extends true ? EntityMetadata<T> : EntityMetadata<T> | undefined;
+    private validate;
 }

package/metadata/MetadataStorage.js

@@ -2,12 +2,28 @@ import { EntityMetadata } from '../typings.js';
 import { Utils } from '../utils/Utils.js';
 import { MetadataError } from '../errors.js';
 import { EntityHelper } from '../entity/EntityHelper.js';
+import { EntitySchema } from './EntitySchema.js';
+function getGlobalStorage(namespace) {
+    const key = `mikro-orm-${namespace}`;
+    globalThis[key] = globalThis[key] || {};
+    return globalThis[key];
+}
 export class MetadataStorage {
     static PATH_SYMBOL = Symbol('MetadataStorage.PATH_SYMBOL');
-    static metadata = Utils.getGlobalStorage('metadata');
-    metadata;
+    static metadata = getGlobalStorage('metadata');
+    metadata = new Map();
+    idMap;
+    classNameMap;
+    uniqueNameMap;
     constructor(metadata = {}) {
-        this.metadata = Utils.copy(metadata, false);
+        this.idMap = {};
+        this.uniqueNameMap = {};
+        this.classNameMap = Utils.copy(metadata, false);
+        for (const meta of Object.values(this.classNameMap)) {
+            this.idMap[meta._id] = meta;
+            this.uniqueNameMap[meta.uniqueName] = meta;
+            this.metadata.set(meta.class, meta);
+        }
     }
     static getMetadata(entity, path) {
         const key = entity && path ? entity + '-' + Utils.hash(path) : null;
@@ -22,63 +38,80 @@ export class MetadataStorage {
     static isKnownEntity(name) {
         return !!Object.values(this.metadata).find(meta => meta.className === name);
     }
-    static getMetadataFromDecorator(target) {
-        if (!Object.hasOwn(target, MetadataStorage.PATH_SYMBOL)) {
-            Object.defineProperty(target, MetadataStorage.PATH_SYMBOL, { value: Utils.lookupPathFromDecorator(target.name), writable: true });
-        }
-        return MetadataStorage.getMetadata(target.name, target[MetadataStorage.PATH_SYMBOL]);
-    }
-    static init() {
-        return new MetadataStorage(MetadataStorage.metadata);
-    }
     static clear() {
         Object.keys(this.metadata).forEach(k => delete this.metadata[k]);
     }
     getAll() {
         return this.metadata;
     }
-    getByDiscriminatorColumn(meta, data) {
-        const value = data[meta.root.discriminatorColumn];
-        if (!value) {
-            return undefined;
-        }
-        const type = meta.root.discriminatorMap[value];
-        return this.metadata[type];
-    }
-    get(entityName, init = false, validate = true) {
-        entityName = Utils.className(entityName);
-        if (validate && !init && !this.has(entityName)) {
-            throw MetadataError.missingMetadata(entityName);
+    get(entityName, init = false) {
+        const exists = this.find(entityName);
+        if (exists) {
+            return exists;
         }
-        if (init && !this.has(entityName)) {
-            this.metadata[entityName] = new EntityMetadata();
+        const className = Utils.className(entityName);
+        if (!init) {
+            throw MetadataError.missingMetadata(className);
         }
-        return this.metadata[entityName];
+        const meta = new EntityMetadata({ class: entityName, name: className });
+        this.set(entityName, meta);
+        return meta;
     }
     find(entityName) {
         if (!entityName) {
             return;
         }
-        entityName = Utils.className(entityName);
-        return this.metadata[entityName];
+        const meta = this.metadata.get(entityName);
+        if (meta) {
+            return meta;
+        }
+        if (entityName instanceof EntitySchema) {
+            return this.metadata.get(entityName.meta.class) ?? entityName.meta;
+        }
+        return this.classNameMap[Utils.className(entityName)];
     }
-    has(entity) {
-        return entity in this.metadata;
+    has(entityName) {
+        return this.metadata.has(entityName);
     }
-    set(entity, meta) {
-        return this.metadata[entity] = meta;
+    set(entityName, meta) {
+        this.metadata.set(entityName, meta);
+        this.idMap[meta._id] = meta;
+        this.uniqueNameMap[meta.uniqueName] = meta;
+        this.classNameMap[Utils.className(entityName)] = meta;
+        return meta;
     }
-    reset(entity) {
-        delete this.metadata[entity];
+    reset(entityName) {
+        const meta = this.find(entityName);
+        if (meta) {
+            this.metadata.delete(meta.class);
+            delete this.idMap[meta._id];
+            delete this.uniqueNameMap[meta.uniqueName];
+            delete this.classNameMap[meta.className];
+        }
     }
     decorate(em) {
-        Object.values(this.metadata)
+        [...this.metadata.values()]
             .filter(meta => meta.prototype)
             .forEach(meta => EntityHelper.decorate(meta, em));
     }
     *[Symbol.iterator]() {
-        for (const meta of Object.values(this.metadata)) {
+        for (const meta of this.metadata.values()) {
             yield meta;
         }
     }
+    getById(id) {
+        return this.idMap[id];
+    }
+    getByClassName(className, validate = true) {
+        return this.validate(this.classNameMap[className], className, validate);
+    }
+    getByUniqueName(uniqueName, validate = true) {
+        return this.validate(this.uniqueNameMap[uniqueName], uniqueName, validate);
+    }
+    validate(meta, id, validate) {
+        if (!meta && validate) {
+            throw MetadataError.missingMetadata(id);
+        }
+        return meta;
+    }
 }

package/metadata/MetadataValidator.d.ts

@@ -1,24 +1,47 @@
-import type { EntityMetadata } from '../typings.js';
+import type { EntityMetadata, EntityName } from '../typings.js';
 import { type MetadataDiscoveryOptions } from '../utils/Configuration.js';
-import { ReferenceKind } from '../enums.js';
 import type { MetadataStorage } from './MetadataStorage.js';
 /**
  * @internal
  */
 export declare class MetadataValidator {
-    /**
-     * Validate there is only one property decorator. This disallows using `@Property()` together with e.g. `@ManyToOne()`
-     * on the same property. One should use only `@ManyToOne()` in such case.
-     * We allow the existence of the property in metadata if the reference type is the same, this should allow things like HMR to work.
-     */
-    static validateSingleDecorator(meta: EntityMetadata, propertyName: string, reference: ReferenceKind): void;
-    validateEntityDefinition<T>(metadata: MetadataStorage, name: string, options: MetadataDiscoveryOptions): void;
+    validateEntityDefinition<T>(metadata: MetadataStorage, name: EntityName<T>, options: MetadataDiscoveryOptions): void;
     validateDiscovered(discovered: EntityMetadata[], options: MetadataDiscoveryOptions): void;
     private validateReference;
+    private validateTargetKey;
+    /**
+     * Checks if a property has a unique constraint (either via `unique: true` or single-property `@Unique` decorator).
+     * Composite unique constraints are not sufficient for targetKey.
+     */
+    private isPropertyUnique;
+    private validatePolymorphicTargets;
     private validateBidirectional;
     private validateOwningSide;
     private validateInverseSide;
     private validateIndexes;
     private validateDuplicateFieldNames;
     private validateVersionField;
+    /**
+     * Validates that entity properties do not use dangerous names that could lead to
+     * prototype pollution vulnerabilities. This validation ensures that property names
+     * cannot be exploited to modify object prototypes when values are assigned during
+     * entity hydration or persistence operations.
+     *
+     * @internal
+     */
+    private validatePropertyNames;
+    /**
+     * Validates view entity configuration.
+     * View entities must have an expression.
+     */
+    private validateViewEntity;
+    /**
+     * Validates that STI and TPT are not mixed in the same inheritance hierarchy.
+     * An entity hierarchy can use either STI (discriminatorColumn) or TPT (inheritance: 'tpt'),
+     * but not both.
+     *
+     * Note: This validation runs before `initTablePerTypeInheritance` sets `inheritanceType`,
+     * so we check the raw `inheritance` option from the decorator/schema.
+     */
+    private validateInheritanceStrategies;
 }

package/metadata/MetadataValidator.js

@@ -1,23 +1,33 @@
 import { Utils } from '../utils/Utils.js';
 import { MetadataError } from '../errors.js';
 import { ReferenceKind } from '../enums.js';
+/**
+ * List of property names that could lead to prototype pollution vulnerabilities.
+ * These names should never be used as entity property names because they could
+ * allow malicious code to modify object prototypes when property values are assigned.
+ *
+ * - `__proto__`: Could modify the prototype chain
+ * - `constructor`: Could modify the constructor property
+ * - `prototype`: Could modify the prototype object
+ *
+ * @internal
+ */
+const DANGEROUS_PROPERTY_NAMES = ['__proto__', 'constructor', 'prototype'];
 /**
  * @internal
  */
 export class MetadataValidator {
-    /**
-     * Validate there is only one property decorator. This disallows using `@Property()` together with e.g. `@ManyToOne()`
-     * on the same property. One should use only `@ManyToOne()` in such case.
-     * We allow the existence of the property in metadata if the reference type is the same, this should allow things like HMR to work.
-     */
-    static validateSingleDecorator(meta, propertyName, reference) {
-        if (meta.properties[propertyName] && meta.properties[propertyName].kind !== reference) {
-            throw MetadataError.multipleDecorators(meta.className, propertyName);
-        }
-    }
     validateEntityDefinition(metadata, name, options) {
         const meta = metadata.get(name);
-        if (meta.virtual || meta.expression) {
+        // View entities (expression with view flag) behave like regular tables but are read-only
+        // They can have primary keys and are created as actual database views
+        if (meta.view) {
+            this.validateViewEntity(meta);
+            return;
+        }
+        // Virtual entities (expression without view flag) have restrictions - no PKs, limited relation types
+        // Note: meta.virtual is set later in sync(), so we check for expression && !view here
+        if (meta.virtual || (meta.expression && !meta.view)) {
             for (const prop of Utils.values(meta.properties)) {
                 if (![ReferenceKind.SCALAR, ReferenceKind.EMBEDDED, ReferenceKind.MANY_TO_ONE, ReferenceKind.ONE_TO_ONE].includes(prop.kind)) {
                     throw new MetadataError(`Only scalars, embedded properties and to-many relations are allowed inside virtual entity. Found '${prop.kind}' in ${meta.className}.${prop.name}`);
@@ -36,13 +46,14 @@ export class MetadataValidator {
         this.validateDuplicateFieldNames(meta, options);
         this.validateIndexes(meta, meta.indexes ?? [], 'index');
         this.validateIndexes(meta, meta.uniques ?? [], 'unique');
+        this.validatePropertyNames(meta);
         for (const prop of Utils.values(meta.properties)) {
             if (prop.kind !== ReferenceKind.SCALAR) {
-                this.validateReference(meta, prop, metadata, options);
-                this.validateBidirectional(meta, prop, metadata);
+                this.validateReference(meta, prop, options);
+                this.validateBidirectional(meta, prop);
             }
-            else if (metadata.has(prop.type)) {
-                throw MetadataError.propertyTargetsEntityType(meta, prop, metadata.get(prop.type));
+            else if (metadata.getByClassName(prop.type, false)) {
+                throw MetadataError.propertyTargetsEntityType(meta, prop, metadata.getByClassName(prop.type));
             }
         }
     }
@@ -50,17 +61,15 @@ export class MetadataValidator {
         if (discovered.length === 0 && options.warnWhenNoEntities) {
             throw MetadataError.noEntityDiscovered();
         }
-        const duplicates = Utils.findDuplicates(discovered.map(meta => meta.className));
-        if (duplicates.length > 0 && options.checkDuplicateEntities) {
-            throw MetadataError.duplicateEntityDiscovered(duplicates);
-        }
-        const tableNames = discovered.filter(meta => !meta.abstract && meta === meta.root && (meta.tableName || meta.collection) && meta.schema !== '*');
+        // Validate no mixing of STI and TPT in the same hierarchy
+        this.validateInheritanceStrategies(discovered);
+        const tableNames = discovered.filter(meta => !meta.abstract && !meta.embeddable && meta === meta.root && (meta.tableName || meta.collection) && meta.schema !== '*');
         const duplicateTableNames = Utils.findDuplicates(tableNames.map(meta => {
             const tableName = meta.tableName || meta.collection;
             return (meta.schema ? '.' + meta.schema : '') + tableName;
         }));
-        if (duplicateTableNames.length > 0 && options.checkDuplicateTableNames && options.checkDuplicateEntities) {
-            throw MetadataError.duplicateEntityDiscovered(duplicateTableNames, 'table names');
+        if (duplicateTableNames.length > 0 && options.checkDuplicateTableNames) {
+            throw MetadataError.duplicateEntityDiscovered(duplicateTableNames);
         }
         // validate we found at least one entity (not just abstract/base entities)
         if (discovered.filter(meta => meta.name).length === 0 && options.warnWhenNoEntities) {
@@ -71,7 +80,7 @@ export class MetadataValidator {
             .replace(/\[]$/, '') // remove array suffix
             .replace(/\((.*)\)/, '$1'); // unwrap union types
         const name = (p) => {
-            if (typeof p === 'function') {
+            if (typeof p === 'function' && !p.prototype) {
                 return Utils.className(p());
             }
             return Utils.className(p);
@@ -95,47 +104,134 @@ export class MetadataValidator {
             }
         });
     }
-    validateReference(meta, prop, metadata, options) {
+    validateReference(meta, prop, options) {
         // references do have types
         if (!prop.type) {
             throw MetadataError.fromWrongTypeDefinition(meta, prop);
         }
-        const targetMeta = metadata.find(prop.type);
+        // Polymorphic relations have multiple targets, validate PK compatibility
+        if (prop.polymorphic && prop.polymorphTargets) {
+            this.validatePolymorphicTargets(meta, prop);
+            return;
+        }
+        const targetMeta = prop.targetMeta;
         // references do have type of known entity
         if (!targetMeta) {
             throw MetadataError.fromWrongTypeDefinition(meta, prop);
         }
-        if (targetMeta.abstract && !targetMeta.discriminatorColumn && !targetMeta.embeddable) {
+        if (targetMeta.abstract && !targetMeta.root?.inheritanceType && !targetMeta.embeddable) {
             throw MetadataError.targetIsAbstract(meta, prop);
         }
         if ([ReferenceKind.MANY_TO_ONE, ReferenceKind.ONE_TO_ONE].includes(prop.kind) && prop.persist === false && targetMeta.compositePK && options.checkNonPersistentCompositeProps) {
             throw MetadataError.nonPersistentCompositeProp(meta, prop);
         }
+        this.validateTargetKey(meta, prop, targetMeta);
+    }
+    validateTargetKey(meta, prop, targetMeta) {
+        if (!prop.targetKey) {
+            return;
+        }
+        // targetKey is not supported for ManyToMany relations
+        if (prop.kind === ReferenceKind.MANY_TO_MANY) {
+            throw MetadataError.targetKeyOnManyToMany(meta, prop);
+        }
+        // targetKey must point to an existing property
+        const targetProp = targetMeta.properties[prop.targetKey];
+        if (!targetProp) {
+            throw MetadataError.targetKeyNotFound(meta, prop);
+        }
+        // targetKey must point to a unique property (composite unique is not sufficient)
+        if (!this.isPropertyUnique(targetProp, targetMeta)) {
+            throw MetadataError.targetKeyNotUnique(meta, prop);
+        }
+    }
+    /**
+     * Checks if a property has a unique constraint (either via `unique: true` or single-property `@Unique` decorator).
+     * Composite unique constraints are not sufficient for targetKey.
+     */
+    isPropertyUnique(prop, meta) {
+        if (prop.unique) {
+            return true;
+        }
+        // Check for single-property unique constraint via @Unique decorator
+        return !!meta.uniques?.some(u => {
+            const props = Utils.asArray(u.properties);
+            return props.length === 1 && props[0] === prop.name && !u.options;
+        });
+    }
+    validatePolymorphicTargets(meta, prop) {
+        const targets = prop.polymorphTargets;
+        // Validate targetKey exists and is compatible across all targets
+        if (prop.targetKey) {
+            for (const target of targets) {
+                const targetProp = target.properties[prop.targetKey];
+                if (!targetProp) {
+                    throw MetadataError.targetKeyNotFound(meta, prop, target);
+                }
+                // targetKey must point to a unique property (composite unique is not sufficient)
+                if (!this.isPropertyUnique(targetProp, target)) {
+                    throw MetadataError.targetKeyNotUnique(meta, prop, target);
+                }
+            }
+        }
+        const firstPKs = targets[0].getPrimaryProps();
+        for (let i = 1; i < targets.length; i++) {
+            const target = targets[i];
+            const targetPKs = target.getPrimaryProps();
+            if (targetPKs.length !== firstPKs.length) {
+                throw MetadataError.incompatiblePolymorphicTargets(meta, prop, targets[0], target, 'different number of primary keys');
+            }
+            for (let j = 0; j < firstPKs.length; j++) {
+                const firstPK = firstPKs[j];
+                const targetPK = targetPKs[j];
+                if (firstPK.runtimeType !== targetPK.runtimeType) {
+                    throw MetadataError.incompatiblePolymorphicTargets(meta, prop, targets[0], target, `incompatible primary key types: ${firstPK.name} (${firstPK.runtimeType}) vs ${targetPK.name} (${targetPK.runtimeType})`);
+                }
+            }
+        }
     }
-    validateBidirectional(meta, prop, metadata) {
+    validateBidirectional(meta, prop) {
         if (prop.inversedBy) {
-            const inverse = metadata.get(prop.type).properties[prop.inversedBy];
-            this.validateOwningSide(meta, prop, inverse, metadata);
+            this.validateOwningSide(meta, prop);
         }
         else if (prop.mappedBy) {
-            const inverse = metadata.get(prop.type).properties[prop.mappedBy];
-            this.validateInverseSide(meta, prop, inverse, metadata);
+            this.validateInverseSide(meta, prop);
         }
-        else {
+        else if (prop.kind === ReferenceKind.ONE_TO_MANY && !prop.mappedBy) {
             // 1:m property has `mappedBy`
-            if (prop.kind === ReferenceKind.ONE_TO_MANY && !prop.mappedBy) {
-                throw MetadataError.fromMissingOption(meta, prop, 'mappedBy');
-            }
+            throw MetadataError.fromMissingOption(meta, prop, 'mappedBy');
         }
     }
-    validateOwningSide(meta, prop, inverse, metadata) {
+    validateOwningSide(meta, prop) {
+        // For polymorphic relations, inversedBy may point to multiple entity types
+        if (prop.polymorphic && prop.polymorphTargets?.length) {
+            // For polymorphic relations, validate inversedBy against each target
+            // The inverse property should exist on the target entities and reference back to this property
+            for (const targetMeta of prop.polymorphTargets) {
+                const inverse = targetMeta.properties[prop.inversedBy];
+                // The inverse property is optional - some targets may not have it
+                if (!inverse) {
+                    continue;
+                }
+                // Validate the inverse property
+                if (inverse.targetMeta?.root.class !== meta.root.class) {
+                    throw MetadataError.fromWrongReference(meta, prop, 'inversedBy', inverse);
+                }
+                // inverse side is not defined as owner
+                if (inverse.inversedBy || inverse.owner) {
+                    throw MetadataError.fromWrongOwnership(meta, prop, 'inversedBy');
+                }
+            }
+            return;
+        }
+        const inverse = prop.targetMeta.properties[prop.inversedBy];
         // has correct `inversedBy` on owning side
         if (!inverse) {
             throw MetadataError.fromWrongReference(meta, prop, 'inversedBy');
         }
-        const targetClassName = metadata.find(inverse.type)?.root.className;
+        const targetClass = inverse.targetMeta?.root.class;
         // has correct `inversedBy` reference type
-        if (inverse.type !== meta.className && targetClassName !== meta.root.className) {
+        if (inverse.type !== meta.className && targetClass !== meta.root.class) {
             throw MetadataError.fromWrongReference(meta, prop, 'inversedBy', inverse);
         }
         // inverse side is not defined as owner
@@ -143,13 +239,16 @@ export class MetadataValidator {
             throw MetadataError.fromWrongOwnership(meta, prop, 'inversedBy');
         }
     }
-    validateInverseSide(meta, prop, owner, metadata) {
+    validateInverseSide(meta, prop) {
+        const owner = prop.targetMeta.properties[prop.mappedBy];
         // has correct `mappedBy` on inverse side
         if (prop.mappedBy && !owner) {
             throw MetadataError.fromWrongReference(meta, prop, 'mappedBy');
         }
         // has correct `mappedBy` reference type
-        if (owner.type !== meta.className && metadata.find(owner.type)?.root.className !== meta.root.className) {
+        // For polymorphic relations, check if this entity is one of the polymorphic targets
+        const isValidPolymorphicInverse = owner.polymorphic && owner.polymorphTargets?.some(target => target.class === meta.root.class);
+        if (!isValidPolymorphicInverse && owner.type !== meta.className && owner.targetMeta?.root.class !== meta.root.class) {
             throw MetadataError.fromWrongReference(meta, prop, 'mappedBy', owner);
         }
         // owning side is not defined as inverse
@@ -192,7 +291,7 @@ export class MetadataValidator {
                     return [prop.embedded ? prop.embedded.join('.') : prop.name, prop.fieldNames[0]];
                 });
             });
-            throw MetadataError.duplicateFieldName(meta.className, pairs);
+            throw MetadataError.duplicateFieldName(meta.class, pairs);
         }
     }
     validateVersionField(meta) {
@@ -209,4 +308,60 @@ export class MetadataValidator {
             throw MetadataError.invalidVersionFieldType(meta);
         }
     }
+    /**
+     * Validates that entity properties do not use dangerous names that could lead to
+     * prototype pollution vulnerabilities. This validation ensures that property names
+     * cannot be exploited to modify object prototypes when values are assigned during
+     * entity hydration or persistence operations.
+     *
+     * @internal
+     */
+    validatePropertyNames(meta) {
+        for (const prop of Utils.values(meta.properties)) {
+            if (DANGEROUS_PROPERTY_NAMES.includes(prop.name)) {
+                throw MetadataError.dangerousPropertyName(meta, prop);
+            }
+        }
+    }
+    /**
+     * Validates view entity configuration.
+     * View entities must have an expression.
+     */
+    validateViewEntity(meta) {
+        // View entities must have an expression
+        if (!meta.expression) {
+            throw MetadataError.viewEntityWithoutExpression(meta);
+        }
+        // Validate indexes if present
+        this.validateIndexes(meta, meta.indexes ?? [], 'index');
+        this.validateIndexes(meta, meta.uniques ?? [], 'unique');
+        // Validate property names
+        this.validatePropertyNames(meta);
+    }
+    /**
+     * Validates that STI and TPT are not mixed in the same inheritance hierarchy.
+     * An entity hierarchy can use either STI (discriminatorColumn) or TPT (inheritance: 'tpt'),
+     * but not both.
+     *
+     * Note: This validation runs before `initTablePerTypeInheritance` sets `inheritanceType`,
+     * so we check the raw `inheritance` option from the decorator/schema.
+     */
+    validateInheritanceStrategies(discovered) {
+        const checkedRoots = new Set();
+        for (const meta of discovered) {
+            if (meta.embeddable) {
+                continue;
+            }
+            const root = meta.root;
+            if (checkedRoots.has(root)) {
+                continue;
+            }
+            checkedRoots.add(root);
+            const hasSTI = !!root.discriminatorColumn;
+            const hasTPT = root.inheritanceType === 'tpt' || root.inheritance === 'tpt';
+            if (hasSTI && hasTPT) {
+                throw MetadataError.mixedInheritanceStrategies(root, meta);
+            }
+        }
+    }
 }