@mikro-orm/core 7.2.0-dev.2 → 7.2.0-dev.20

package/unit-of-work/ChangeSetPersister.js

@@ -3,7 +3,7 @@ import { PolymorphicRef } from '../entity/PolymorphicRef.js';
 import { helper } from '../entity/wrap.js';
 import { ChangeSetType } from './ChangeSet.js';
 import { isRaw } from '../utils/RawQueryFragment.js';
-import { Utils } from '../utils/Utils.js';
+import { equals, Utils } from '../utils/Utils.js';
 import { OptimisticLockError, ValidationError } from '../errors.js';
 import { ReferenceKind } from '../enums.js';
 /** @internal Executes change sets against the database, handling inserts, updates, and deletes. */
@@ -204,13 +204,14 @@ export class ChangeSetPersister {
     }
     checkConcurrencyKeys(meta, changeSet, cond) {
         const tmp = [];
-        for (const key of meta.concurrencyCheckKeys) {
+        const keys = meta.getOwnConcurrencyCheckKeys();
+        for (const key of keys) {
             cond[key] = changeSet.originalEntity[key];
             if (changeSet.payload[key]) {
                 tmp.push(key);
             }
         }
-        if (tmp.length === 0 && meta.concurrencyCheckKeys.size > 0) {
+        if (tmp.length === 0 && keys.length > 0) {
             throw OptimisticLockError.lockFailed(changeSet.entity);
         }
     }
@@ -230,11 +231,15 @@ export class ChangeSetPersister {
         }
         const res = await this.#driver.nativeUpdateMany(meta.class, cond, payload, options);
         const map = new Map();
-        res.rows?.forEach(item => map.set(Utils.getCompositeKeyHash(item, meta, true, this.#platform, true), item));
+        // returning rows are not mapped yet, so they are keyed by field names - we need to build the hash
+        // from those to be able to match them with `getSerializedPrimaryKey()` of the entity
+        const pkFields = meta.getPrimaryProps().flatMap(prop => prop.fieldNames);
+        res.rows?.forEach(item => map.set(Utils.getPrimaryKeyHash(pkFields.map(field => item[field])), item));
         for (const changeSet of changeSets) {
             if (res.rows) {
                 const row = map.get(helper(changeSet.entity).getSerializedPrimaryKey());
-                this.mapReturnedValues(changeSet.entity, changeSet.payload, row, meta);
+                // STI batches can mix child types, so map through the change set's own metadata
+                this.mapReturnedValues(changeSet.entity, changeSet.payload, row, changeSet.meta);
             }
             changeSet.persisted = true;
         }
@@ -299,32 +304,33 @@ export class ChangeSetPersister {
         options = this.prepareOptions(meta, options, {
             convertCustomTypes: false,
         });
-        if (meta.concurrencyCheckKeys.size === 0 &&
-            (!meta.versionProperty || changeSet.entity[meta.versionProperty] == null)) {
+        if (meta.getOwnConcurrencyCheckKeys().length === 0 &&
+            (!meta.ownsVersionProperty() || changeSet.entity[meta.versionProperty] == null)) {
             return this.#driver.nativeUpdate(changeSet.meta.class, cond, changeSet.payload, options);
         }
-        if (meta.versionProperty) {
+        if (meta.ownsVersionProperty()) {
             cond[meta.versionProperty] = this.#platform.convertVersionValue(changeSet.entity[meta.versionProperty], meta.properties[meta.versionProperty]);
         }
         this.checkConcurrencyKeys(meta, changeSet, cond);
         return this.#driver.nativeUpdate(changeSet.meta.class, cond, changeSet.payload, options);
     }
     async checkOptimisticLocks(meta, changeSets, options) {
-        if (meta.concurrencyCheckKeys.size === 0 &&
-            (!meta.versionProperty || changeSets.every(cs => cs.entity[meta.versionProperty] == null))) {
+        const concurrencyCheckKeys = meta.getOwnConcurrencyCheckKeys();
+        if (concurrencyCheckKeys.length === 0 &&
+            (!meta.ownsVersionProperty() || changeSets.every(cs => cs.entity[meta.versionProperty] == null))) {
             return;
         }
         // skip entity references as they don't have version values loaded
         changeSets = changeSets.filter(cs => helper(cs.entity).__initialized);
+        const primaryKeys = meta.primaryKeys.concat(...concurrencyCheckKeys);
         const $or = changeSets.map(cs => {
-            const cond = Utils.getPrimaryKeyCond(cs.originalEntity, meta.primaryKeys.concat(...meta.concurrencyCheckKeys));
-            if (meta.versionProperty) {
+            const cond = Utils.getPrimaryKeyCond(cs.originalEntity, primaryKeys);
+            if (meta.ownsVersionProperty()) {
                 // @ts-ignore
                 cond[meta.versionProperty] = this.#platform.convertVersionValue(cs.entity[meta.versionProperty], meta.properties[meta.versionProperty]);
             }
             return cond;
         });
-        const primaryKeys = meta.primaryKeys.concat(...meta.concurrencyCheckKeys);
         options = this.prepareOptions(meta, options, {
             fields: primaryKeys,
             orderBy: meta.primaryKeys.reduce((o, pk) => {
@@ -332,9 +338,12 @@ export class ChangeSetPersister {
                 return o;
             }, {}),
         });
-        const res = await this.#driver.find(meta.root.class, { $or }, options);
+        // TPT tables query their own metadata, as the version column might not live on the root table
+        const target = meta.inheritanceType === 'tpt' ? meta : meta.root;
+        const res = await this.#driver.find(target.class, { $or }, options);
         if (res.length !== changeSets.length) {
-            const compare = (a, b, keys) => keys.every(k => a[k] === b[k]);
+            // a FK pointing to a composite PK is an array, so the values need to be compared deeply
+            const compare = (a, b, keys) => keys.every(k => equals(a[k], b[k]));
             const entity = changeSets.find(cs => {
                 return !res.some(row => compare(Utils.getPrimaryKeyCond(cs.entity, primaryKeys), row, primaryKeys));
             }).entity;
@@ -342,7 +351,7 @@ export class ChangeSetPersister {
         }
     }
     checkOptimisticLock(meta, changeSet, res) {
-        if ((meta.versionProperty || meta.concurrencyCheckKeys.size > 0) && res && !res.affectedRows) {
+        if ((meta.ownsVersionProperty() || meta.getOwnConcurrencyCheckKeys().length > 0) && res && !res.affectedRows) {
             throw OptimisticLockError.lockFailed(changeSet.entity);
         }
     }
@@ -351,7 +360,7 @@ export class ChangeSetPersister {
      * so we use a single query in case of both versioning and default values is used.
      */
     async reloadVersionValues(meta, changeSets, options) {
-        const reloadProps = meta.versionProperty && !this.#usesReturningStatement ? [meta.properties[meta.versionProperty]] : [];
+        const reloadProps = meta.ownsVersionProperty() && !this.#usesReturningStatement ? [meta.properties[meta.versionProperty]] : [];
         if (changeSets[0].type === ChangeSetType.CREATE) {
             for (const prop of meta.props) {
                 if (prop.persist === false) {
@@ -375,7 +384,8 @@ export class ChangeSetPersister {
             changeSets.forEach(cs => {
                 Utils.keys(cs.payload).forEach(k => {
                     if (isRaw(cs.payload[k]) && isRaw(cs.entity[k])) {
-                        returning.add(meta.properties[k]);
+                        // STI batches can mix child types, so the property might not exist on `meta`
+                        returning.add(cs.meta.properties[k]);
                     }
                 });
             });
@@ -400,12 +410,14 @@ export class ChangeSetPersister {
         options = this.prepareOptions(meta, options, {
             fields: Utils.unique(reloadProps.map(prop => prop.name)),
         });
-        const data = await this.#driver.find(meta.class, { [pk]: { $in: pks } }, options);
+        // a mixed STI batch shares one table but the child discriminator would filter out the siblings
+        const target = changeSets.some(cs => cs.meta !== meta) && meta.root.discriminatorColumn ? meta.root : meta;
+        const data = await this.#driver.find(target.class, { [pk]: { $in: pks } }, options);
         const map = new Map();
         data.forEach(item => map.set(Utils.getCompositeKeyHash(item, meta, false, this.#platform, true), item));
         for (const changeSet of changeSets) {
             const data = map.get(helper(changeSet.entity).getSerializedPrimaryKey());
-            this.#hydrator.hydrate(changeSet.entity, meta, data, this.#factory, 'full', false, true);
+            this.#hydrator.hydrate(changeSet.entity, changeSet.meta, data, this.#factory, 'full', false, true);
             Object.assign(changeSet.payload, data); // merge to the changeset payload, so it gets saved to the entity snapshot
         }
     }

package/unit-of-work/UnitOfWork.js

@@ -124,7 +124,6 @@ export class UnitOfWork {
         if (options?.newEntity) {
             return entity;
         }
-        const forceUndefined = this.#em.config.get('forceUndefined');
         const wrapped = helper(entity);
         if (options?.loaded && wrapped.__initialized && !wrapped.__onLoadFired) {
             this.#loadedEntities.add(entity);
@@ -332,6 +331,7 @@ export class UnitOfWork {
                     let parentCs = changeSet.tptChangeSets.find(pc => pc.meta === current);
                     if (!parentCs) {
                         parentCs = new ChangeSet(entity, changeSet.type, {}, current);
+                        parentCs.originalEntity = changeSet.originalEntity;
                         changeSet.tptChangeSets.splice(idx, 0, parentCs);
                     }
                     idx++;
@@ -472,6 +472,7 @@ export class UnitOfWork {
                 const loggerContext = Utils.merge({ id: this.#em._id }, this.#em.getLoggerContext({ disableContextResolution: true }));
                 await this.#em.getConnection('write').transactional(trx => this.persistToDatabase(groups, trx), {
                     ctx: oldTx,
+                    sessionContext: this.#em.getTransactionSessionContext(),
                     eventBroadcaster: new TransactionEventBroadcaster(this.#em),
                     loggerContext,
                 });
@@ -527,6 +528,10 @@ export class UnitOfWork {
                     if (prop.formula) {
                         delete referrer[prop.name];
                     }
+                    else if (prop.primary) {
+                        // the referrer's primary key contains the removed entity, so its identity cannot survive the removal
+                        this.unsetIdentity(referrer);
+                    }
                     else {
                         delete helper(referrer).__data[prop.name];
                     }
@@ -702,13 +707,14 @@ export class UnitOfWork {
                     payload[pk] = identifiers[i] ?? originalChangeSet.payload[pk];
                 }
             }
-            if (!isCreate && Object.keys(payload).length === 0) {
+            // the table declaring the version property or a concurrency check still needs its bump and lock check
+            if (!isCreate && Object.keys(payload).length === 0 && !current.hasOptimisticLock()) {
                 current = current.tptParent;
                 continue;
             }
             const cs = new ChangeSet(entity, originalChangeSet.type, payload, current);
+            cs.originalEntity = originalChangeSet.originalEntity;
             if (current === meta) {
-                cs.originalEntity = originalChangeSet.originalEntity;
                 leafCs = cs;
             }
             else {
@@ -1205,7 +1211,8 @@ export class UnitOfWork {
         const addToGroup = (cs) => {
             // Skip stub TPT changesets with empty payload (e.g. leaf with no own-property changes on UPDATE)
             if ((cs.type === ChangeSetType.UPDATE || cs.type === ChangeSetType.UPDATE_EARLY) &&
-                !Utils.hasObjectKeys(cs.payload)) {
+                !Utils.hasObjectKeys(cs.payload) &&
+                !cs.meta.hasOptimisticLock()) {
                 return;
             }
             const group = groups[cs.type];

package/utils/AbstractMigrator.d.ts

@@ -103,7 +103,7 @@ export declare abstract class AbstractMigrator<D extends IDatabaseDriver> implem
         name: string;
         path: string;
     }): RunnableMigration;
-    protected initialize(MigrationClass: Constructor<Migration>, name: string): RunnableMigration;
+    protected initialize(MigrationClass: Constructor<Migration>, name?: string): RunnableMigration;
     /**
      * Checks if `src` folder exists, it so, tries to adjust the migrations and seeders paths automatically to use it.
      * If there is a `dist` or `build` folder, it will be used for the JS variant (`path` option), while the `src` folder will be

package/utils/AbstractMigrator.js

@@ -358,7 +358,8 @@ export class AbstractMigrator {
     initialize(MigrationClass, name) {
         const instance = new MigrationClass(this.driver, this.config);
         return {
-            name: this.storage.getMigrationName(name),
+            // the constructor name is the last resort, minifiers can mangle it (e.g. when bundling)
+            name: this.storage.getMigrationName(name ?? instance.name ?? MigrationClass.name),
             up: afterRun => this.runner.run(instance, 'up', afterRun),
             down: afterRun => this.runner.run(instance, 'down', afterRun),
         };
@@ -409,7 +410,7 @@ export class AbstractMigrator {
         if (this.options.migrationsList) {
             return this.options.migrationsList.map(migration => {
                 if (typeof migration === 'function') {
-                    return this.initialize(migration, migration.name);
+                    return this.initialize(migration);
                 }
                 return this.initialize(migration.class, migration.name);
             });

package/utils/Configuration.d.ts

@@ -439,7 +439,7 @@ export interface Options<Driver extends IDatabaseDriver = IDatabaseDriver, EM ex
      */
     filters: Dictionary<{
         name?: string;
-    } & Omit<FilterDef, 'name'>>;
+    } & Omit<FilterDef, 'name' | 'rls'>>;
     /**
      * Metadata discovery configuration options.
      * Controls how entities are discovered and validated.
@@ -480,6 +480,12 @@ export interface Options<Driver extends IDatabaseDriver = IDatabaseDriver, EM ex
      * @default false
      */
     disableTransactions?: boolean;
+    /**
+     * How `em.setSessionContext()` session variables/role are applied for row level security.
+     * `'transaction'` (default) emits `set_config(..., true)` inside each transaction; `'connection'` applies them on every pooled connection acquire (PostgreSQL only).
+     * @default 'transaction'
+     */
+    sessionContext?: 'transaction' | 'connection';
     /**
      * Enable verbose logging of internal operations.
      * @default false
@@ -840,6 +846,14 @@ export interface Options<Driver extends IDatabaseDriver = IDatabaseDriver, EM ex
          * @default false
          */
         ignoreRoutines?: boolean;
+        /**
+         * Leave row level security policies unmanaged. Declared policies are still created and RLS is still enabled or
+         * forced based on the entity metadata, but existing policies are never dropped or altered and RLS is never
+         * disabled or unforced — use this to protect hand-written policies from being removed when they are not
+         * mirrored in the entity definitions.
+         * @default false
+         */
+        ignorePolicies?: boolean;
         /**
          * Table names or patterns to skip during schema generation.
          * @default []

package/utils/Configuration.js

@@ -7,7 +7,7 @@ import { Utils } from '../utils/Utils.js';
 import { Routine } from '../metadata/Routine.js';
 import { MetadataValidator } from '../metadata/MetadataValidator.js';
 import { MetadataProvider } from '../metadata/MetadataProvider.js';
-import { NotFoundError } from '../errors.js';
+import { MetadataError, NotFoundError, ValidationError } from '../errors.js';
 import { RequestContext } from './RequestContext.js';
 import { DataloaderType, FlushMode, LoadStrategy, PopulateHint } from '../enums.js';
 import { MemoryCacheAdapter } from '../cache/MemoryCacheAdapter.js';
@@ -71,6 +71,7 @@ const DEFAULTS = {
     ensureDatabase: true,
     ensureIndexes: false,
     batchSize: 300,
+    sessionContext: 'transaction',
     debug: false,
     ignoreDeprecations: false,
     verbose: false,
@@ -86,13 +87,15 @@ const DEFAULTS = {
         snapshot: true,
         snapshotOnMigrate: true,
         emit: 'ts',
-        fileName: (timestamp, name) => `Migration${timestamp}${name ? '_' + name : ''}`,
+        // mirrors `NamingStrategy.classToMigrationName`, so the file name matches the class it declares
+        fileName: (timestamp, name) => `Migration${timestamp}${name ? '_' + name.replace(/[^$\p{ID_Continue}]+/gu, '_') : ''}`,
     },
     schemaGenerator: {
         createForeignKeyConstraints: true,
         ignoreSchema: [],
         ignoreTriggers: false,
         ignoreRoutines: false,
+        ignorePolicies: false,
         skipTables: [],
         skipViews: [],
         skipColumns: {},
@@ -392,7 +395,15 @@ export class Configuration {
         }
         this.#options.schema ??= this.#platform.getDefaultSchemaName();
         this.#options.charset ??= this.#platform.getDefaultCharset();
+        // fail closed instead of silently applying no session state on drivers without the reserve hook (e.g. pglite)
+        if (this.#options.sessionContext === 'connection' && !this.#platform.supportsConnectionSessionContext()) {
+            throw ValidationError.connectionSessionContextNotSupported();
+        }
         Object.keys(this.#options.filters).forEach(key => {
+            // global filters have no entity to attach a policy to, so `rls` is only valid on entity-scoped filters
+            if (this.#options.filters[key].rls) {
+                throw MetadataError.rlsFilterMustBeEntityScoped(key);
+            }
             this.#options.filters[key].default ??= true;
         });
         if (!this.#options.filtersOnRelations) {

package/utils/Cursor.d.ts

@@ -61,6 +61,8 @@ export declare class Cursor<Entity extends object, Hint extends string = never,
      * Computes the cursor value for a given entity.
      */
     from(entity: Entity | Loaded<Entity, Hint, Fields, Excludes>): string;
+    /** Serializes a single cursor value, walking nested directions and reading the owner's properties. */
+    private static serialize;
     [Symbol.iterator](): IterableIterator<Loaded<Entity, Hint, Fields, Excludes>>;
     get length(): number;
     /**

package/utils/Cursor.js

@@ -58,6 +58,7 @@ export class Cursor {
     hasPrevPage;
     hasNextPage;
     #definition;
+    #meta;
     constructor(items, totalCount, options, meta) {
         this.items = items;
         this.totalCount = totalCount;
@@ -76,6 +77,7 @@ export class Cursor {
             }
         }
         this.#definition = Cursor.getDefinition(meta, orderBy);
+        this.#meta = meta;
     }
     get startCursor() {
         if (this.items.length === 0) {
@@ -93,37 +95,46 @@ export class Cursor {
      * Computes the cursor value for a given entity.
      */
     from(entity) {
-        const processEntity = (entity, prop, direction, object = false) => {
-            if (Utils.isPlainObject(direction)) {
-                const unwrapped = Reference.unwrapReference(entity[prop]);
-                // Check if the relation is loaded - for nested properties, undefined means not populated
-                if (Utils.isEntity(unwrapped) && !helper(unwrapped).isInitialized()) {
-                    throw CursorError.entityNotPopulated(entity, prop);
-                }
-                return Utils.keys(direction).reduce((o, key) => {
-                    Object.assign(o, processEntity(unwrapped, key, direction[key], true));
-                    return o;
-                }, {});
-            }
-            let value = entity[prop];
-            // Allow null/undefined values in cursor - they will be handled in createCursorCondition
-            // undefined can occur with forceUndefined config option which converts null to undefined
-            if (value == null) {
-                return object ? { [prop]: null } : null;
-            }
-            if (Utils.isEntity(value, true)) {
-                value = helper(value).getPrimaryKey();
-            }
-            if (Utils.isScalarReference(value)) {
-                value = value.unwrap();
+        const value = this.#definition.map(([key, direction]) => Cursor.serialize(this.#meta.properties, entity, key, direction));
+        return Cursor.encode(value);
+    }
+    /** Serializes a single cursor value, walking nested directions and reading the owner's properties. */
+    static serialize(properties, owner, key, direction) {
+        const prop = properties[key];
+        let value = owner[key];
+        if (Utils.isPlainObject(direction)) {
+            const unwrapped = Reference.unwrapReference(value);
+            // for nested properties, an uninitialized relation means not populated
+            if (Utils.isEntity(unwrapped) && !helper(unwrapped).isInitialized()) {
+                throw CursorError.entityNotPopulated(owner, key);
             }
-            if (object) {
-                return { [prop]: value };
+            if (unwrapped == null || typeof unwrapped !== 'object') {
+                return unwrapped;
             }
-            return value;
-        };
-        const value = this.#definition.map(([key, direction]) => processEntity(entity, key, direction));
-        return Cursor.encode(value);
+            const childProps = prop?.kind === ReferenceKind.EMBEDDED ? prop.embeddedProps : prop?.targetMeta?.properties;
+            return Utils.keys(direction).reduce((o, childKey) => {
+                o[childKey] = Cursor.serialize(childProps ?? {}, unwrapped, childKey, direction[childKey]);
+                return o;
+            }, {});
+        }
+        // allow null/undefined values in cursor - they will be handled in createCursorCondition
+        // undefined can occur with forceUndefined config option which converts null to undefined
+        if (value == null) {
+            return null;
+        }
+        if (Utils.isEntity(value, true)) {
+            value = helper(value).getPrimaryKey();
+        }
+        if (Utils.isScalarReference(value)) {
+            value = value.unwrap();
+        }
+        // only types implementing `fromJSON` own their wire format, others keep the raw JS value,
+        // so their cursors stay decodable by the `convertToJSValue` fallback
+        if (prop?.customType?.fromJSON) {
+            // the platform is assigned to the type instance during discovery
+            return prop.customType.toJSON(value, prop.customType.platform);
+        }
+        return value;
     }
     *[Symbol.iterator]() {
         for (const item of this.items) {
@@ -138,24 +149,18 @@ export class Cursor {
      */
     static for(meta, entity, orderBy) {
         const definition = this.getDefinition(meta, orderBy);
-        return Cursor.encode(definition.map(([key]) => {
-            const value = entity[key];
-            if (value === undefined) {
+        return Cursor.encode(definition.map(([key, direction]) => {
+            if (entity[key] === undefined) {
                 throw CursorError.missingValue(meta.className, key);
             }
-            return value;
+            return this.serialize(meta.properties, entity, key, direction);
         }));
     }
     static encode(value) {
         return Buffer.from(JSON.stringify(value)).toString('base64url');
     }
     static decode(value) {
-        return JSON.parse(Buffer.from(value, 'base64url').toString('utf8')).map((value) => {
-            if (typeof value === 'string' && /^\d{4}-\d{2}-\d{2}T\d{2}:\d{2}:\d{2}\.\d{3}/.exec(value)) {
-                return new Date(value);
-            }
-            return value;
-        });
+        return JSON.parse(Buffer.from(value, 'base64url').toString('utf8'));
     }
     static getDefinition(meta, orderBy) {
         return Utils.asArray(orderBy).flatMap(order => {

package/utils/DataloaderUtils.js

@@ -197,7 +197,8 @@ export class DataloaderUtils {
                 const prop = group[0][0].property;
                 const options = {};
                 const wrap = (cond) => ({ [prop.name]: cond });
-                const orderBy = Utils.asArray(group[0][1]?.orderBy).map(o => wrap(o));
+                // `findChildrenFromPivotTable` expects the `orderBy` relative to the target entity, so no wrapping here
+                const orderBy = Utils.asArray(group[0][1]?.orderBy);
                 const populate = wrap(group[0][1]?.populate);
                 const owners = group.map(c => c[0].owner);
                 const $or = [];

package/utils/EntityComparator.d.ts

@@ -80,6 +80,8 @@ export declare class EntityComparator {
     private getGenericComparator;
     private getPropertyComparator;
     private wrap;
+    /** Renders a key as a single-quoted JS string literal, safe to embed in generated code. */
+    private quote;
     private safeKey;
     /**
      * Sets the toArray helper in the context if not already set.

package/utils/EntityComparator.js

@@ -164,7 +164,9 @@ export class EntityComparator {
         const lines = [];
         const context = new Map();
         context.set('isEntityOrRef', (val) => Utils.isEntity(val, true));
-        context.set('getCompositeKeyValue', (val) => Utils.flatten(Utils.getCompositeKeyValue(val, meta, 'convertToDatabaseValue', this.#platform)));
+        context.set('getCompositeKeyValue', (val) => 
+        // deep flatten, nested composite PKs produce nested arrays that would be comma-joined by the hash
+        Utils.flatten(Utils.getCompositeKeyValue(val, meta, 'convertToDatabaseValue', this.#platform), true));
         context.set('getPrimaryKeyHash', (val) => Utils.getPrimaryKeyHash(Utils.asArray(val)));
         if (meta.primaryKeys.length > 1) {
             lines.push(`  const pks = entity.__helper.__pk ? getCompositeKeyValue(entity.__helper.__pk) : [`);
@@ -447,6 +449,7 @@ export class EntityComparator {
         const ret = [];
         const padding = ' '.repeat(level * 2);
         const idx = this.#tmpIndex++;
+        ret.push(`${padding}if (entity${entityKey} === null) ret${dataKey} = null;`);
         ret.push(`${padding}if (Array.isArray(entity${entityKey})) {`);
         ret.push(`${padding}  ret${dataKey} = [];`);
         ret.push(`${padding}  entity${entityKey}.forEach((_, idx_${idx}) => {`);
@@ -584,7 +587,7 @@ export class EntityComparator {
                 }
             }
             else if (prop.polymorphic) {
-                const discriminatorMapKey = `discriminatorMapReverse_${prop.name}`;
+                const discriminatorMapKey = `discriminatorMapReverse_${this.safeKey(prop.name)}`;
                 const reverseMap = new Map();
                 for (const [key, value] of Object.entries(prop.discriminatorMap)) {
                     reverseMap.set(value, key);
@@ -755,10 +758,14 @@ export class EntityComparator {
         return this.getGenericComparator(this.wrap(prop.name), `!equals(last${this.wrap(prop.name)}, current${this.wrap(prop.name)})`);
     }
     wrap(key) {
-        if (/^\[.*]$/.exec(key)) {
+        if (/^\[idx_\d+]$/.exec(key)) {
             return key;
         }
-        return /^\w+$/.exec(key) ? `.${key}` : `['${key}']`;
+        return /^\w+$/.exec(key) ? `.${key}` : `[${this.quote(key)}]`;
+    }
+    /** Renders a key as a single-quoted JS string literal, safe to embed in generated code. */
+    quote(key) {
+        return `'${key.replace(/\\/g, '\\\\').replace(/'/g, "\\'")}'`;
     }
     safeKey(key) {
         return key.replace(/\W/g, '_');

package/utils/QueryHelper.d.ts

@@ -37,9 +37,26 @@ export declare class QueryHelper {
     static inlinePrimaryKeyObjects<T extends object>(where: Dictionary, meta: EntityMetadata<T>, metadata: MetadataStorage, key?: string): boolean;
     static processWhere<T extends object>(options: ProcessWhereOptions<T>): FilterQuery<T>;
     static getActiveFilters<T>(meta: EntityMetadata<T>, options: FilterOptions | undefined, filters: Dictionary<FilterDef>): FilterDef[];
+    /** @internal Sentinel wrapping for arguments accessed while statically resolving an `rls` filter condition. */
+    static readonly RLS_SENTINEL_PREFIX = "__mikro_rls_arg__";
+    /** @internal */
+    static readonly RLS_SENTINEL_SUFFIX = "__";
+    /**
+     * Resolves an `rls` filter's condition to a static `FilterQuery`. Function conditions are called with a proxy `args`
+     * that yields a unique sentinel per accessed argument, real `type`/`entityName` strings (validated to not affect the
+     * result), and a poison proxy or `undefined` for the remaining runtime-only parameters.
+     *
+     * @internal
+     */
+    static resolveRlsFilterCond(filter: FilterDef, accessed: Set<string>, entityName?: string): Dictionary;
     static mergePropertyFilters(propFilters: FilterOptions | undefined, options: FilterOptions | undefined): FilterOptions | undefined;
     static isFilterActive<T>(meta: EntityMetadata<T>, filterName: string, filter: FilterDef, options: Dictionary<boolean | Dictionary>): boolean;
     static processCustomType<T extends object>(prop: EntityProperty<T>, cond: FilterQuery<T>, platform: Platform, key?: string, fromQuery?: boolean): FilterQuery<T>;
+    /**
+     * Composite PK conditions are keyed by a hash of all the PK names, which `findProperty` cannot
+     * resolve, so the custom types have to be applied positionally instead.
+     */
+    private static processCompositeCustomTypes;
     private static isSupportedOperator;
     private static processJsonCondition;
     static findProperty<T>(fieldName: string, options: ProcessWhereOptions<T>): EntityProperty<T> | undefined;