@mikro-orm/core 7.2.0-dev.2 → 7.2.0-dev.20

package/errors.js

@@ -94,6 +94,30 @@ export class ValidationError extends Error {
     static cannotUseGlobalContext() {
         return new ValidationError("Using global EntityManager instance methods for context specific actions is disallowed. If you need to work with the global instance's identity map, use `allowGlobalContext` configuration option or `fork()` instead.");
     }
+    static sessionContextNotSupported() {
+        return new ValidationError('Database session context (row level security) is only supported by the PostgreSQL driver. To test a PostgreSQL app without a server, use the `@mikro-orm/pglite` driver instead of sqlite.');
+    }
+    static sessionContextRequiresImplicitTransactions() {
+        return new ValidationError("Cannot set a database session context (row level security) with the 'transaction' strategy while 'implicitTransactions' is disabled. The context is applied on transaction begin, but writes would run without a transaction and silently bypass the policies. Enable 'implicitTransactions', wrap the work in 'em.transactional()', or use the 'connection' session context strategy.");
+    }
+    static sessionContextWithDisabledTransactions() {
+        return new ValidationError("Cannot set a database session context (row level security) with the 'transaction' strategy while transactions are disabled via 'disableTransactions'. The context is applied on transaction begin, so flushes would run without it and silently bypass the policies. Enable transactions, or use the 'connection' session context strategy.");
+    }
+    static sessionContextInsideTransaction(action = 'set') {
+        const advice = action === 'set'
+            ? "Set the session context before starting the transaction (e.g. via 'em.fork({ session })')."
+            : 'Clear the session context outside the transaction.';
+        return new ValidationError(`Cannot ${action} a database session context (row level security) inside an active transaction. The context is applied when the transaction begins or the connection is reserved, so the change would never reach an already-open transaction (with the 'connection' strategy the pinned connection was reserved with the previous context). ${advice}`);
+    }
+    static cannotStageNonScalarSessionVariable(filterName, argName) {
+        return new ValidationError(`Cannot stage the '${argName}' argument of filter '${filterName}' as a session variable (row level security) — only scalar values (string, number, boolean, Date) can be mirrored to the database policy backing the filter.`);
+    }
+    static sessionContextStreamRequiresTransaction() {
+        return new ValidationError("Cannot stream under a database session context (row level security) with the 'transaction' strategy outside a transaction. Streaming never opens the implicit transaction that applies the context, so the streamed rows would not be scoped by it (other tenants' rows would leak). Wrap the stream in 'em.transactional()', or use the 'connection' session context strategy.");
+    }
+    static connectionSessionContextNotSupported() {
+        return new ValidationError("The 'connection' session context strategy requires a driver that supports per-acquire connection hooks (the `postgresql` driver). Use the default 'transaction' strategy instead.");
+    }
     static cannotUseOperatorsInsideEmbeddables(entityName, propName, payload) {
         return new ValidationError(`Using operators inside embeddables is not allowed, move the operator above. (property: ${Utils.className(entityName)}.${propName}, payload: ${inspect(payload)})`);
     }
@@ -116,6 +140,11 @@ export class CursorError extends ValidationError {
     static missingValue(entityName, prop) {
         return new CursorError(`Invalid cursor condition, value for '${entityName}.${prop}' is missing.`);
     }
+    static invalidCursor(entityName, cause) {
+        const error = new CursorError(`Invalid cursor for entity ${entityName}: ${cause.message}`);
+        error.cause = cause;
+        return error;
+    }
 }
 /** Error thrown when an optimistic lock conflict is detected during entity persistence. */
 export class OptimisticLockError extends ValidationError {
@@ -195,6 +224,9 @@ export class MetadataError extends ValidationError {
     static missingMetadata(entity) {
         return new MetadataError(`Metadata for entity ${entity} not found`);
     }
+    static ambiguousEntityName(className) {
+        return new MetadataError(`Entity name '${className}' is ambiguous, multiple discovered entity classes share it (possibly due to a minifier mangling class names). Use a class reference instead of a string name.`);
+    }
     static invalidPrimaryKey(meta, prop, requiredName) {
         return this.fromMessage(meta, prop, `has wrong field name, '${requiredName}' is required in current driver`);
     }
@@ -214,6 +246,16 @@ export class MetadataError extends ValidationError {
         const suggestion = target.embeddable ? 'Embedded' : 'ManyToOne';
         return this.fromMessage(meta, prop, `is defined as scalar @Property(), but its type is a discovered entity ${target.className}. Maybe you want to use @${suggestion}() decorator instead?`);
     }
+    static throughRelationMissingProperty(meta, prop, through, side) {
+        const target = side === 'owner' ? meta.className : prop.targetMeta.className;
+        return this.fromMessage(meta, prop, `uses 'through' entity ${through.className} which has no ManyToOne property pointing to ${target}`);
+    }
+    static throughRelationCompositeTarget(meta, prop) {
+        return this.fromMessage(meta, prop, `uses 'through' option which is not supported for targets with composite primary key`);
+    }
+    static throughRelationInvalidKind(meta, prop) {
+        return this.fromMessage(meta, prop, `uses 'through' option which is only supported for ManyToOne and OneToOne relations`);
+    }
     static fromMissingOption(meta, prop, option) {
         return this.fromMessage(meta, prop, `is missing '${option}' option`);
     }
@@ -247,6 +289,54 @@ export class MetadataError extends ValidationError {
     static triggersNotSupportedByDriver(meta) {
         return new MetadataError(`Entity ${meta.className} defines database triggers which are not supported by the current driver. Triggers are only available with SQL drivers.`);
     }
+    /** Thrown when row level security is declared on an entity using a driver that does not support it. */
+    static rowLevelSecurityNotSupportedByDriver(meta) {
+        return new MetadataError(`Entity ${meta.className} declares row level security which is not supported by the current driver. Row level security is only available with the PostgreSQL driver. To test a PostgreSQL app without a server, use the \`@mikro-orm/pglite\` driver instead of sqlite.`);
+    }
+    /** Thrown when row level security is declared on a non-root entity of an STI hierarchy. */
+    static rowLevelSecurityOnNonRootStiEntity(meta) {
+        return new MetadataError(`Entity ${meta.className} declares row level security, but it is part of a single table inheritance hierarchy. Declare policies on the root entity ${meta.root.className} instead, as the whole hierarchy shares a single table.`);
+    }
+    /** Thrown when two policies on the same entity are given the same explicit name. */
+    static duplicatePolicyName(meta, name) {
+        return new MetadataError(`Entity ${meta.className} declares multiple row level security policies named '${name}'. Policy names must be unique per table; rename one of them or omit the name to use an auto-generated one.`);
+    }
+    /** Thrown when a filter flagged with `rls` is declared on a driver that does not support row level security. */
+    static rlsFilterNotSupportedByDriver(meta, filterName) {
+        return new MetadataError(`Filter '${filterName}' on entity ${meta.className} is flagged with 'rls', which is only supported by the PostgreSQL driver. To test a PostgreSQL app without a server, use the \`@mikro-orm/pglite\` driver instead of sqlite.`);
+    }
+    /** Thrown when a filter flagged with `rls` is declared on a non-root entity of an STI hierarchy. */
+    static rlsFilterOnNonRootStiEntity(meta, filterName) {
+        return new MetadataError(`Filter '${filterName}' on entity ${meta.className} is flagged with 'rls', but the entity is part of a single table inheritance hierarchy. Declare the filter on the root entity ${meta.root.className} instead, as the whole hierarchy shares a single table and the policy would never be created otherwise.`);
+    }
+    /** Thrown when a global (config or EM registered) filter is flagged with `rls`; RLS filters must be entity scoped. */
+    static rlsFilterMustBeEntityScoped(filterName) {
+        return new MetadataError(`Filter '${filterName}' is a global filter and cannot be flagged with 'rls'. RLS filters must be declared on an entity via @Filter() so a policy can be attached to its table.`);
+    }
+    /** Thrown when an entity-scoped `rls` filter is registered at runtime via `em.addFilter()` instead of in metadata. */
+    static rlsFilterCannotBeRegisteredAtRuntime(filterName) {
+        return new MetadataError(`Filter '${filterName}' cannot be flagged with 'rls' when registered at runtime via 'em.addFilter()'. RLS filters must be declared in entity metadata via the @Filter() decorator (or the entity 'filters' option) so a policy can be attached to the table.`);
+    }
+    /** Thrown when a filter's custom `setting` is used with more than one argument. */
+    static rlsFilterMultiArgSetting(filterName, args) {
+        return new MetadataError(`Filter '${filterName}' sets a custom 'setting' but references multiple arguments (${args.join(', ')}). A custom 'setting' is only allowed for single-argument RLS filters; remove it to use the default 'mikro.${filterName}.<arg>' names.`);
+    }
+    /** Thrown when an `rls` filter's condition depends on runtime state and cannot be compiled to a static policy. */
+    static rlsFilterDependsOnRuntimeState(filterName) {
+        return new MetadataError(`Filter '${filterName}' cannot be compiled to an RLS policy because its condition depends on runtime state (it accesses 'em', 'type', 'options' or 'entityName', or resolves asynchronously). Declare an explicit policy instead.`);
+    }
+    /** Thrown when an `rls` filter compares against a column whose type has no automatic session-variable cast. */
+    static rlsFilterUncastableType(filterName, columnType) {
+        return new MetadataError(`Filter '${filterName}' cannot be compiled to an RLS policy because the column type '${columnType}' has no automatic session-variable cast. Declare an explicit policy instead.`);
+    }
+    /** Thrown when an `rls` filter references an argument outside of a direct comparison, which cannot be compiled. */
+    static rlsFilterUnsupportedCond(filterName) {
+        return new MetadataError(`Filter '${filterName}' cannot be compiled to an RLS policy because it references an argument outside of a direct comparison (only expressions like { prop: args.x } are supported). Declare an explicit policy instead.`);
+    }
+    /** Thrown when an `rls` filter compares against a column the schema generator does not manage. */
+    static rlsFilterUnmanagedColumn(filterName, column) {
+        return new MetadataError(`Filter '${filterName}' cannot be compiled to an RLS policy because column '${column}' is not part of the managed schema (e.g. the property is marked 'persist: false' or the column is excluded via 'skipColumns'). Declare an explicit policy instead.`);
+    }
     static fromMessage(meta, prop, message) {
         return new MetadataError(`${meta.className}.${prop.name} ${message}`);
     }

package/events/EventManager.js

@@ -43,7 +43,10 @@ export class EventManager {
         }));
         for (const listener of this.#listeners[event] ?? new Set()) {
             const entities = this.#entities.get(listener);
-            if (entities.size === 0 || !entity || entities.has(entity.constructor.name)) {
+            if (entities.size === 0 ||
+                !entity ||
+                entities.has(entity.constructor) ||
+                entities.has(entity.constructor.name)) {
                 listeners.push(listener[event].bind(listener));
             }
         }
@@ -68,7 +71,7 @@ export class EventManager {
         }
         for (const listener of this.#listeners[event] ?? new Set()) {
             const entities = this.#entities.get(listener);
-            if (entities.size === 0 || entities.has(meta.className)) {
+            if (entities.size === 0 || entities.has(meta.class) || entities.has(meta.className)) {
                 this.#cache.set(cacheKey, true);
                 return true;
             }
@@ -84,6 +87,6 @@ export class EventManager {
         if (!listener.getSubscribedEntities) {
             return new Set();
         }
-        return new Set(listener.getSubscribedEntities().map(name => Utils.className(name)));
+        return new Set(listener.getSubscribedEntities().map(name => Utils.classOrName(name)));
     }
 }

package/exceptions.d.ts

@@ -102,3 +102,8 @@ export declare class TableNotFoundException extends DatabaseObjectNotFoundExcept
  */
 export declare class UniqueConstraintViolationException extends ConstraintViolationException {
 }
+/**
+ * Exception for a row-level security policy violation (failed `WITH CHECK`) detected in the driver.
+ */
+export declare class RowLevelSecurityViolationException extends ConstraintViolationException {
+}

package/exceptions.js

@@ -115,3 +115,8 @@ export class TableNotFoundException extends DatabaseObjectNotFoundException {
  */
 export class UniqueConstraintViolationException extends ConstraintViolationException {
 }
+/**
+ * Exception for a row-level security policy violation (failed `WITH CHECK`) detected in the driver.
+ */
+export class RowLevelSecurityViolationException extends ConstraintViolationException {
+}

package/hydration/ObjectHydrator.d.ts

@@ -19,6 +19,8 @@ export declare class ObjectHydrator extends Hydrator {
     getEntityHydrator<T extends object>(meta: EntityMetadata<T>, type: 'full' | 'reference', normalizeAccessors?: boolean): EntityHydrator<T>;
     private createCollectionItemMapper;
     private wrap;
+    /** Renders a key as a single-quoted JS string literal, safe to embed in generated code. */
+    private quote;
     private safeKey;
 }
 export {};

package/hydration/ObjectHydrator.js

@@ -87,7 +87,7 @@ export class ObjectHydrator extends Hydrator {
             ret.push(`  if (data${dataKey} === null) {`);
             if (prop.ref) {
                 ret.push(`    entity${entityKey} = new ScalarReference();`);
-                ret.push(`    entity${entityKey}.bind(entity, '${prop.name}');`);
+                ret.push(`    entity${entityKey}.bind(entity, ${this.quote(prop.name)});`);
                 ret.push(`    entity${entityKey}.set(${nullVal});`);
             }
             else {
@@ -127,14 +127,14 @@ export class ObjectHydrator extends Hydrator {
             if (prop.ref) {
                 ret.push(`    const value = isScalarReference(entity${entityKey}) ? entity${entityKey}.unwrap() : entity${entityKey};`);
                 ret.push(`    entity${entityKey} = oldValue_${idx} ?? new ScalarReference(value);`);
-                ret.push(`    entity${entityKey}.bind(entity, '${prop.name}');`);
+                ret.push(`    entity${entityKey}.bind(entity, ${this.quote(prop.name)});`);
                 ret.push(`    entity${entityKey}.set(value);`);
             }
             ret.push(`  }`);
             if (prop.ref) {
                 ret.push(`  if (!entity${entityKey}) {`);
                 ret.push(`    entity${entityKey} = new ScalarReference();`);
-                ret.push(`    entity${entityKey}.bind(entity, '${prop.name}');`);
+                ret.push(`    entity${entityKey}.bind(entity, ${this.quote(prop.name)});`);
                 ret.push(`  }`);
             }
             return ret;
@@ -220,7 +220,7 @@ export class ObjectHydrator extends Hydrator {
             ret.push(`  }`);
             ret.push(`  if (Array.isArray(data${dataKey})) {`);
             ret.push(`    const items = data${dataKey}.map(value => createCollectionItem_${this.safeKey(prop.name)}(value, entity));`);
-            ret.push(`    const coll = Collection.create(entity, '${prop.name}', items, newEntity);`);
+            ret.push(`    const coll = Collection.create(entity, ${this.quote(prop.name)}, items, newEntity);`);
             ret.push(`    if (newEntity) {`);
             ret.push(`      coll.setDirty();`);
             ret.push(`    } else {`);
@@ -231,11 +231,11 @@ export class ObjectHydrator extends Hydrator {
             if (!this.platform.usesPivotTable() && prop.owner && prop.kind === ReferenceKind.MANY_TO_MANY) {
                 ret.push(`  } else if (!entity${entityKey} && Array.isArray(data${dataKey})) {`);
                 const items = this.platform.usesPivotTable() || !prop.owner ? 'undefined' : '[]';
-                ret.push(`    const coll = Collection.create(entity, '${prop.name}', ${items}, !!data${dataKey} || newEntity);`);
+                ret.push(`    const coll = Collection.create(entity, ${this.quote(prop.name)}, ${items}, !!data${dataKey} || newEntity);`);
                 ret.push(`    coll.setDirty(false);`);
             }
             ret.push(`  } else if (!entity${entityKey}) {`);
-            ret.push(`    const coll = Collection.create(entity, '${prop.name}', undefined, newEntity);`);
+            ret.push(`    const coll = Collection.create(entity, ${this.quote(prop.name)}, undefined, newEntity);`);
             ret.push(`    coll.setDirty(false);`);
             ret.push(`  }`);
             return ret;
@@ -364,6 +364,9 @@ export class ObjectHydrator extends Hydrator {
             ret.push(`    data${dataKey}.forEach((_, idx_${idx}) => {`);
             ret.push(...hydrateEmbedded(prop, [...path, `[idx_${idx}]`], `${dataKey}[idx_${idx}]`).map(l => '    ' + l));
             ret.push(`    });`);
+            ret.push(`  } else if (data${dataKey} === null) {`);
+            /* v8 ignore next */
+            ret.push(`    entity${entityKey} = ${this.config.get('forceUndefined') ? 'undefined' : 'null'};`);
             ret.push(`  }`);
             return ret;
         };
@@ -428,10 +431,14 @@ export class ObjectHydrator extends Hydrator {
         return lines;
     }
     wrap(key) {
-        if (/^\[.*]$/.exec(key)) {
+        if (/^\[idx_\d+]$/.exec(key)) {
             return key;
         }
-        return /^\w+$/.exec(key) ? `.${key}` : `['${key}']`;
+        return /^\w+$/.exec(key) ? `.${key}` : `[${this.quote(key)}]`;
+    }
+    /** Renders a key as a single-quoted JS string literal, safe to embed in generated code. */
+    quote(key) {
+        return `'${key.replace(/\\/g, '\\\\').replace(/'/g, "\\'")}'`;
     }
     safeKey(key) {
         return key.replace(/\W/g, '_');

package/index.d.ts

@@ -3,7 +3,7 @@
  * @module core
  */
 export { EntityMetadata, PrimaryKeyProp, EntityRepositoryType, OptionalProps, EagerProps, HiddenProps, Config, EntityName, IndexHints, } from './typings.js';
-export type { CompiledFunctions, Constructor, ConnectionType, Dictionary, Primary, IPrimaryKey, ObjectQuery, FilterQuery, IWrappedEntity, InferEntityName, EntityData, Highlighter, MaybePromise, AnyEntity, EntityClass, EntityProperty, PopulateOptions, Populate, Loaded, New, LoadedReference, LoadedCollection, IMigrator, IMigrationGenerator, MigratorEvent, GetRepository, MigrationObject, DeepPartial, PrimaryProperty, Cast, IsUnknown, EntityDictionary, EntityDTO, EntityDTOFlat, EntityDTOProp, SerializeDTO, MigrationDiff, GenerateOptions, FilterObject, IndexFilterQuery, ExtractIndexHints, ExtractDefineEntityProperties, IndexName, IndexColumns, WithUsingOptions, IMigrationRunner, IEntityGenerator, ISeedManager, SeederObject, IMigratorStorage, RequiredEntityData, CheckCallback, TriggerCallback, IndexCallback, FormulaCallback, FormulaColumns, FormulaTable, SchemaTable, SchemaColumns, SchemaColumnRef, EntityDataPropValue, SimpleColumnMeta, Rel, Ref, LazyRef, ScalarRef, EntityRef, ISchemaGenerator, MigrationInfo, MigrateOptions, MigrationResult, MigrationRow, EntityKey, EntityValue, EntityDataValue, FilterKey, EntityType, FromEntityType, Selected, IsSubset, EntityProps, ExpandProperty, ExpandScalar, FilterItemValue, ExpandQuery, Scalar, ExpandHint, FilterValue, MergeLoaded, MergeSelected, TypeConfig, AnyString, ClearDatabaseOptions, CreateSchemaOptions, EnsureDatabaseOptions, UpdateSchemaOptions, DropSchemaOptions, RefreshDatabaseOptions, AutoPath, UnboxArray, MetadataProcessor, ImportsResolver, RequiredNullable, DefineConfig, Opt, Hidden, EntitySchemaWithMeta, InferEntity, CheckConstraint, TriggerDef, RoutineReturns, RoutineBodyCallback, RoutineJsBody, RoutineIgnoreField, RoutineParamConfig, RoutineConfig, RoutineRuntimeType, RoutineArgs, RoutineReturn, GeneratedColumnCallback, FilterDef, EntityCtor, Subquery, PopulateHintOptions, Prefixes, } from './typings.js';
+export type { CompiledFunctions, Constructor, ConnectionType, Dictionary, Primary, IPrimaryKey, ObjectQuery, FilterQuery, IWrappedEntity, InferEntityName, EntityData, Highlighter, MaybePromise, AnyEntity, EntityClass, EntityProperty, PopulateOptions, Populate, Loaded, New, LoadedReference, LoadedCollection, IMigrator, IMigrationGenerator, MigratorEvent, GetRepository, MigrationObject, DeepPartial, PrimaryProperty, Cast, IsUnknown, EntityDictionary, EntityDTO, EntityDTOFlat, EntityDTOProp, SerializeDTO, MigrationDiff, GenerateOptions, FilterObject, IndexFilterQuery, ExtractIndexHints, ExtractDefineEntityProperties, IndexName, IndexColumns, WithUsingOptions, IMigrationRunner, IEntityGenerator, ISeedManager, SeederObject, IMigratorStorage, RequiredEntityData, CheckCallback, TriggerCallback, IndexCallback, FormulaCallback, FormulaColumns, FormulaTable, SchemaTable, SchemaColumns, SchemaColumnRef, EntityDataPropValue, SimpleColumnMeta, Rel, Ref, LazyRef, ScalarRef, EntityRef, ISchemaGenerator, MigrationInfo, MigrateOptions, MigrationResult, MigrationRow, EntityKey, EntityValue, EntityDataValue, FilterKey, EntityType, FromEntityType, Selected, IsSubset, EntityProps, ExpandProperty, ExpandScalar, FilterItemValue, ExpandQuery, Scalar, ExpandHint, FilterValue, MergeLoaded, MergeSelected, TypeConfig, AnyString, ClearDatabaseOptions, CreateSchemaOptions, EnsureDatabaseOptions, UpdateSchemaOptions, DropSchemaOptions, RefreshDatabaseOptions, AutoPath, UnboxArray, MetadataProcessor, ImportsResolver, RequiredNullable, DefineConfig, Opt, Hidden, EntitySchemaWithMeta, InferEntity, CheckConstraint, TriggerDef, PolicyDef, PolicyCallback, SessionContext, RoutineReturns, RoutineBodyCallback, RoutineJsBody, RoutineIgnoreField, RoutineParamConfig, RoutineConfig, RoutineRuntimeType, RoutineArgs, RoutineReturn, GeneratedColumnCallback, FilterDef, EntityCtor, Subquery, PopulateHintOptions, Prefixes, } from './typings.js';
 export * from './enums.js';
 export * from './errors.js';
 export * from './exceptions.js';

package/metadata/EntitySchema.js

@@ -4,6 +4,8 @@ import { Cascade, ReferenceKind } from '../enums.js';
 import { Type } from '../types/Type.js';
 import { Utils } from '../utils/Utils.js';
 import { EnumArrayType } from '../types/EnumArrayType.js';
+// mirrors `MetadataStorage.META_SYMBOL`, we can't import it here due to a module cycle
+const META_SYMBOL = Symbol.for('@mikro-orm/core/MetadataStorage.META_SYMBOL');
 /** Class-less entity definition that provides a programmatic API for defining entities without decorators. */
 export class EntitySchema {
     /**
@@ -220,8 +222,9 @@ export class EntitySchema {
         // Only set extends if the parent is NOT the auto-generated class for this same entity.
         // When the user extends the auto-generated class (from defineEntity without a class option)
         // and registers their custom class via setClass, we don't want to discover the
-        // auto-generated class as a separate parent entity.
-        if (base !== BaseEntity && base.name !== this._meta.className) {
+        // auto-generated class as a separate parent entity. A parent carrying its own decorator
+        // metadata is a real base class even when a minifier mangles it to the same name as the child.
+        if (base !== BaseEntity && (base.name !== this._meta.className || Object.hasOwn(base, META_SYMBOL))) {
             this._meta.extends ??= base.name ? base : undefined;
         }
     }

package/metadata/MetadataDiscovery.d.ts

@@ -117,6 +117,7 @@ export declare class MetadataDiscovery {
     private createSchemaTable;
     private initCheckConstraints;
     private initTriggers;
+    private initPolicies;
     private initGeneratedColumn;
     private getDefaultVersionValue;
     private inferDefaultValue;
@@ -125,6 +126,8 @@ export declare class MetadataDiscovery {
     private initVersionProperty;
     private initCustomType;
     private initRelation;
+    /** Resolves the `through` option of a virtual to-one relation into a read-only formula property. */
+    private initThroughRelation;
     private initColumnType;
     private getMappedType;
     private getPrefix;