@open-mercato/shared 0.6.5-develop.5048.1.fd82f4ae17 → 0.6.5-develop.5099.1.85c0aff78c

package/src/lib/query/__tests__/resolve-registered-entity-table.test.ts

@@ -0,0 +1,83 @@
+import {
+  resolveRegisteredEntityTableName,
+  resolveEntityTableName,
+  isValidEntityIdShape,
+  ENTITY_ID_PATTERN,
+} from '../engine'
+
+function makeEm(metaByClass: Record<string, string>) {
+  const all = Object.entries(metaByClass).map(([className, tableName]) => ({ className, tableName }))
+  return {
+    getMetadata: () => ({
+      find: (className: string) => {
+        const tableName = metaByClass[className]
+        return tableName ? { tableName } : undefined
+      },
+      getAll: () => all,
+    }),
+  } as any
+}
+
+describe('resolveRegisteredEntityTableName', () => {
+  it('resolves a registered entity via class-name metadata', () => {
+    const em = makeEm({ Todo: 'todos' })
+    expect(resolveRegisteredEntityTableName(em, 'example:todo')).toBe('todos')
+  })
+
+  it('resolves a registered entity via the secondary table-name lookup', () => {
+    const em = makeEm({ SomeOtherClass: 'directory_organizations' })
+    expect(resolveRegisteredEntityTableName(em, 'directory:organization')).toBe('directory_organizations')
+  })
+
+  it('returns null for an entity type that does not map to any registered metadata', () => {
+    const em = makeEm({ Todo: 'todos' })
+    expect(resolveRegisteredEntityTableName(em, 'foo:auth_user')).toBeNull()
+    expect(resolveRegisteredEntityTableName(em, 'foo:user')).toBeNull()
+  })
+
+  it('returns null when no metadata is available', () => {
+    expect(resolveRegisteredEntityTableName(undefined, 'example:todo')).toBeNull()
+    expect(resolveRegisteredEntityTableName({} as any, 'example:todo')).toBeNull()
+  })
+
+  it('never pluralizes attacker-chosen ids into a real table name', () => {
+    const em = makeEm({})
+    expect(resolveRegisteredEntityTableName(em, 'foo:auth_user')).toBeNull()
+    expect(resolveRegisteredEntityTableName(em, 'foo:user')).toBeNull()
+  })
+})
+
+describe('resolveEntityTableName fallback (broad query path)', () => {
+  it('still falls back to a pluralized guess for unregistered ids', () => {
+    const warnSpy = jest.spyOn(console, 'warn').mockImplementation(() => {})
+    try {
+      const em = makeEm({})
+      expect(resolveEntityTableName(em, 'foo:never_registered_widget')).toBe('never_registered_widgets')
+    } finally {
+      warnSpy.mockRestore()
+    }
+  })
+})
+
+describe('isValidEntityIdShape', () => {
+  it('accepts canonical module:entity ids', () => {
+    expect(isValidEntityIdShape('example:todo')).toBe(true)
+    expect(isValidEntityIdShape('directory:organization')).toBe(true)
+    expect(isValidEntityIdShape('query_index:search_token')).toBe(true)
+  })
+
+  it('rejects ids without exactly two snake_case segments', () => {
+    expect(isValidEntityIdShape('todos')).toBe(false)
+    expect(isValidEntityIdShape('auth_users')).toBe(false)
+    expect(isValidEntityIdShape('foo:bar:baz')).toBe(false)
+    expect(isValidEntityIdShape('Foo:Bar')).toBe(false)
+    expect(isValidEntityIdShape('1bad:entity')).toBe(false)
+    expect(isValidEntityIdShape('foo:')).toBe(false)
+    expect(isValidEntityIdShape(':bar')).toBe(false)
+    expect(isValidEntityIdShape('foo bar:baz')).toBe(false)
+  })
+
+  it('exposes the pattern for schema reuse', () => {
+    expect(ENTITY_ID_PATTERN.test('example:todo')).toBe(true)
+  })
+})

package/src/lib/query/engine.ts

@@ -42,6 +42,15 @@ type ResolvedCustomFieldSource = {
 
 type ResultRow = Record<string, unknown>
 
+/**
+ * Canonical `module:entity` entity-id shape (both segments snake_case,
+ * starting with a lowercase letter). Used to validate caller-supplied entity
+ * ids at security-sensitive boundaries before they reach table resolution.
+ */
+export const ENTITY_ID_PATTERN = /^[a-z][a-z0-9_]*:[a-z][a-z0-9_]*$/
+
+export const isValidEntityIdShape = (value: string): boolean => ENTITY_ID_PATTERN.test(value)
+
 const pluralizeBaseName = (name: string): string => {
   if (!name) return name
   if (name.endsWith('s')) return name
@@ -65,46 +74,66 @@ const candidateClassNames = (rawName: string): string[] => {
   return Array.from(candidates)
 }
 
-export function resolveEntityTableName(em: EntityManager | undefined, entity: EntityId): string {
-  if (entityTableCache.has(entity)) {
-    return entityTableCache.get(entity)!
-  }
+/**
+ * Resolve an entity id to a table name strictly via registered MikroORM metadata.
+ *
+ * Unlike {@link resolveEntityTableName}, this never falls back to a pluralized
+ * guess: it returns `null` when no registered entity matches. Use it for
+ * security-sensitive call sites (e.g. the reindexer) that must refuse to read
+ * arbitrary, attacker-chosen tables that happen to exist in the schema.
+ */
+export function resolveRegisteredEntityTableName(
+  em: EntityManager | undefined,
+  entity: EntityId,
+): string | null {
   const parts = String(entity || '').split(':')
   const rawName = (parts[1] && parts[1].trim().length > 0) ? parts[1] : (parts[0] || '').trim()
   const metadata = (em as any)?.getMetadata?.()
 
-  if (metadata && rawName) {
-    const candidates = candidateClassNames(rawName)
-    for (const candidate of candidates) {
-      try {
-        const meta = metadata.find?.(candidate)
-        if (meta?.tableName) {
-          const tableName = String(meta.tableName)
-          entityTableCache.set(entity, tableName)
-          return tableName
-        }
-      } catch {}
-    }
+  if (!metadata || !rawName) return null
 
-    // Secondary lookup: search ORM metadata by candidate table names
-    const modulePrefix = parts[0] ?? ''
-    const candidateTables = [
-      `${modulePrefix}_${rawName}`,
-      pluralizeBaseName(rawName),
-      `${modulePrefix}_${pluralizeBaseName(rawName)}`,
-    ]
+  const candidates = candidateClassNames(rawName)
+  for (const candidate of candidates) {
     try {
-      const allMeta: any[] = metadata.getAll?.() ?? []
-      for (const meta of allMeta) {
-        if (meta?.tableName && candidateTables.includes(String(meta.tableName))) {
-          const tableName = String(meta.tableName)
-          entityTableCache.set(entity, tableName)
-          return tableName
-        }
+      const meta = metadata.find?.(candidate)
+      if (meta?.tableName) {
+        return String(meta.tableName)
       }
     } catch {}
   }
 
+  // Secondary lookup: search ORM metadata by candidate table names
+  const modulePrefix = parts[0] ?? ''
+  const candidateTables = [
+    `${modulePrefix}_${rawName}`,
+    pluralizeBaseName(rawName),
+    `${modulePrefix}_${pluralizeBaseName(rawName)}`,
+  ]
+  try {
+    const allMeta: any[] = metadata.getAll?.() ?? []
+    for (const meta of allMeta) {
+      if (meta?.tableName && candidateTables.includes(String(meta.tableName))) {
+        return String(meta.tableName)
+      }
+    }
+  } catch {}
+
+  return null
+}
+
+export function resolveEntityTableName(em: EntityManager | undefined, entity: EntityId): string {
+  if (entityTableCache.has(entity)) {
+    return entityTableCache.get(entity)!
+  }
+  const parts = String(entity || '').split(':')
+  const rawName = (parts[1] && parts[1].trim().length > 0) ? parts[1] : (parts[0] || '').trim()
+
+  const registered = resolveRegisteredEntityTableName(em, entity)
+  if (registered) {
+    entityTableCache.set(entity, registered)
+    return registered
+  }
+
   const fallback = pluralizeBaseName(rawName || '')
   console.warn(
     `[QueryEngine] Could not resolve entity "${entity}" via ORM metadata. ` +

package/src/modules/vector.ts

@@ -1,5 +1,6 @@
 import type { EntityId } from './entities'
 import type { QueryEngine } from '../lib/query/types'
+import type { SearchFieldPolicy } from './search'
 
 export type VectorDriverId = 'pgvector' | 'qdrant' | 'chromadb'
 
@@ -71,6 +72,12 @@ export type VectorEntityConfig = {
    * Provide extra deep links rendered next to the search result.
    */
   resolveLinks?: (ctx: VectorBuildContext) => Promise<VectorLinkDescriptor[] | null> | VectorLinkDescriptor[] | null
+  /**
+   * Controls which record/custom fields are eligible for the default embedding source builder.
+   * Applied only when `buildSource` is not provided. `excluded`/`hashOnly` fields are never embedded;
+   * when `searchable` is defined it acts as an allowlist for both record and custom fields.
+   */
+  fieldPolicy?: SearchFieldPolicy
 }
 
 export type VectorModuleConfig = {