@mikro-orm/core 7.2.0-dev.2 → 7.2.0-dev.21

package/EntityManager.js

@@ -1,4 +1,5 @@
-import { getOnConflictReturningFields, getWhereCondition, resetUntouchedCollections } from './utils/upsert-utils.js';
+import { getOnConflictReturningFields, getOnCreateGeneratedFields, getWhereCondition, resetUntouchedCollections, } from './utils/upsert-utils.js';
+import { computeRemovedRlsVariables, computeRlsFilterVariables, findRlsFilterDefs } from './utils/rls-utils.js';
 import { Utils } from './utils/Utils.js';
 import { Cursor } from './utils/Cursor.js';
 import { QueryHelper } from './utils/QueryHelper.js';
@@ -15,7 +16,7 @@ import { UnitOfWork } from './unit-of-work/UnitOfWork.js';
 import { EventType, FlushMode, LoadStrategy, LockMode, PopulateHint, PopulatePath, QueryFlag, ReferenceKind, SCALAR_TYPES, } from './enums.js';
 import { EventManager } from './events/EventManager.js';
 import { TransactionEventBroadcaster } from './events/TransactionEventBroadcaster.js';
-import { OptimisticLockError, ValidationError } from './errors.js';
+import { MetadataError, OptimisticLockError, ValidationError } from './errors.js';
 import { applyPopulateHints, getLoadingStrategy } from './entity/utils.js';
 import { TransactionManager } from './utils/TransactionManager.js';
 /**
@@ -44,6 +45,7 @@ export class EntityManager {
     #resultCache;
     #filters = {};
     #filterParams = {};
+    #sessionContext;
     loggerContext;
     #transactionContext;
     #disableTransactions;
@@ -116,7 +118,7 @@ export class EntityManager {
             return ret;
         }
         const em = this.getContext();
-        em.prepareOptions(options);
+        options = em.prepareOptions(options);
         const meta = this.metadata.get(entityName);
         em.validateIndexUsage(meta, where, options);
         await em.tryFlush(entityName, options);
@@ -199,7 +201,12 @@ export class EntityManager {
      */
     async *stream(entityName, options = {}) {
         const em = this.getContext();
-        em.prepareOptions(options);
+        // a stream never opens the implicit session-context transaction, so under the 'transaction' strategy the staged
+        // context would silently never apply outside an ambient transaction and other tenants' rows would leak — fail closed
+        if (!options.ctx && !em.#transactionContext && em.getTransactionSessionContext()) {
+            throw ValidationError.sessionContextStreamRequiresTransaction();
+        }
+        options = em.prepareOptions(options);
         options.strategy = 'joined';
         await em.tryFlush(entityName, options);
         const where = (await em.processWhere(entityName, options.where ?? {}, options, 'read'));
@@ -258,8 +265,17 @@ export class EntityManager {
      * Registers global filter to this entity manager. Global filters are enabled by default (unless disabled via last parameter).
      */
     addFilter(options) {
+        options = { ...options };
         if (options.entity) {
-            options.entity = Utils.asArray(options.entity).map(n => Utils.className(n));
+            options.entity = Utils.asArray(options.entity).map(n => Utils.classOrName(n));
+        }
+        // runtime-registered filters are never part of entity metadata, so no policy can be generated for them — whether or
+        // not an `entity` was scoped, `rls` is only valid on filters declared in metadata via `@Filter()`. `rls` is excluded
+        // from the type above so TS users fail at compile time; the runtime guard still covers JS callers using `as any`
+        if (options.rls) {
+            throw options.entity
+                ? MetadataError.rlsFilterCannotBeRegisteredAtRuntime(options.name)
+                : MetadataError.rlsFilterMustBeEntityScoped(options.name);
         }
         options.default ??= true;
         this.getContext(false).#filters[options.name] = options;
@@ -269,7 +285,37 @@ export class EntityManager {
      * If you want to set shared value for all contexts, be sure to use the root entity manager.
      */
     setFilterParams(name, args) {
-        this.getContext().#filterParams[name] = args;
+        const em = this.getContext();
+        // `rls` filters mirror their params as session variables, so the matching DB policies see the same values;
+        // the same filter name can be declared on multiple entities, so stage the union across all `rls`-flagged defs
+        const filters = findRlsFilterDefs(em.metadata, name);
+        if (filters.length === 0) {
+            em.#filterParams[name] = args;
+            return;
+        }
+        // fail before storing the params and pruning stale variables below, so an invalid staging attempt leaves both
+        // the filter params and the session context untouched
+        em.validateSessionContextStaging();
+        const variables = computeRlsFilterVariables(filters, args);
+        const previousArgs = em.#filterParams[name];
+        em.#filterParams[name] = args;
+        // this call replaces the filter's params, so drop the exact variables a previous call for this filter staged but
+        // this one no longer sets (unless another filter's current params still stage them)
+        const staged = em.#sessionContext?.variables;
+        if (staged && previousArgs) {
+            for (const key of computeRemovedRlsVariables(em.metadata, name, filters, previousArgs, variables, em.#filterParams)) {
+                delete staged[key];
+            }
+            // pruning may have emptied the whole context — drop it, so it does not keep forcing the implicit
+            // transaction wrap (and a distinct cache key) while carrying no variables
+            if (Object.keys(staged).length === 0 && !em.#sessionContext.role) {
+                em.#sessionContext = undefined;
+            }
+        }
+        // an empty context would still switch on the implicit transaction wrapping
+        if (Object.keys(variables).length > 0) {
+            em.mergeSessionContext({ variables });
+        }
     }
     /**
      * Returns filter parameters for given filter set in this context.
@@ -277,6 +323,90 @@ export class EntityManager {
     getFilterParams(name) {
         return this.getContext().#filterParams[name];
     }
+    /**
+     * Sets the database session context (row level security) for this entity manager. Session variables are merged
+     * with any previously set ones, while the role is replaced when one is provided. The variables are applied via `set_config()` and are
+     * typically referenced by RLS policies through `current_setting()`.
+     */
+    setSessionContext(context) {
+        // validate the global context like `setFilterParams` — a tenant context set on the global EM
+        // would be silently inherited by every later fork
+        this.getContext().mergeSessionContext(context);
+    }
+    validateSessionContextStaging() {
+        if (!this.getPlatform().supportsRowLevelSecurity()) {
+            throw ValidationError.sessionContextNotSupported();
+        }
+        // staging inside an open transaction is inert under both strategies (the 'transaction' context is only emitted at
+        // top-level begin; the 'connection' context was applied when the pinned connection was reserved), while
+        // `getSessionContext()` would still claim it is set — fail closed regardless of strategy
+        if (this.#transactionContext) {
+            throw ValidationError.sessionContextInsideTransaction();
+        }
+        if (this.config.get('sessionContext') === 'transaction') {
+            // the context is applied on transaction begin, so without implicit transactions writes run untransacted and
+            // silently bypass the policies — fail closed instead of leaking a base-role write
+            if (this.config.get('implicitTransactions') === false) {
+                throw ValidationError.sessionContextRequiresImplicitTransactions();
+            }
+            // same rationale for disabled transactions (config or fork option): the UoW flush would run untransacted
+            // and skip the context while reads still get the per-statement wrap — fail closed on the asymmetry
+            if (this.#disableTransactions) {
+                throw ValidationError.sessionContextWithDisabledTransactions();
+            }
+        }
+    }
+    /** Merges into this exact instance — `fork()` must bypass context resolution to target the new fork. */
+    mergeSessionContext(context) {
+        this.validateSessionContextStaging();
+        const current = this.#sessionContext;
+        const merged = {
+            variables: { ...current?.variables, ...context.variables },
+            role: context.role ?? current?.role,
+        };
+        // normalize an empty context away — it would still force the implicit transaction wrap and a distinct cache key
+        this.#sessionContext = Object.keys(merged.variables).length > 0 || merged.role ? merged : undefined;
+    }
+    /**
+     * Returns the database session context (row level security) set for this entity manager, or `undefined` if none.
+     */
+    getSessionContext() {
+        return this.getContext(false).#sessionContext;
+    }
+    /**
+     * Clears the database session context, since `setSessionContext()` only ever merges variables and updates the role.
+     */
+    clearSessionContext() {
+        const em = this.getContext(false);
+        // clearing inside an open transaction would be as inert (and cache-poisoning) as staging there — fail closed too,
+        // under both strategies (the 'connection' pinned connection was already reserved with the previous context)
+        if (em.#sessionContext && em.#transactionContext) {
+            throw ValidationError.sessionContextInsideTransaction('clear');
+        }
+        em.#sessionContext = undefined;
+    }
+    /** @internal session context to apply on `begin()` under the `'transaction'` strategy (`undefined` otherwise). */
+    getTransactionSessionContext() {
+        const em = this.getContext(false);
+        if (!em.#sessionContext || em.config.get('sessionContext') !== 'transaction') {
+            return undefined;
+        }
+        return em.#sessionContext;
+    }
+    /**
+     * Wraps a driver call in a short implicit transaction when the session context needs to apply, so `set local`
+     * takes effect. Resolves to a plain call when already inside a transaction or when no session context is set.
+     *
+     * @internal
+     */
+    async withSessionContext(ctx, cb) {
+        const em = this.getContext(false);
+        const sessionContext = ctx ? undefined : em.getTransactionSessionContext();
+        if (!sessionContext) {
+            return cb(ctx);
+        }
+        return em.getConnection('write').transactional(trx => cb(trx), { sessionContext, loggerContext: em.loggerContext });
+    }
     /**
      * Sets logger context for this entity manager.
      */
@@ -382,6 +512,7 @@ export class EntityManager {
                 filters,
                 populate: hint.children,
                 populateWhere: PopulateHint.ALL,
+                populateFilter: undefined,
             });
             if (Utils.hasObjectKeys(where)) {
                 ret[field] = ret[field] ? { $and: [where, ret[field]] } : where;
@@ -528,7 +659,7 @@ export class EntityManager {
     async findAndCount(entityName, where, options = {}) {
         const em = this.getContext(false);
         await em.tryFlush(entityName, options);
-        options.flushMode = 'commit'; // do not try to auto flush again
+        options = { ...options, flushMode: 'commit' }; // do not try to auto flush again
         return Promise.all([
             em.find(entityName, where, options),
             em.count(entityName, where, options),
@@ -592,6 +723,7 @@ export class EntityManager {
      */
     async findByCursor(entityName, options) {
         const em = this.getContext(false);
+        options = { ...options };
         options.overfetch ??= true;
         options.where ??= {};
         if (Utils.isEmpty(options.orderBy) && !Raw.hasObjectFragments(options.orderBy)) {
@@ -610,10 +742,10 @@ export class EntityManager {
     async refreshOrFail(entity, options = {}) {
         const ret = await this.refresh(entity, options);
         if (!ret) {
-            options.failHandler ??= this.config.get('findOneOrFailHandler');
+            const failHandler = options.failHandler ?? this.config.get('findOneOrFailHandler');
             const wrapped = helper(entity);
             const where = wrapped.getPrimaryKey();
-            throw options.failHandler(wrapped.__meta.className, where);
+            throw failHandler(wrapped.__meta.className, where);
         }
         return ret;
     }
@@ -667,7 +799,7 @@ export class EntityManager {
             return ret;
         }
         const em = this.getContext();
-        em.prepareOptions(options);
+        options = em.prepareOptions(options);
         let entity = em.#unitOfWork.tryGetById(entityName, where, options.schema);
         // query for a not managed entity which is already in the identity map as it
         // was provided with a PK this entity does not exist in the db, there can't
@@ -739,11 +871,11 @@ export class EntityManager {
         }
         if (!entity || isStrictViolation) {
             const key = options.strict ? 'findExactlyOneOrFailHandler' : 'findOneOrFailHandler';
-            options.failHandler ??= this.config.get(key);
+            const failHandler = options.failHandler ?? this.config.get(key);
             const name = Utils.className(entityName);
             /* v8 ignore next */
             where = Utils.isEntity(where) ? helper(where).getPrimaryKey() : where;
-            throw options.failHandler(name, where);
+            throw failHandler(name, where);
         }
         return entity;
     }
@@ -778,7 +910,7 @@ export class EntityManager {
             return ret;
         }
         const em = this.getContext(false);
-        em.prepareOptions(options);
+        options = em.prepareOptions(options);
         let entityName;
         let where;
         let entity = null;
@@ -791,6 +923,7 @@ export class EntityManager {
         }
         const meta = this.metadata.get(entityName);
         const convertCustomTypes = !Utils.isEntity(data);
+        let generatedFields = [];
         if (Utils.isEntity(data)) {
             entity = data;
             if (helper(entity).__managed && helper(entity).__em === em && !this.config.get('upsertManaged')) {
@@ -798,6 +931,7 @@ export class EntityManager {
                 return entity;
             }
             where = helper(entity).getPrimaryKey();
+            generatedFields = getOnCreateGeneratedFields(meta, entity);
             em.#entityFactory.assignDefaultValues(entity, meta);
             data = em.#comparator.prepareEntity(entity);
         }
@@ -810,6 +944,7 @@ export class EntityManager {
                     return em.assign(exists, data);
                 }
             }
+            generatedFields = getOnCreateGeneratedFields(meta, data);
             em.#entityFactory.assignDefaultValues(data, meta, true);
             for (const key of Object.keys(data)) {
                 const prop = meta.properties[key];
@@ -818,6 +953,10 @@ export class EntityManager {
                 }
             }
         }
+        // `onCreate` generated values are for the insert clause only, they must not overwrite an existing row
+        if (generatedFields.length > 0 && !options.onConflictMergeFields) {
+            options.onConflictExcludeFields = [...(options.onConflictExcludeFields ?? []), ...generatedFields];
+        }
         where = getWhereCondition(meta, options.onConflictFields, data, where).where;
         data = QueryHelper.processObjectParams(data);
         validateParams(data, 'insert data');
@@ -827,12 +966,12 @@ export class EntityManager {
                 data = em.#comparator.prepareEntity(entity);
             }
         }
-        const ret = await em.driver.nativeUpdate(entityName, where, data, {
-            ctx: em.#transactionContext,
+        const ret = await em.withSessionContext(options.ctx ?? em.#transactionContext, ctx => em.driver.nativeUpdate(entityName, where, data, {
             upsert: true,
             convertCustomTypes,
             ...options,
-        });
+            ctx,
+        }));
         em.#unitOfWork.getChangeSetPersister().mapReturnedValues(entity, data, ret.row, meta, true);
         entity ??= em.#entityFactory.create(entityName, data, {
             refresh: true,
@@ -864,13 +1003,13 @@ export class EntityManager {
                     where[meta.primaryKeys[0]] = ret.insertId;
                 }
             }
-            const data2 = await this.driver.findOne(meta.class, where, {
+            const data2 = await em.withSessionContext(options.ctx ?? em.#transactionContext, ctx => this.driver.findOne(meta.class, where, {
                 fields: returning.concat(...(options.onConflictMergeFields ?? [])),
-                ctx: em.#transactionContext,
+                ctx,
                 convertCustomTypes: true,
                 connectionType: 'write',
                 schema: options.schema,
-            });
+            }));
             em.getHydrator().hydrate(entity, meta, data2, em.#entityFactory, 'full', false, true);
         }
         // recompute the data as there might be some values missing (e.g. those with db column defaults)
@@ -916,7 +1055,7 @@ export class EntityManager {
             return ret;
         }
         const em = this.getContext(false);
-        em.prepareOptions(options);
+        options = em.prepareOptions(options);
         let entityName;
         let propIndex;
         if (data === undefined) {
@@ -937,6 +1076,7 @@ export class EntityManager {
         }
         const meta = this.metadata.get(entityName);
         const convertCustomTypes = !Utils.isEntity(data[0]);
+        const generatedFields = new Set();
         const allData = [];
         const allWhere = [];
         const entities = new Map();
@@ -954,6 +1094,7 @@ export class EntityManager {
                     continue;
                 }
                 where = helper(entity).getPrimaryKey();
+                getOnCreateGeneratedFields(meta, entity).forEach(field => generatedFields.add(field));
                 em.#entityFactory.assignDefaultValues(entity, meta);
                 entitiesByAllDataIdx.set(allData.length, entity);
                 row = em.#comparator.prepareEntity(entity);
@@ -970,6 +1111,7 @@ export class EntityManager {
                         continue;
                     }
                 }
+                getOnCreateGeneratedFields(meta, row).forEach(field => generatedFields.add(field));
                 em.#entityFactory.assignDefaultValues(row, meta, true);
                 for (const key of Object.keys(row)) {
                     const prop = meta.properties[key];
@@ -998,6 +1140,10 @@ export class EntityManager {
         if (entities.size === data.length) {
             return [...entities.keys()];
         }
+        // `onCreate` generated values are for the insert clause only, they must not overwrite existing rows
+        if (generatedFields.size > 0 && !options.onConflictMergeFields) {
+            options.onConflictExcludeFields = [...(options.onConflictExcludeFields ?? []), ...generatedFields];
+        }
         if (em.eventManager.hasListeners(EventType.beforeUpsert, meta)) {
             for (const dto of data) {
                 const entity = entitiesByData.get(dto) ?? dto;
@@ -1007,12 +1153,12 @@ export class EntityManager {
                 allData[idx] = em.#comparator.prepareEntity(entity);
             }
         }
-        const res = await em.driver.nativeUpdateMany(entityName, allWhere, allData, {
-            ctx: em.#transactionContext,
+        const res = await em.withSessionContext(options.ctx ?? em.#transactionContext, ctx => em.driver.nativeUpdateMany(entityName, allWhere, allData, {
             upsert: true,
             convertCustomTypes,
             ...options,
-        });
+            ctx,
+        }));
         entities.clear();
         entitiesByData.clear();
         const loadPK = new Map();
@@ -1055,16 +1201,16 @@ export class EntityManager {
                     where.$or[idx][prop] = item[prop];
                 });
             });
-            const data2 = await this.driver.find(meta.class, where, {
+            const data2 = await em.withSessionContext(options.ctx ?? em.#transactionContext, ctx => this.driver.find(meta.class, where, {
                 fields: returning
                     .concat(...add)
                     .concat(...(Array.isArray(uniqueFields) ? uniqueFields : []))
                     .concat(...(options.onConflictMergeFields ?? [])),
-                ctx: em.#transactionContext,
+                ctx,
                 convertCustomTypes: true,
                 connectionType: 'write',
                 schema: options.schema,
-            });
+            }));
             for (const [entity, cond] of loadPK.entries()) {
                 const row = data2.find(row => {
                     const tmp = {};
@@ -1162,6 +1308,7 @@ export class EntityManager {
         }
         const em = this.getContext(false);
         em.#transactionContext = await em.getConnection('write').begin({
+            sessionContext: em.getTransactionSessionContext(),
             ...options,
             eventBroadcaster: new TransactionEventBroadcaster(em, { topLevelTransaction: !options.ctx }),
         });
@@ -1202,7 +1349,7 @@ export class EntityManager {
      */
     async lock(entity, lockMode, options = {}) {
         options = Utils.isPlainObject(options) ? options : { lockVersion: options };
-        this.getContext(false).prepareOptions(options);
+        options = this.getContext(false).prepareOptions(options);
         await this.getUnitOfWork().lock(entity, { lockMode, ...options });
     }
     /**
@@ -1210,7 +1357,7 @@ export class EntityManager {
      */
     async insert(entityNameOrEntity, data, options = {}) {
         const em = this.getContext(false);
-        em.prepareOptions(options);
+        options = em.prepareOptions(options);
         let entityName;
         if (data === undefined) {
             entityName = entityNameOrEntity.constructor;
@@ -1229,15 +1376,12 @@ export class EntityManager {
             const meta = helper(data).__meta;
             const payload = em.#comparator.prepareEntity(data);
             const cs = new ChangeSet(data, ChangeSetType.CREATE, payload, meta);
-            await em.#unitOfWork.getChangeSetPersister().executeInserts([cs], { ctx: em.#transactionContext, ...options });
+            await em.withSessionContext(options.ctx ?? em.#transactionContext, ctx => em.#unitOfWork.getChangeSetPersister().executeInserts([cs], { ...options, ctx }));
             return cs.getPrimaryKey();
         }
         data = QueryHelper.processObjectParams(data);
         validateParams(data, 'insert data');
-        const res = await em.driver.nativeInsert(entityName, data, {
-            ctx: em.#transactionContext,
-            ...options,
-        });
+        const res = await em.withSessionContext(options.ctx ?? em.#transactionContext, ctx => em.driver.nativeInsert(entityName, data, { ...options, ctx }));
         return res.insertId;
     }
     /**
@@ -1277,12 +1421,9 @@ export class EntityManager {
             overrides = overridesOrOptions;
         }
         options ??= {};
-        em.prepareOptions(options);
+        options = em.prepareOptions(options);
         const meta = em.metadata.get(entityName);
-        const res = await em.driver.nativeClone(entityName, where, overrides, {
-            ctx: em.#transactionContext,
-            ...options,
-        });
+        const res = await em.withSessionContext(options.ctx ?? em.#transactionContext, ctx => em.driver.nativeClone(entityName, where, overrides, { ...options, ctx }));
         const pk = res.insertId ?? res.row?.[meta.primaryKeys[0]];
         return em.findOneOrFail(entityName, pk, {
             schema: options.schema,
@@ -1293,7 +1434,7 @@ export class EntityManager {
      */
     async insertMany(entityNameOrEntities, data, options = {}) {
         const em = this.getContext(false);
-        em.prepareOptions(options);
+        options = em.prepareOptions(options);
         let entityName;
         if (data === undefined) {
             entityName = entityNameOrEntities[0].constructor;
@@ -1317,15 +1458,12 @@ export class EntityManager {
                 const payload = em.#comparator.prepareEntity(row);
                 return new ChangeSet(row, ChangeSetType.CREATE, payload, meta);
             });
-            await em.#unitOfWork.getChangeSetPersister().executeInserts(css, { ctx: em.#transactionContext, ...options });
+            await em.withSessionContext(options.ctx ?? em.#transactionContext, ctx => em.#unitOfWork.getChangeSetPersister().executeInserts(css, { ...options, ctx }));
             return css.map(cs => cs.getPrimaryKey());
         }
         data = data.map(row => QueryHelper.processObjectParams(row));
         data.forEach(row => validateParams(row, 'insert data'));
-        const res = await em.driver.nativeInsertMany(entityName, data, {
-            ctx: em.#transactionContext,
-            ...options,
-        });
+        const res = await em.withSessionContext(options.ctx ?? em.#transactionContext, ctx => em.driver.nativeInsertMany(entityName, data, { ...options, ctx }));
         if (res.insertedIds) {
             return res.insertedIds;
         }
@@ -1336,17 +1474,17 @@ export class EntityManager {
      */
     async nativeUpdate(entityName, where, data, options = {}) {
         const em = this.getContext(false);
-        em.prepareOptions(options);
+        options = em.prepareOptions(options);
         await em.processUnionWhere(entityName, options, 'update');
         data = QueryHelper.processObjectParams(data);
         where = await em.processWhere(entityName, where, { ...options, convertCustomTypes: false }, 'update');
         validateParams(data, 'update data');
         validateParams(where, 'update condition');
-        const res = await em.driver.nativeUpdate(entityName, where, data, {
-            ctx: em.#transactionContext,
+        const res = await em.withSessionContext(options.ctx ?? em.#transactionContext, ctx => em.driver.nativeUpdate(entityName, where, data, {
             em,
             ...options,
-        });
+            ctx,
+        }));
         return res.affectedRows;
     }
     /**
@@ -1378,29 +1516,37 @@ export class EntityManager {
             throw new Error(`Routine '${routine.name}' is not registered in the 'routines' config option.`);
         }
         const conn = em.driver.getConnection('write');
-        return conn.callRoutine(routine, args, em.#transactionContext);
+        return em.withSessionContext(em.#transactionContext, ctx => conn.callRoutine(routine, args, ctx));
     }
     /**
      * Fires native delete query. Calling this has no side effects on the context (identity map).
      */
     async nativeDelete(entityName, where, options = {}) {
         const em = this.getContext(false);
-        em.prepareOptions(options);
+        options = em.prepareOptions(options);
         await em.processUnionWhere(entityName, options, 'delete');
         where = (await em.processWhere(entityName, where, options, 'delete'));
         validateParams(where, 'delete condition');
-        const res = await em.driver.nativeDelete(entityName, where, {
-            ctx: em.#transactionContext,
+        const res = await em.withSessionContext(options.ctx ?? em.#transactionContext, ctx => em.driver.nativeDelete(entityName, where, {
             em,
             ...options,
-        });
+            ctx,
+        }));
         return res.affectedRows;
     }
     /**
-     * Maps raw database result to an entity and merges it to this EntityManager.
+     * Maps raw database result to an entity and merges it to this EntityManager by default.
+     * Use `disableIdentityMap` to return an isolated entity without affecting the current context.
      */
     map(entityName, result, options = {}) {
-        const { mapped, ...rest } = options;
+        if (options.disableIdentityMap ?? this.config.get('disableIdentityMap')) {
+            const em = this.getContext(false);
+            const fork = em.fork({ keepTransactionContext: true });
+            const ret = fork.map(entityName, result, { ...options, disableIdentityMap: false });
+            fork.clear();
+            return ret;
+        }
+        const { mapped, disableIdentityMap, ...rest } = options;
         const meta = this.metadata.get(entityName);
         const data = (mapped ? result : this.driver.mapResult(result, meta));
         for (const k of Object.keys(data)) {
@@ -1428,6 +1574,7 @@ export class EntityManager {
             return this.merge(entityName.constructor, entityName, data);
         }
         const em = options.disableContextResolution ? this : this.getContext();
+        options = { ...options };
         options.schema ??= em.#schema;
         options.validate ??= true;
         options.cascade ??= true;
@@ -1461,6 +1608,7 @@ export class EntityManager {
      */
     create(entityName, data, options = {}) {
         const em = this.getContext();
+        options = { ...options };
         options.schema ??= em.#schema;
         const entity = em.#entityFactory.create(entityName, data, {
             ...options,
@@ -1484,6 +1632,7 @@ export class EntityManager {
      * Gets a reference to the entity identified by the given type and identifier without actually loading it, if the entity is not yet loaded
      */
     getReference(entityName, id, options = {}) {
+        options = { ...options };
         options.schema ??= this.schema;
         options.convertCustomTypes ??= false;
         const meta = this.metadata.get(entityName);
@@ -1504,13 +1653,10 @@ export class EntityManager {
      */
     async count(entityName, where = {}, options = {}) {
         const em = this.getContext(false);
-        // Shallow copy options since the object will be modified when deleting orderBy
-        options = { ...options };
-        em.prepareOptions(options);
+        options = em.prepareOptions(options);
         await em.tryFlush(entityName, options);
         where = await em.processWhere(entityName, where, options, 'read');
         options.populate = (await em.preparePopulate(entityName, options));
-        options = { ...options };
         // save the original hint value so we know it was infer/all
         const meta = em.metadata.find(entityName);
         options._populateWhere = options.populateWhere ?? this.config.get('populateWhere');
@@ -1524,7 +1670,7 @@ export class EntityManager {
         if (cached?.data !== undefined) {
             return cached.data;
         }
-        const count = await em.driver.count(entityName, where, { ctx: em.#transactionContext, em, ...options });
+        const count = await em.withSessionContext(options.ctx ?? em.#transactionContext, ctx => em.driver.count(entityName, where, { em, ...options, ctx }));
         await em.storeCache(options.cache, cached, () => +count);
         return +count;
     }
@@ -1639,8 +1785,9 @@ export class EntityManager {
         }
         // For TPT inheritance, check the entity's own properties, not just the root's
         // For STI, meta.properties includes all properties anyway
-        const ret = p in meta.properties;
-        if (parts.length > 0) {
+        // use an own-property check so inherited `Object.prototype` members (e.g. `__proto__`, `constructor`) are not treated as populatable
+        const ret = Object.hasOwn(meta.properties, p);
+        if (ret && parts.length > 0) {
             return this.canPopulate(meta.properties[p].targetMeta.class, parts.join('.'));
         }
         return ret;
@@ -1654,7 +1801,7 @@ export class EntityManager {
             return entities;
         }
         const em = this.getContext();
-        em.prepareOptions(options);
+        options = em.prepareOptions(options);
         const entityName = arr[0].constructor;
         const preparedPopulate = await em.preparePopulate(entityName, { populate: populate, filters: options.filters, populateHints: options.populateHints }, options.validate);
         await em.#entityLoader.populate(entityName, arr, preparedPopulate, options);
@@ -1665,6 +1812,7 @@ export class EntityManager {
      */
     fork(options = {}) {
         const em = options.disableContextResolution ? this : this.getContext(false);
+        options = { ...options };
         options.clear ??= true;
         options.useContext ??= false;
         options.freshEventManager ??= false;
@@ -1687,6 +1835,18 @@ export class EntityManager {
         }
         fork.#filters = { ...em.#filters };
         fork.#filterParams = Utils.copy(em.#filterParams);
+        if (options.session) {
+            // the fork's session replaces the parent context, but the copied `rls` filter params must stay consistent with
+            // it — re-stage their variables underneath the explicit `session.variables`, which win on any conflict
+            const variables = {};
+            for (const name of Object.keys(fork.#filterParams)) {
+                Object.assign(variables, computeRlsFilterVariables(findRlsFilterDefs(fork.metadata, name), fork.#filterParams[name]));
+            }
+            fork.mergeSessionContext({ ...options.session, variables: { ...variables, ...options.session.variables } });
+        }
+        else if (em.#sessionContext) {
+            fork.#sessionContext = Utils.copy(em.#sessionContext);
+        }
         fork.loggerContext = Utils.merge({}, em.loggerContext, options.loggerContext);
         fork.#schema = options.schema ?? em.#schema;
         fork.signal = options.signal ?? em.signal;
@@ -2073,10 +2233,13 @@ export class EntityManager {
         if (!Utils.isEmpty(options.fields) && !Utils.isEmpty(options.exclude)) {
             throw new ValidationError(`Cannot combine 'fields' and 'exclude' option.`);
         }
-        options.schema ??= this.#schema;
-        options.signal ??= this.signal;
-        options.inflightQueryAbortStrategy ??= this.inflightQueryAbortStrategy;
-        options.logging = options.loggerContext = Utils.merge({ id: this.id }, this.loggerContext, options.loggerContext, options.logging);
+        // the options object belongs to the caller, everything below works on our own copy
+        const opts = { ...options };
+        opts.schema ??= this.#schema;
+        opts.signal ??= this.signal;
+        opts.inflightQueryAbortStrategy ??= this.inflightQueryAbortStrategy;
+        opts.logging = opts.loggerContext = Utils.merge({ id: this.id }, this.loggerContext, opts.loggerContext, opts.logging);
+        return opts;
     }
     /**
      * @internal
@@ -2095,7 +2258,19 @@ export class EntityManager {
         ]) {
             delete opts[k];
         }
-        return [Utils.className(entityName), method, opts, where];
+        // the table name (plus discriminator value for STI) is stable across builds and processes,
+        // unlike class names, which minifiers can mangle to the same short name for two entities
+        const meta = this.metadata.find(entityName);
+        const entityKey = meta?.tableName
+            ? [meta.schema, meta.tableName, meta.discriminatorValue]
+            : Utils.className(entityName);
+        const key = [entityKey, method, opts, where];
+        // session context (row level security) scopes cached rows per tenant/role, avoiding cross-context serves
+        const sessionContext = this.getContext(false).#sessionContext;
+        if (sessionContext) {
+            key.push(sessionContext);
+        }
+        return key;
     }
     /**
      * @internal
@@ -2106,7 +2281,13 @@ export class EntityManager {
             return undefined;
         }
         const em = this.getContext();
-        const cacheKey = Array.isArray(config) ? config[0] : JSON.stringify(key);
+        // a named cache key (`config[0]`) discards the computed `key`, which already carries the session context — so
+        // scope it here too, otherwise a fork's rows would be served to another session context under the same name
+        const cacheKey = Array.isArray(config)
+            ? em.#sessionContext
+                ? `${config[0]}|${JSON.stringify(em.#sessionContext)}`
+                : config[0]
+            : JSON.stringify(key);
         const cached = await em.#resultCache.get(cacheKey);
         if (!cached) {
             return { key: cacheKey, data: cached };
@@ -2154,7 +2335,12 @@ export class EntityManager {
      * ```
      */
     async clearCache(cacheKey) {
-        await this.getContext().#resultCache.remove(cacheKey);
+        const em = this.getContext();
+        await em.#resultCache.remove(cacheKey);
+        // named keys are scoped by the session context (see `tryCache`), so clear this context's variant too
+        if (em.#sessionContext) {
+            await em.#resultCache.remove(`${cacheKey}|${JSON.stringify(em.#sessionContext)}`);
+        }
     }
     /**
      * Returns the default schema of this EntityManager. Respects the context, so global EM will give you the contextual schema