@mikro-orm/core 7.2.0-dev.13 → 7.2.0-dev.15

package/metadata/MetadataDiscovery.js

@@ -165,6 +165,9 @@ export class MetadataDiscovery {
         filtered.forEach(meta => this.initAutoincrement(meta)); // once again after we init custom types
         filtered.forEach(meta => this.initCheckConstraints(meta));
         filtered.forEach(meta => this.initTriggers(meta));
+        // filter names are load-bearing for RLS (policy and session variable names), backfill from the dictionary key
+        filtered.forEach(meta => Object.entries(meta.filters).forEach(([key, filter]) => (filter.name ??= key)));
+        filtered.forEach(meta => this.initPolicies(meta));
         forEachProp((_m, p) => {
             this.initDefaultValue(p);
             this.inferTypeFromDefault(p);
@@ -441,7 +444,18 @@ export class MetadataDiscovery {
         if (prop.kind === ReferenceKind.SCALAR || prop.kind === ReferenceKind.EMBEDDED) {
             prop.fieldNames = [this.#namingStrategy.propertyToColumnName(prop.name, object)];
         }
-        else if ([ReferenceKind.MANY_TO_ONE, ReferenceKind.ONE_TO_ONE].includes(prop.kind) && !prop.polymorphic) {
+        else if ([ReferenceKind.MANY_TO_ONE, ReferenceKind.ONE_TO_ONE].includes(prop.kind) && prop.polymorphic) {
+            if (prop.targetMeta) {
+                // same layout as `initManyToOneFields` builds later: `[discriminatorColumn, ...fkIdColumns]`
+                const pkFields = prop.targetMeta.getPrimaryProps().flatMap(pk => {
+                    this.initFieldName(pk);
+                    return pk.fieldNames;
+                });
+                const idColumns = pkFields.map(fieldName => this.#namingStrategy.joinKeyColumnName(prop.discriminator, fieldName, pkFields.length > 1));
+                prop.fieldNames = [prop.discriminatorColumn, ...idColumns];
+            }
+        }
+        else if ([ReferenceKind.MANY_TO_ONE, ReferenceKind.ONE_TO_ONE].includes(prop.kind)) {
             prop.fieldNames = this.initManyToOneFieldName(prop, prop.name);
         }
         else if (prop.kind === ReferenceKind.MANY_TO_MANY && prop.owner) {
@@ -451,10 +465,13 @@ export class MetadataDiscovery {
     initManyToOneFieldName(prop, name) {
         const meta2 = prop.targetMeta;
         const ret = [];
-        for (const primaryKey of meta2.primaryKeys) {
-            this.initFieldName(meta2.properties[primaryKey]);
-            for (const fieldName of meta2.properties[primaryKey].fieldNames) {
-                ret.push(this.#namingStrategy.joinKeyColumnName(name, fieldName, meta2.compositePK));
+        // with `targetKey` on a composite PK target, derive the FK field name from that property
+        // instead of the PKs (simple PK targets keep the PK based naming for backwards compatibility)
+        const referencedKeys = prop.targetKey && meta2.compositePK ? [prop.targetKey] : meta2.primaryKeys;
+        for (const referencedKey of referencedKeys) {
+            this.initFieldName(meta2.properties[referencedKey]);
+            for (const fieldName of meta2.properties[referencedKey].fieldNames) {
+                ret.push(this.#namingStrategy.joinKeyColumnName(name, fieldName, !prop.targetKey && meta2.compositePK));
             }
         }
         return ret;
@@ -1055,11 +1072,18 @@ export class MetadataDiscovery {
         }
         // TPT children have their own tables that don't contain the parent's columns,
         // so propagating parent indexes/uniques/checks/triggers would target missing columns.
+        // deep equality, as the subclass items might be copies of the base class ones (e.g. with TC39 decorators)
         if (meta.inheritanceType !== 'tpt' || !meta.tptParent) {
-            meta.indexes = Utils.unique([...base.indexes, ...meta.indexes]);
-            meta.uniques = Utils.unique([...base.uniques, ...meta.uniques]);
-            meta.checks = Utils.unique([...base.checks, ...meta.checks]);
-            meta.triggers = Utils.unique([...base.triggers, ...meta.triggers]);
+            meta.indexes = Utils.unique([...base.indexes, ...meta.indexes], Utils.equals);
+            meta.uniques = Utils.unique([...base.uniques, ...meta.uniques], Utils.equals);
+            meta.checks = Utils.unique([...base.checks, ...meta.checks], Utils.equals);
+            meta.triggers = Utils.unique([...base.triggers, ...meta.triggers], Utils.equals);
+        }
+        // Policies pass down only from inlined abstract bases; STI children share the root table
+        // and TPT children own their tables, so both declare policies directly on the root/child.
+        if (base.abstract && base.inheritanceType !== 'sti' && (meta.inheritanceType !== 'tpt' || !meta.tptParent)) {
+            meta.policies = Utils.unique([...base.policies, ...meta.policies]);
+            meta.rowLevelSecurity ??= base.rowLevelSecurity;
         }
         const pks = Object.values(meta.properties)
             .filter(p => p.primary)
@@ -1247,8 +1271,17 @@ export class MetadataDiscovery {
             if (embeddedProp.nullable || refInArray) {
                 meta.properties[name].nullable = true;
             }
+            // polymorphic relations derive their column names from the discriminator, so prefix it too
+            if (meta.properties[name].polymorphic && !object) {
+                meta.properties[name].discriminator = prefix + meta.properties[name].discriminator;
+                meta.properties[name].discriminatorColumn = prefix + meta.properties[name].discriminatorColumn;
+            }
             if (meta.properties[name].fieldNames) {
-                meta.properties[name].fieldNames[0] = prefix + meta.properties[name].fieldNames[0];
+                const { fieldNames, polymorphic } = meta.properties[name];
+                // polymorphic `fieldNames` hold `[discriminatorColumn, ...fkIdColumns]`, so prefix all of them
+                for (let i = 0; i < (polymorphic ? fieldNames.length : 1); i++) {
+                    fieldNames[i] = prefix + fieldNames[i];
+                }
             }
             else {
                 const name2 = meta.properties[name].name;
@@ -1677,6 +1710,9 @@ export class MetadataDiscovery {
                 if (prop.persist === false || prop.nativeEnumName || !prop.items?.every(item => typeof item === 'string')) {
                     continue;
                 }
+                if (prop.customType instanceof t.json || ['json', 'jsonb'].includes(prop.columnTypes?.[0])) {
+                    continue;
+                }
                 this.initFieldName(prop);
                 let expression = null;
                 if (prop.enum) {
@@ -1716,6 +1752,28 @@ export class MetadataDiscovery {
         }
         meta.hasTriggers = true;
     }
+    initPolicies(meta) {
+        if (meta.policies.length === 0) {
+            return;
+        }
+        const columns = meta.createSchemaColumnMappingObject();
+        const table = this.createSchemaTable(meta);
+        // resolve callbacks into a copy — the defs can be shared with siblings via an inlined abstract base,
+        // and resolving in place would bake the first child's table into every other child's policy
+        meta.policies = meta.policies.map(policy => {
+            if (!(policy.using instanceof Function) && !(policy.check instanceof Function)) {
+                return policy;
+            }
+            const resolved = { ...policy };
+            if (resolved.using instanceof Function) {
+                resolved.using = resolved.using(columns, table);
+            }
+            if (resolved.check instanceof Function) {
+                resolved.check = resolved.check(columns, table);
+            }
+            return resolved;
+        });
+    }
     initGeneratedColumn(meta, prop) {
         if (!prop.generated && prop.columnTypes) {
             const match = /(.*) generated always as (.*)/i.exec(prop.columnTypes[0]);
@@ -2080,6 +2138,7 @@ export class MetadataDiscovery {
             prop.columnTypes.push(...columnTypes);
             if (!targetMeta.compositePK || prop.targetKey) {
                 prop.customType = referencedProp.customType;
+                prop.collation ??= referencedProp.collation;
             }
         }
     }
@@ -2135,7 +2194,7 @@ export class MetadataDiscovery {
     shouldForceConstructorUsage(meta) {
         const forceConstructor = this.#config.get('forceEntityConstructor');
         if (Array.isArray(forceConstructor)) {
-            return forceConstructor.some(cls => Utils.className(cls) === meta.className);
+            return forceConstructor.some(cls => Utils.matchesEntity(cls, meta));
         }
         return forceConstructor;
     }

package/metadata/MetadataStorage.js

@@ -17,6 +17,7 @@ export class MetadataStorage {
     #idMap;
     #classNameMap;
     #uniqueNameMap;
+    #ambiguousNames = new Set();
     constructor(metadata = {}) {
         this.#idMap = {};
         this.#uniqueNameMap = {};
@@ -64,6 +65,10 @@ export class MetadataStorage {
     }
     /** Returns metadata for the given entity, optionally initializing it if not found. */
     get(entityName, init = false) {
+        // string lookups cannot be resolved when several classes were minified to the same name
+        if (typeof entityName === 'string' && this.#ambiguousNames.has(entityName)) {
+            throw MetadataError.ambiguousEntityName(entityName);
+        }
         const exists = this.find(entityName);
         if (exists) {
             return exists;
@@ -99,7 +104,13 @@ export class MetadataStorage {
         this.#metadataMap.set(entityName, meta);
         this.#idMap[meta._id] = meta;
         this.#uniqueNameMap[meta.uniqueName] = meta;
-        this.#classNameMap[Utils.className(entityName)] = meta;
+        const className = Utils.className(entityName);
+        const existing = this.#classNameMap[className];
+        // track name collisions caused by minifiers mangling two classes to the same name
+        if (existing && existing !== meta && existing.class !== meta.class) {
+            this.#ambiguousNames.add(className);
+        }
+        this.#classNameMap[className] = meta;
         return meta;
     }
     /** Removes metadata for the given entity from all internal maps. */
@@ -110,6 +121,11 @@ export class MetadataStorage {
             delete this.#idMap[meta._id];
             delete this.#uniqueNameMap[meta.uniqueName];
             delete this.#classNameMap[meta.className];
+            // the name may still be ambiguous among the remaining metas
+            const remaining = new Set([...this.#metadataMap.values()].filter(m => m.className === meta.className).map(m => m.class));
+            if (remaining.size <= 1) {
+                this.#ambiguousNames.delete(meta.className);
+            }
         }
     }
     /** Decorates all entity prototypes with helper methods (e.g. init, toJSON). */

package/metadata/types.d.ts

@@ -1,4 +1,4 @@
-import type { AnyEntity, Constructor, EntityName, AnyString, CheckCallback, GeneratedColumnCallback, FormulaCallback, FilterQuery, Dictionary, AutoPath, EntityClass, IndexCallback, ObjectQuery, Raw, SchemaColumns, TriggerDef } from '../typings.js';
+import type { AnyEntity, Constructor, EntityName, AnyString, CheckCallback, GeneratedColumnCallback, FormulaCallback, FilterQuery, Dictionary, AutoPath, EntityClass, IndexCallback, ObjectQuery, Raw, SchemaColumns, TriggerDef, PolicyDef } from '../typings.js';
 import type { Cascade, LoadStrategy, DeferMode, QueryOrderMap, EmbeddedPrefixMode } from '../enums.js';
 import type { Type, types } from '../types/index.js';
 import type { EntityManager } from '../EntityManager.js';
@@ -104,6 +104,10 @@ export type EntityOptions<T, E = T extends EntityClass<infer P> ? P : T> = {
     hasTriggers?: boolean;
     /** Database triggers to create for this entity's table. (SQL drivers only) */
     triggers?: TriggerDef<E>[];
+    /** PostgreSQL row level security policies for this entity's table. Declaring policies implicitly enables RLS. */
+    policies?: PolicyDef<E>[];
+    /** Enables PostgreSQL row level security on this entity's table. `'force'` also enforces it for the table owner. Set to `false` to keep declared policies staged while leaving RLS disabled. */
+    rowLevelSecurity?: boolean | 'force';
     /**
      * PostgreSQL partitioning definition for this table.
      *

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@mikro-orm/core",
-  "version": "7.2.0-dev.13",
+  "version": "7.2.0-dev.15",
   "description": "TypeScript ORM for Node.js based on Data Mapper, Unit of Work and Identity Map patterns. Supports MongoDB, MySQL, PostgreSQL and SQLite databases as well as usage with vanilla JavaScript.",
   "keywords": [
     "data-mapper",

package/platforms/Platform.d.ts

@@ -211,8 +211,9 @@ export declare abstract class Platform {
     getBlobDeclarationSQL(): string;
     getJsonDeclarationSQL(): string;
     getSearchJsonPropertySQL(path: string, type: string, aliased: boolean): string | Raw;
-    getSearchJsonPropertyKey(path: string[], type: string, aliased: boolean, value?: unknown): string | Raw;
-    processJsonCondition<T extends object>(o: FilterQuery<T>, value: EntityValue<T>, path: EntityKey<T>[], alias: boolean): FilterQuery<T>;
+    /** When `aliased` is a string, it holds an explicit alias the key was prefixed with. */
+    getSearchJsonPropertyKey(path: string[], type: string, aliased: boolean | string, value?: unknown): string | Raw;
+    processJsonCondition<T extends object>(o: FilterQuery<T>, value: EntityValue<T>, path: EntityKey<T>[], alias: boolean | string): FilterQuery<T>;
     protected getJsonValueType(value: unknown): string;
     getJsonIndexDefinition(index: {
         columnNames: string[];
@@ -315,6 +316,15 @@ export declare abstract class Platform {
     supportsDownMigrations(): boolean;
     /** Whether the platform supports deferred unique constraints. */
     supportsDeferredUniqueConstraints(): boolean;
+    /** Whether the platform supports row level security (PostgreSQL). */
+    supportsRowLevelSecurity(): boolean;
+    /** Whether the driver can apply the session context on every pooled connection acquire (`sessionContext: 'connection'`). */
+    supportsConnectionSessionContext(): boolean;
+    /**
+     * SQL cast suffix (e.g. `'::uuid'`, or `''` when none is needed) applied when an RLS filter reads a session
+     * variable via `current_setting()` as the given column type, or `null` if the type has no automatic cast.
+     */
+    getCurrentSettingCast(mappedType: Type<unknown>): string | null;
     /** Platform-specific validation of entity metadata. */
     validateMetadata(meta: EntityMetadata): void;
     /**

package/platforms/Platform.js

@@ -413,6 +413,7 @@ export class Platform {
     getSearchJsonPropertySQL(path, type, aliased) {
         return path;
     }
+    /** When `aliased` is a string, it holds an explicit alias the key was prefixed with. */
     getSearchJsonPropertyKey(path, type, aliased, value) {
         return path.join('.');
     }
@@ -424,7 +425,8 @@ export class Platform {
             return o;
         }
         if (path.length === 1) {
-            o[path[0]] = value;
+            const key = typeof alias === 'string' ? `${alias}.${path[0]}` : path[0];
+            o[key] = value;
             return o;
         }
         const type = this.getJsonValueType(value);
@@ -720,11 +722,51 @@ export class Platform {
     supportsDeferredUniqueConstraints() {
         return true;
     }
+    /** Whether the platform supports row level security (PostgreSQL). */
+    supportsRowLevelSecurity() {
+        return false;
+    }
+    /** Whether the driver can apply the session context on every pooled connection acquire (`sessionContext: 'connection'`). */
+    supportsConnectionSessionContext() {
+        return false;
+    }
+    /**
+     * SQL cast suffix (e.g. `'::uuid'`, or `''` when none is needed) applied when an RLS filter reads a session
+     * variable via `current_setting()` as the given column type, or `null` if the type has no automatic cast.
+     */
+    getCurrentSettingCast(mappedType) {
+        return null;
+    }
     /** Platform-specific validation of entity metadata. */
     validateMetadata(meta) {
         if (meta.partitionBy && !this.supportsPartitionedTables()) {
             throw new MetadataError(`Entity ${meta.className} uses partitionBy, but ${this.constructor.name} does not support partitioned tables`);
         }
+        const declaresRls = meta.policies.length > 0 || !!meta.rowLevelSecurity;
+        if (declaresRls && !this.supportsRowLevelSecurity()) {
+            throw MetadataError.rowLevelSecurityNotSupportedByDriver(meta);
+        }
+        // STI hierarchies share a single table, so only the root may declare policies; `root` is optional-chained
+        // as `validateMetadata` is public API and tolerates partially populated metadata
+        if (declaresRls && meta.root?.inheritanceType === 'sti' && meta.root !== meta) {
+            throw MetadataError.rowLevelSecurityOnNonRootStiEntity(meta);
+        }
+        if (meta.root?.inheritanceType === 'sti' && meta.root !== meta) {
+            for (const filter of Object.values(meta.filters)) {
+                // inherited root filters share the def object; only defs declared on the child itself are a problem,
+                // as non-root STI metas never reach the schema generator and the policy would silently not exist
+                if (filter.rls && meta.root.filters[filter.name] !== filter) {
+                    throw MetadataError.rlsFilterOnNonRootStiEntity(meta, filter.name);
+                }
+            }
+        }
+        if (!this.supportsRowLevelSecurity()) {
+            for (const filter of Object.values(meta.filters)) {
+                if (filter.rls) {
+                    throw MetadataError.rlsFilterNotSupportedByDriver(meta, filter.name);
+                }
+            }
+        }
     }
     /**
      * Generates a custom order by statement given a set of in order values, eg.

package/types/Type.js

@@ -55,11 +55,11 @@ export class Type {
         return prop.columnTypes?.[0] ?? platform.getTextTypeDeclarationSQL(prop);
     }
     static getType(cls) {
-        const key = cls.name;
-        if (!Type.types.has(key)) {
-            Type.types.set(key, new cls());
+        // keyed by class reference, as minifiers can mangle two classes to the same name
+        if (!Type.types.has(cls)) {
+            Type.types.set(cls, new cls());
         }
-        return Type.types.get(key);
+        return Type.types.get(cls);
     }
     /**
      * Checks whether the argument is instance of `Type`.

package/typings.d.ts

@@ -478,12 +478,12 @@ type NonArrayObject = object & {
 export type EntityDataProp<T, C extends boolean> = T extends Date ? string | Date : T extends Scalar ? T : T extends ScalarReference<infer U> ? EntityDataProp<U, C> : T extends {
     __runtime?: infer Runtime;
     __raw?: infer Raw;
-} ? C extends true ? Raw : Runtime : T extends LazyRef.Brand<infer U> ? EntityDataNested<U, C> : T extends ReferenceShape<infer U> ? EntityDataNested<U, C> : T extends CollectionShape<infer U> ? U | U[] | EntityDataNested<U & object, C> | EntityDataNested<U & object, C>[] : T extends readonly (infer U)[] ? U extends NonArrayObject ? U | U[] | EntityDataNested<U, C> | EntityDataNested<U, C>[] : U[] | EntityDataNested<U, C>[] : EntityDataNested<T, C>;
+} ? C extends true ? Raw : Runtime : T extends LazyRef.Brand<infer U> ? EntityDataNested<U, C> : T extends ReferenceShape<infer U> ? EntityDataNested<U, C> : T extends CollectionShape<infer U> ? U | U[] | EntityDataNested<U & object, C> | EntityDataNested<U & object, C>[] : T extends readonly (infer U)[] ? [U] extends [NonArrayObject] ? U | U[] | EntityDataNested<U, C> | EntityDataNested<U, C>[] : U[] | EntityDataNested<U, C>[] : EntityDataNested<T, C>;
 /** Like `EntityDataProp` but used in `RequiredEntityData` context with required/optional key distinction. */
 export type RequiredEntityDataProp<T, O, C extends boolean> = T extends Date ? string | Date : Exclude<T, null> extends RequiredNullable.Brand ? T | null : T extends Scalar ? T : T extends ScalarReference<infer U> ? RequiredEntityDataProp<U, O, C> : T extends {
     __runtime?: infer Runtime;
     __raw?: infer Raw;
-} ? C extends true ? Raw : Runtime : T extends LazyRef.Brand<infer U> ? RequiredEntityDataNested<U, O, C> : T extends ReferenceShape<infer U> ? RequiredEntityDataNested<U, O, C> : T extends CollectionShape<infer U> ? U | U[] | RequiredEntityDataNested<U & object, O, C> | RequiredEntityDataNested<U & object, O, C>[] : T extends readonly (infer U)[] ? U extends NonArrayObject ? U | U[] | RequiredEntityDataNested<U, O, C> | RequiredEntityDataNested<U, O, C>[] : U[] | RequiredEntityDataNested<U, O, C>[] : RequiredEntityDataNested<T, O, C>;
+} ? C extends true ? Raw : Runtime : T extends LazyRef.Brand<infer U> ? RequiredEntityDataNested<U, O, C> : T extends ReferenceShape<infer U> ? RequiredEntityDataNested<U, O, C> : T extends CollectionShape<infer U> ? U | U[] | RequiredEntityDataNested<U & object, O, C> | RequiredEntityDataNested<U & object, O, C>[] : T extends readonly (infer U)[] ? [U] extends [NonArrayObject] ? U | U[] | RequiredEntityDataNested<U, O, C> | RequiredEntityDataNested<U, O, C>[] : U[] | RequiredEntityDataNested<U, O, C>[] : RequiredEntityDataNested<T, O, C>;
 /** Nested entity data shape for embedded or related entities within `EntityData`. */
 export type EntityDataNested<T, C extends boolean = false> = T extends undefined ? never : T extends any[] ? Readonly<T> : EntityData<T, C> | ExpandEntityProp<T, C>;
 type UnwrapScalarRef<T> = T extends ScalarReference<infer U> ? U : T;
@@ -710,6 +710,8 @@ export type IndexCallback<T> = (columns: Record<PropertyName<T>, string>, table:
 export type FormulaCallback<T> = (columns: FormulaColumns<T>, table: FormulaTable) => string | Raw;
 /** Callback for CHECK constraint expressions. Receives column mappings and table info. */
 export type CheckCallback<T> = (columns: SchemaColumns<T>, table: SchemaTable) => string | Raw;
+/** Callback for row level security policy expressions. Receives column mappings and table info. */
+export type PolicyCallback<T> = (columns: SchemaColumns<T>, table: SchemaTable) => string | Raw;
 /** Callback for trigger body expressions. Receives column mappings and table info. */
 export type TriggerCallback<T> = (columns: Record<PropertyName<T>, string>, table: SchemaTable) => string | Raw;
 /**
@@ -724,6 +726,28 @@ export interface CheckConstraint<T = any> {
     property?: string;
     expression: string | Raw | CheckCallback<T>;
 }
+/** Definition of a PostgreSQL row level security policy on a table. */
+export interface PolicyDef<T = any> {
+    /** Policy name. Auto-generated if omitted. */
+    name?: string;
+    /** DML command the policy applies to. Defaults to `'all'`. */
+    command?: 'select' | 'insert' | 'update' | 'delete' | 'all';
+    /** Whether the policy is permissive (OR-combined) or restrictive (AND-combined). Defaults to `'permissive'`. */
+    type?: 'permissive' | 'restrictive';
+    /** Database roles the policy applies to. Defaults to `PUBLIC`. */
+    roles?: string[];
+    /** `USING` expression filtering visible rows. Can be a string, Raw query, or callback receiving column name mappings. */
+    using?: string | Raw | PolicyCallback<T>;
+    /** `WITH CHECK` expression validating written rows. Can be a string, Raw query, or callback receiving column name mappings. */
+    check?: string | Raw | PolicyCallback<T>;
+}
+/** Per-context database session state applied for row level security (session variables and role). */
+export interface SessionContext {
+    /** Session variables set via `set_config`, typically referenced by RLS policies through `current_setting()`. `Date` values are serialized to ISO 8601. */
+    variables?: Dictionary<string | number | boolean | Date>;
+    /** Database role to switch to for the duration of the context (`set local role` / `set role`). */
+    role?: string;
+}
 /** Definition of a database trigger on a table. */
 export interface TriggerDef<T = any> {
     /** Trigger name. Auto-generated if omitted. */
@@ -1050,6 +1074,12 @@ export declare class EntityMetadata<Entity = any, Class extends EntityCtor<Entit
     constructor(meta?: Partial<EntityMetadata>);
     addProperty(prop: Partial<EntityProperty<Entity>>): void;
     removeProperty(name: string, sync?: boolean): void;
+    /** For TPT entities, the version column exists only on the table of the entity that declares it. */
+    ownsVersionProperty(): boolean;
+    /** For TPT entities, concurrency check columns exist only on the table of the entity that declares them. */
+    getOwnConcurrencyCheckKeys(): EntityKey<Entity>[];
+    /** Whether updates of this table are guarded by a version property or concurrency check columns it owns. */
+    hasOptimisticLock(): boolean;
     getPrimaryProps(flatten?: boolean): EntityProperty<Entity>[];
     getPrimaryProp(): EntityProperty<Entity>;
     /**
@@ -1165,6 +1195,9 @@ export interface EntityMetadata<Entity = any, Class extends EntityCtor<Entity> =
     }[];
     checks: CheckConstraint<Entity>[];
     triggers: TriggerDef<Entity>[];
+    policies: PolicyDef<Entity>[];
+    /** Enables row level security on the table. `'force'` also enables it for the table owner. Implied by non-empty `policies`, unless set to `false`, which keeps the policies staged but RLS disabled. */
+    rowLevelSecurity?: boolean | 'force';
     repositoryClass?: string;
     repository: () => EntityClass<EntityRepository<any>>;
     hooks: {
@@ -1492,6 +1525,15 @@ type FilterDefResolved<T extends object = any> = {
     entity?: EntityName<T> | EntityName<T>[];
     args?: boolean;
     strict?: boolean;
+    /**
+     * Also materializes this filter as a PostgreSQL row level security policy on the entity's table, and stages the
+     * matching session variables when its params are enabled via `em.setFilterParams()`. The `cond` must be compilable
+     * to a static expression (no access to `em`/`type`/`options`, not async). Each referenced argument maps to a session
+     * variable named `mikro.<filterName>.<argName>`; pass `{ setting }` to override that name for a single-argument filter.
+     */
+    rls?: boolean | {
+        setting?: string;
+    };
 };
 /** Definition of a query filter that can be registered globally or per-entity via `@Filter()`. */
 export type FilterDef<T extends EntityName | readonly EntityName[] = any> = FilterDefResolved<EntityFromInput<T>> & {

package/typings.js

@@ -49,6 +49,7 @@ export class EntityMetadata {
         this.uniques = [];
         this.checks = [];
         this.triggers = [];
+        this.policies = [];
         this.referencingProperties = [];
         this.concurrencyCheckKeys = new Set();
         Object.assign(this, meta);
@@ -79,6 +80,25 @@ export class EntityMetadata {
             this.sync();
         }
     }
+    /** For TPT entities, the version column exists only on the table of the entity that declares it. */
+    ownsVersionProperty() {
+        if (!this.versionProperty) {
+            return false;
+        }
+        return this.inheritanceType !== 'tpt' || !this.ownProps || this.ownProps.some(p => p.name === this.versionProperty);
+    }
+    /** For TPT entities, concurrency check columns exist only on the table of the entity that declares them. */
+    getOwnConcurrencyCheckKeys() {
+        const keys = [...this.concurrencyCheckKeys];
+        if (this.inheritanceType !== 'tpt' || !this.ownProps) {
+            return keys;
+        }
+        return keys.filter(key => this.ownProps.some(p => p.name === key));
+    }
+    /** Whether updates of this table are guarded by a version property or concurrency check columns it owns. */
+    hasOptimisticLock() {
+        return this.ownsVersionProperty() || this.getOwnConcurrencyCheckKeys().length > 0;
+    }
     getPrimaryProps(flatten = false) {
         const pks = this.primaryKeys.map(pk => this.properties[pk]);
         if (flatten) {
@@ -216,7 +236,10 @@ export class EntityMetadata {
         if (config) {
             const platform = config.getPlatform();
             for (const prop of this.props) {
-                if (prop.enum && !prop.nativeEnumName && prop.items?.every(item => typeof item === 'string')) {
+                if (prop.enum &&
+                    !prop.nativeEnumName &&
+                    prop.items?.every(item => typeof item === 'string') &&
+                    !['json', 'jsonb'].includes(prop.columnTypes?.[0])) {
                     const name = platform.getIndexName(this.tableName, prop.fieldNames, 'check');
                     const exists = this.checks.findIndex(check => check.name === name);
                     if (exists !== -1) {

package/unit-of-work/ChangeSetPersister.js

@@ -204,13 +204,14 @@ export class ChangeSetPersister {
     }
     checkConcurrencyKeys(meta, changeSet, cond) {
         const tmp = [];
-        for (const key of meta.concurrencyCheckKeys) {
+        const keys = meta.getOwnConcurrencyCheckKeys();
+        for (const key of keys) {
             cond[key] = changeSet.originalEntity[key];
             if (changeSet.payload[key]) {
                 tmp.push(key);
             }
         }
-        if (tmp.length === 0 && meta.concurrencyCheckKeys.size > 0) {
+        if (tmp.length === 0 && keys.length > 0) {
             throw OptimisticLockError.lockFailed(changeSet.entity);
         }
     }
@@ -303,32 +304,33 @@ export class ChangeSetPersister {
         options = this.prepareOptions(meta, options, {
             convertCustomTypes: false,
         });
-        if (meta.concurrencyCheckKeys.size === 0 &&
-            (!meta.versionProperty || changeSet.entity[meta.versionProperty] == null)) {
+        if (meta.getOwnConcurrencyCheckKeys().length === 0 &&
+            (!meta.ownsVersionProperty() || changeSet.entity[meta.versionProperty] == null)) {
             return this.#driver.nativeUpdate(changeSet.meta.class, cond, changeSet.payload, options);
         }
-        if (meta.versionProperty) {
+        if (meta.ownsVersionProperty()) {
             cond[meta.versionProperty] = this.#platform.convertVersionValue(changeSet.entity[meta.versionProperty], meta.properties[meta.versionProperty]);
         }
         this.checkConcurrencyKeys(meta, changeSet, cond);
         return this.#driver.nativeUpdate(changeSet.meta.class, cond, changeSet.payload, options);
     }
     async checkOptimisticLocks(meta, changeSets, options) {
-        if (meta.concurrencyCheckKeys.size === 0 &&
-            (!meta.versionProperty || changeSets.every(cs => cs.entity[meta.versionProperty] == null))) {
+        const concurrencyCheckKeys = meta.getOwnConcurrencyCheckKeys();
+        if (concurrencyCheckKeys.length === 0 &&
+            (!meta.ownsVersionProperty() || changeSets.every(cs => cs.entity[meta.versionProperty] == null))) {
             return;
         }
         // skip entity references as they don't have version values loaded
         changeSets = changeSets.filter(cs => helper(cs.entity).__initialized);
+        const primaryKeys = meta.primaryKeys.concat(...concurrencyCheckKeys);
         const $or = changeSets.map(cs => {
-            const cond = Utils.getPrimaryKeyCond(cs.originalEntity, meta.primaryKeys.concat(...meta.concurrencyCheckKeys));
-            if (meta.versionProperty) {
+            const cond = Utils.getPrimaryKeyCond(cs.originalEntity, primaryKeys);
+            if (meta.ownsVersionProperty()) {
                 // @ts-ignore
                 cond[meta.versionProperty] = this.#platform.convertVersionValue(cs.entity[meta.versionProperty], meta.properties[meta.versionProperty]);
             }
             return cond;
         });
-        const primaryKeys = meta.primaryKeys.concat(...meta.concurrencyCheckKeys);
         options = this.prepareOptions(meta, options, {
             fields: primaryKeys,
             orderBy: meta.primaryKeys.reduce((o, pk) => {
@@ -336,7 +338,9 @@ export class ChangeSetPersister {
                 return o;
             }, {}),
         });
-        const res = await this.#driver.find(meta.root.class, { $or }, options);
+        // TPT tables query their own metadata, as the version column might not live on the root table
+        const target = meta.inheritanceType === 'tpt' ? meta : meta.root;
+        const res = await this.#driver.find(target.class, { $or }, options);
         if (res.length !== changeSets.length) {
             // a FK pointing to a composite PK is an array, so the values need to be compared deeply
             const compare = (a, b, keys) => keys.every(k => equals(a[k], b[k]));
@@ -347,7 +351,7 @@ export class ChangeSetPersister {
         }
     }
     checkOptimisticLock(meta, changeSet, res) {
-        if ((meta.versionProperty || meta.concurrencyCheckKeys.size > 0) && res && !res.affectedRows) {
+        if ((meta.ownsVersionProperty() || meta.getOwnConcurrencyCheckKeys().length > 0) && res && !res.affectedRows) {
             throw OptimisticLockError.lockFailed(changeSet.entity);
         }
     }
@@ -356,7 +360,7 @@ export class ChangeSetPersister {
      * so we use a single query in case of both versioning and default values is used.
      */
     async reloadVersionValues(meta, changeSets, options) {
-        const reloadProps = meta.versionProperty && !this.#usesReturningStatement ? [meta.properties[meta.versionProperty]] : [];
+        const reloadProps = meta.ownsVersionProperty() && !this.#usesReturningStatement ? [meta.properties[meta.versionProperty]] : [];
         if (changeSets[0].type === ChangeSetType.CREATE) {
             for (const prop of meta.props) {
                 if (prop.persist === false) {

package/unit-of-work/UnitOfWork.js

@@ -124,7 +124,6 @@ export class UnitOfWork {
         if (options?.newEntity) {
             return entity;
         }
-        const forceUndefined = this.#em.config.get('forceUndefined');
         const wrapped = helper(entity);
         if (options?.loaded && wrapped.__initialized && !wrapped.__onLoadFired) {
             this.#loadedEntities.add(entity);
@@ -332,6 +331,7 @@ export class UnitOfWork {
                     let parentCs = changeSet.tptChangeSets.find(pc => pc.meta === current);
                     if (!parentCs) {
                         parentCs = new ChangeSet(entity, changeSet.type, {}, current);
+                        parentCs.originalEntity = changeSet.originalEntity;
                         changeSet.tptChangeSets.splice(idx, 0, parentCs);
                     }
                     idx++;
@@ -472,6 +472,7 @@ export class UnitOfWork {
                 const loggerContext = Utils.merge({ id: this.#em._id }, this.#em.getLoggerContext({ disableContextResolution: true }));
                 await this.#em.getConnection('write').transactional(trx => this.persistToDatabase(groups, trx), {
                     ctx: oldTx,
+                    sessionContext: this.#em.getTransactionSessionContext(),
                     eventBroadcaster: new TransactionEventBroadcaster(this.#em),
                     loggerContext,
                 });
@@ -527,6 +528,10 @@ export class UnitOfWork {
                     if (prop.formula) {
                         delete referrer[prop.name];
                     }
+                    else if (prop.primary) {
+                        // the referrer's primary key contains the removed entity, so its identity cannot survive the removal
+                        this.unsetIdentity(referrer);
+                    }
                     else {
                         delete helper(referrer).__data[prop.name];
                     }
@@ -702,13 +707,14 @@ export class UnitOfWork {
                     payload[pk] = identifiers[i] ?? originalChangeSet.payload[pk];
                 }
             }
-            if (!isCreate && Object.keys(payload).length === 0) {
+            // the table declaring the version property or a concurrency check still needs its bump and lock check
+            if (!isCreate && Object.keys(payload).length === 0 && !current.hasOptimisticLock()) {
                 current = current.tptParent;
                 continue;
             }
             const cs = new ChangeSet(entity, originalChangeSet.type, payload, current);
+            cs.originalEntity = originalChangeSet.originalEntity;
             if (current === meta) {
-                cs.originalEntity = originalChangeSet.originalEntity;
                 leafCs = cs;
             }
             else {
@@ -1205,7 +1211,8 @@ export class UnitOfWork {
         const addToGroup = (cs) => {
             // Skip stub TPT changesets with empty payload (e.g. leaf with no own-property changes on UPDATE)
             if ((cs.type === ChangeSetType.UPDATE || cs.type === ChangeSetType.UPDATE_EARLY) &&
-                !Utils.hasObjectKeys(cs.payload)) {
+                !Utils.hasObjectKeys(cs.payload) &&
+                !cs.meta.hasOptimisticLock()) {
                 return;
             }
             const group = groups[cs.type];