@mikro-orm/core 7.2.0-dev.14 → 7.2.0-dev.16

package/utils/Configuration.d.ts

@@ -439,7 +439,7 @@ export interface Options<Driver extends IDatabaseDriver = IDatabaseDriver, EM ex
      */
     filters: Dictionary<{
         name?: string;
-    } & Omit<FilterDef, 'name'>>;
+    } & Omit<FilterDef, 'name' | 'rls'>>;
     /**
      * Metadata discovery configuration options.
      * Controls how entities are discovered and validated.
@@ -480,6 +480,12 @@ export interface Options<Driver extends IDatabaseDriver = IDatabaseDriver, EM ex
      * @default false
      */
     disableTransactions?: boolean;
+    /**
+     * How `em.setSessionContext()` session variables/role are applied for row level security.
+     * `'transaction'` (default) emits `set_config(..., true)` inside each transaction; `'connection'` applies them on every pooled connection acquire (PostgreSQL only).
+     * @default 'transaction'
+     */
+    sessionContext?: 'transaction' | 'connection';
     /**
      * Enable verbose logging of internal operations.
      * @default false
@@ -840,6 +846,14 @@ export interface Options<Driver extends IDatabaseDriver = IDatabaseDriver, EM ex
          * @default false
          */
         ignoreRoutines?: boolean;
+        /**
+         * Leave row level security policies unmanaged. Declared policies are still created and RLS is still enabled or
+         * forced based on the entity metadata, but existing policies are never dropped or altered and RLS is never
+         * disabled or unforced — use this to protect hand-written policies from being removed when they are not
+         * mirrored in the entity definitions.
+         * @default false
+         */
+        ignorePolicies?: boolean;
         /**
          * Table names or patterns to skip during schema generation.
          * @default []

package/utils/Configuration.js

@@ -7,7 +7,7 @@ import { Utils } from '../utils/Utils.js';
 import { Routine } from '../metadata/Routine.js';
 import { MetadataValidator } from '../metadata/MetadataValidator.js';
 import { MetadataProvider } from '../metadata/MetadataProvider.js';
-import { NotFoundError } from '../errors.js';
+import { MetadataError, NotFoundError, ValidationError } from '../errors.js';
 import { RequestContext } from './RequestContext.js';
 import { DataloaderType, FlushMode, LoadStrategy, PopulateHint } from '../enums.js';
 import { MemoryCacheAdapter } from '../cache/MemoryCacheAdapter.js';
@@ -71,6 +71,7 @@ const DEFAULTS = {
     ensureDatabase: true,
     ensureIndexes: false,
     batchSize: 300,
+    sessionContext: 'transaction',
     debug: false,
     ignoreDeprecations: false,
     verbose: false,
@@ -94,6 +95,7 @@ const DEFAULTS = {
         ignoreSchema: [],
         ignoreTriggers: false,
         ignoreRoutines: false,
+        ignorePolicies: false,
         skipTables: [],
         skipViews: [],
         skipColumns: {},
@@ -393,7 +395,15 @@ export class Configuration {
         }
         this.#options.schema ??= this.#platform.getDefaultSchemaName();
         this.#options.charset ??= this.#platform.getDefaultCharset();
+        // fail closed instead of silently applying no session state on drivers without the reserve hook (e.g. pglite)
+        if (this.#options.sessionContext === 'connection' && !this.#platform.supportsConnectionSessionContext()) {
+            throw ValidationError.connectionSessionContextNotSupported();
+        }
         Object.keys(this.#options.filters).forEach(key => {
+            // global filters have no entity to attach a policy to, so `rls` is only valid on entity-scoped filters
+            if (this.#options.filters[key].rls) {
+                throw MetadataError.rlsFilterMustBeEntityScoped(key);
+            }
             this.#options.filters[key].default ??= true;
         });
         if (!this.#options.filtersOnRelations) {

package/utils/QueryHelper.d.ts

@@ -37,6 +37,18 @@ export declare class QueryHelper {
     static inlinePrimaryKeyObjects<T extends object>(where: Dictionary, meta: EntityMetadata<T>, metadata: MetadataStorage, key?: string): boolean;
     static processWhere<T extends object>(options: ProcessWhereOptions<T>): FilterQuery<T>;
     static getActiveFilters<T>(meta: EntityMetadata<T>, options: FilterOptions | undefined, filters: Dictionary<FilterDef>): FilterDef[];
+    /** @internal Sentinel wrapping for arguments accessed while statically resolving an `rls` filter condition. */
+    static readonly RLS_SENTINEL_PREFIX = "__mikro_rls_arg__";
+    /** @internal */
+    static readonly RLS_SENTINEL_SUFFIX = "__";
+    /**
+     * Resolves an `rls` filter's condition to a static `FilterQuery`. Function conditions are called with a proxy `args`
+     * that yields a unique sentinel per accessed argument, real `type`/`entityName` strings (validated to not affect the
+     * result), and a poison proxy or `undefined` for the remaining runtime-only parameters.
+     *
+     * @internal
+     */
+    static resolveRlsFilterCond(filter: FilterDef, accessed: Set<string>, entityName?: string): Dictionary;
     static mergePropertyFilters(propFilters: FilterOptions | undefined, options: FilterOptions | undefined): FilterOptions | undefined;
     static isFilterActive<T>(meta: EntityMetadata<T>, filterName: string, filter: FilterDef, options: Dictionary<boolean | Dictionary>): boolean;
     static processCustomType<T extends object>(prop: EntityProperty<T>, cond: FilterQuery<T>, platform: Platform, key?: string, fromQuery?: boolean): FilterQuery<T>;

package/utils/QueryHelper.js

@@ -4,6 +4,7 @@ import { ARRAY_OPERATORS, GroupOperator, JSON_KEY_OPERATORS, ReferenceKind } fro
 import { JsonType } from '../types/JsonType.js';
 import { helper } from '../entity/wrap.js';
 import { isRaw, Raw } from './RawQueryFragment.js';
+import { MetadataError } from '../errors.js';
 /** @internal */
 export class QueryHelper {
     static SUPPORTED_OPERATORS = ['>', '<', '<=', '>=', '!', '!='];
@@ -286,6 +287,68 @@ export class QueryHelper {
             return filters[f];
         });
     }
+    /** @internal Sentinel wrapping for arguments accessed while statically resolving an `rls` filter condition. */
+    static RLS_SENTINEL_PREFIX = '__mikro_rls_arg__';
+    /** @internal */
+    static RLS_SENTINEL_SUFFIX = '__';
+    /**
+     * Resolves an `rls` filter's condition to a static `FilterQuery`. Function conditions are called with a proxy `args`
+     * that yields a unique sentinel per accessed argument, real `type`/`entityName` strings (validated to not affect the
+     * result), and a poison proxy or `undefined` for the remaining runtime-only parameters.
+     *
+     * @internal
+     */
+    static resolveRlsFilterCond(filter, accessed, entityName) {
+        if (!(filter.cond instanceof Function)) {
+            return filter.cond;
+        }
+        const args = new Proxy({}, {
+            get: (_target, prop) => {
+                if (typeof prop === 'symbol') {
+                    // e.g. coercing `args` itself in a template literal triggers a `Symbol.toPrimitive` lookup
+                    throw MetadataError.rlsFilterUnsupportedCond(filter.name);
+                }
+                accessed.add(prop);
+                return `${this.RLS_SENTINEL_PREFIX}${prop}${this.RLS_SENTINEL_SUFFIX}`;
+            },
+        });
+        const poison = new Proxy({}, {
+            get: () => {
+                throw MetadataError.rlsFilterDependsOnRuntimeState(filter.name);
+            },
+        });
+        // property access on the poison proxies throws, but equality/truthiness checks (`type === 'read'`,
+        // `entityName === 'X'`, `options ? a : b`) cannot be trapped — vary all three across the evaluations and require
+        // identical results, so a command-, entity-, or options-dependent condition cannot silently compile one branch.
+        // `entityName` uses the real class name (plus two derived-distinct variants) so an `=== '<name>'` check diverges;
+        // `options` alternates the poison proxy and `undefined` so a truthiness check flips. `em` stays poison throughout.
+        const name = entityName ?? `${this.RLS_SENTINEL_PREFIX}entity${this.RLS_SENTINEL_SUFFIX}`;
+        const evaluate = (type, entity, options) => {
+            let result;
+            try {
+                result = filter.cond(args, type, poison, options, entity);
+            }
+            catch (e) {
+                // a raw TypeError from touching the `undefined` options/em must fail closed like the poison proxy does,
+                // but the descriptive MetadataErrors thrown above are already correct — let them surface unchanged
+                if (e instanceof MetadataError) {
+                    throw e;
+                }
+                throw MetadataError.rlsFilterDependsOnRuntimeState(filter.name);
+            }
+            if (result instanceof Promise) {
+                throw MetadataError.rlsFilterDependsOnRuntimeState(filter.name);
+            }
+            return result;
+        };
+        const read = evaluate('read', name, poison);
+        const update = evaluate('update', `${name}\0a`, undefined);
+        const del = evaluate('delete', `${name}\0b`, poison);
+        if (JSON.stringify(read) !== JSON.stringify(update) || JSON.stringify(read) !== JSON.stringify(del)) {
+            throw MetadataError.rlsFilterDependsOnRuntimeState(filter.name);
+        }
+        return read;
+    }
     static mergePropertyFilters(propFilters, options) {
         if (!options || !propFilters || options === true || propFilters === true) {
             return options ?? propFilters;

package/utils/TransactionManager.js

@@ -239,7 +239,7 @@ export class TransactionManager {
         return TransactionContext.create(fork, () => fork.getConnection().transactional(async (trx) => {
             fork.setTransactionContext(trx);
             return this.executeTransactionFlow(fork, cb, propagateToUpperContext, em);
-        }, { ...options, eventBroadcaster }));
+        }, { sessionContext: fork.getTransactionSessionContext(), ...options, eventBroadcaster }));
     }
     /**
      * Executes transaction workflow with entity synchronization.

package/utils/Utils.d.ts

@@ -33,6 +33,8 @@ export declare function parseJsonSafe<T = unknown>(value: unknown): T;
 export declare class Utils {
     #private;
     static readonly PK_SEPARATOR = "~~~";
+    /** Default session variable name backing an RLS filter argument (`current_setting('mikro.<filter>.<arg>')`). */
+    static getRlsSettingName(filterName: string, argName: string): string;
     /**
      * Checks if the argument is instance of `Object`. Returns false for arrays.
      */

package/utils/Utils.js

@@ -153,7 +153,11 @@ export function parseJsonSafe(value) {
 /** Collection of general-purpose utility methods used throughout the ORM. */
 export class Utils {
     static PK_SEPARATOR = '~~~';
-    static #ORM_VERSION = '7.2.0-dev.14';
+    static #ORM_VERSION = '7.2.0-dev.16';
+    /** Default session variable name backing an RLS filter argument (`current_setting('mikro.<filter>.<arg>')`). */
+    static getRlsSettingName(filterName, argName) {
+        return `mikro.${filterName}.${argName}`;
+    }
     /**
      * Checks if the argument is instance of `Object`. Returns false for arrays.
      */

package/utils/env-vars.js

@@ -88,6 +88,7 @@ export function loadEnvironmentVars() {
     read3('createForeignKeyConstraints', bool);
     read3('ignoreTriggers', bool);
     read3('ignoreRoutines', bool);
+    read3('ignorePolicies', bool);
     cleanup(ret, 'schemaGenerator');
     ret.seeder = {};
     const read4 = read.bind(null, ret.seeder, 'MIKRO_ORM_SEEDER_');

package/utils/index.d.ts

@@ -10,4 +10,5 @@ export * from './EntityComparator.js';
 export * from './RawQueryFragment.js';
 export * from './env-vars.js';
 export * from './upsert-utils.js';
+export * from './rls-utils.js';
 export * from './partition-utils.js';

package/utils/index.js

@@ -10,4 +10,5 @@ export * from './EntityComparator.js';
 export * from './RawQueryFragment.js';
 export * from './env-vars.js';
 export * from './upsert-utils.js';
+export * from './rls-utils.js';
 export * from './partition-utils.js';

package/utils/rls-utils.d.ts

@@ -0,0 +1,35 @@
+import type { MetadataStorage } from '../metadata/MetadataStorage.js';
+import type { Dictionary, FilterDef } from '../typings.js';
+/** An `rls`-flagged filter definition together with the entity it is declared on. @internal */
+export interface RlsFilterEntry {
+    filter: FilterDef;
+    entityName: string;
+}
+/**
+ * Collects all `rls`-flagged filter definitions with the given name (only entity-scoped filters can be `rls`).
+ * The full name -> defs lookup is built once and cached on the shared (immutable) MetadataStorage, so repeated
+ * `setFilterParams` calls and forks reuse it instead of walking every entity each time.
+ * @internal
+ */
+export declare function findRlsFilterDefs(metadata: MetadataStorage, name: string): RlsFilterEntry[];
+/**
+ * Drops the cached `rls` filter lookup — `MikroORM.discoverEntity()` mutates the shared MetadataStorage,
+ * so a lookup built before the call would miss the newly discovered filters.
+ *
+ * @internal
+ */
+export declare function clearRlsFilterDefsCache(metadata: MetadataStorage): void;
+/**
+ * Computes the `rls` session variables a set of same-named filter defs stages for the given args, mirroring the
+ * policy compilation (`current_setting` names and custom `setting` binding). Shared by staging and `fork({ session })`.
+ * @internal
+ */
+export declare function computeRlsFilterVariables(filters: RlsFilterEntry[], args: Dictionary): Dictionary<string | number | boolean | Date>;
+/**
+ * Computes which staged session variables a `setFilterParams` call may prune: the variables the OLD args staged for
+ * this filter that the new args no longer set, minus any variable another filter's current params still stage
+ * (a custom `setting` name can be shared by differently named filters). Recomputing from the old args rather than
+ * matching by prefix keeps a filter named `tenant` from also pruning a `tenant.x` filter's `mikro.tenant.x.*` variables.
+ * @internal
+ */
+export declare function computeRemovedRlsVariables(metadata: MetadataStorage, name: string, filters: RlsFilterEntry[], previousArgs: Dictionary, nextVariables: Dictionary, allFilterParams: Dictionary<Dictionary>): string[];

package/utils/rls-utils.js

@@ -0,0 +1,97 @@
+import { MetadataError, ValidationError } from '../errors.js';
+import { QueryHelper } from './QueryHelper.js';
+import { Utils } from './Utils.js';
+/** Lazily-built `rls` filter lookup keyed by the shared (immutable) MetadataStorage, so all forks reuse it. */
+const rlsFilterDefs = new WeakMap();
+/**
+ * Collects all `rls`-flagged filter definitions with the given name (only entity-scoped filters can be `rls`).
+ * The full name -> defs lookup is built once and cached on the shared (immutable) MetadataStorage, so repeated
+ * `setFilterParams` calls and forks reuse it instead of walking every entity each time.
+ * @internal
+ */
+export function findRlsFilterDefs(metadata, name) {
+    let cache = rlsFilterDefs.get(metadata);
+    if (!cache) {
+        cache = new Map();
+        for (const meta of metadata) {
+            for (const filterName of Object.keys(meta.filters)) {
+                const filter = meta.filters[filterName];
+                if (!filter.rls) {
+                    continue;
+                }
+                const defs = cache.get(filterName) ?? [];
+                // inheritance shares the same filter object across base and child metadata — keep a single entry
+                if (!defs.some(d => d.filter === filter)) {
+                    defs.push({ filter, entityName: meta.className });
+                }
+                cache.set(filterName, defs);
+            }
+        }
+        rlsFilterDefs.set(metadata, cache);
+    }
+    return cache.get(name) ?? [];
+}
+/**
+ * Drops the cached `rls` filter lookup — `MikroORM.discoverEntity()` mutates the shared MetadataStorage,
+ * so a lookup built before the call would miss the newly discovered filters.
+ *
+ * @internal
+ */
+export function clearRlsFilterDefsCache(metadata) {
+    rlsFilterDefs.delete(metadata);
+}
+/**
+ * Computes the `rls` session variables a set of same-named filter defs stages for the given args, mirroring the
+ * policy compilation (`current_setting` names and custom `setting` binding). Shared by staging and `fork({ session })`.
+ * @internal
+ */
+export function computeRlsFilterVariables(filters, args) {
+    const variables = {};
+    for (const { filter, entityName } of filters) {
+        const setting = typeof filter.rls === 'object' ? filter.rls.setting : undefined;
+        let settingArg;
+        if (setting) {
+            // mirror the policy compilation — a custom `setting` binds the single argument the condition accesses
+            const accessed = new Set();
+            QueryHelper.resolveRlsFilterCond(filter, accessed, entityName);
+            if (accessed.size > 1) {
+                throw MetadataError.rlsFilterMultiArgSetting(filter.name, [...accessed]);
+            }
+            settingArg = [...accessed][0];
+        }
+        for (const key of Object.keys(args)) {
+            const value = args[key];
+            // treat `undefined` like an omitted arg — staging it would serialize as the literal string 'undefined'
+            if (value === undefined) {
+                continue;
+            }
+            // a non-scalar arg has no equivalent in the compiled `= current_setting(...)` comparison — the app-level
+            // filter would apply `$in`/`is null` semantics while the policy compares against `String(value)`
+            if (value === null || (typeof value === 'object' && !(value instanceof Date))) {
+                throw ValidationError.cannotStageNonScalarSessionVariable(filter.name, key);
+            }
+            const settingName = key === settingArg ? setting : Utils.getRlsSettingName(filter.name, key);
+            variables[settingName] = value;
+        }
+    }
+    return variables;
+}
+/**
+ * Computes which staged session variables a `setFilterParams` call may prune: the variables the OLD args staged for
+ * this filter that the new args no longer set, minus any variable another filter's current params still stage
+ * (a custom `setting` name can be shared by differently named filters). Recomputing from the old args rather than
+ * matching by prefix keeps a filter named `tenant` from also pruning a `tenant.x` filter's `mikro.tenant.x.*` variables.
+ * @internal
+ */
+export function computeRemovedRlsVariables(metadata, name, filters, previousArgs, nextVariables, allFilterParams) {
+    const removed = Object.keys(computeRlsFilterVariables(filters, previousArgs)).filter(key => !(key in nextVariables));
+    const keptByOthers = new Set();
+    for (const otherName of removed.length > 0 ? Object.keys(allFilterParams) : []) {
+        if (otherName !== name) {
+            for (const key of Object.keys(computeRlsFilterVariables(findRlsFilterDefs(metadata, otherName), allFilterParams[otherName]))) {
+                keptByOthers.add(key);
+            }
+        }
+    }
+    return removed.filter(key => !keptByOthers.has(key));
+}