fix: finalize schema dsl runtime hardening

Author: rockyshi1993

scripts/build-p1.cjs

@@ -47,6 +47,9 @@ async function main() {
         format: 'cjs',
         target: 'node18',
         sourcemap: emitSourceMaps,
+        define: {
+            MONSQLIZE_IMPORT_META_URL: 'undefined',
+        },
         logLevel: 'info',
     });
 
@@ -59,6 +62,9 @@ async function main() {
         format: 'esm',
         target: 'node18',
         sourcemap: emitSourceMaps,
+        define: {
+            MONSQLIZE_IMPORT_META_URL: 'import.meta.url',
+        },
         logLevel: 'info',
     });
 

src/capabilities/model/index.ts

@@ -680,6 +680,11 @@ export class ModelInstance<TDocument = Record<string, unknown>> {
         return this.runModelWrite(() => saveModelDocument(this.collection, document, {
             timestampsConfig: this._timestampsConfig,
             versionConfig: this._versionConfig,
+            schemaValidationContext: {
+                validateEnabled: this._validateEnabled,
+                schemaCache: this._schemaCache,
+                schemaValidateFn: this._schemaValidateFn,
+            },
             nowFactory: () => this.nowDate(),
         }));
     }

src/capabilities/model/model-instance-helpers.ts

@@ -22,6 +22,8 @@ import {
     applyModelReplaceVersion,
     assertModelOptimisticLockMatched,
     assertNumericExpectedVersion,
+    validateModelSchemaPayload,
+    type ModelSchemaValidationContext,
     type ModelTimestampConfig,
     type ModelVersionConfig,
 } from './model-write-helpers';
@@ -353,6 +355,7 @@ export async function saveModelDocument<TDocument>(
     options: {
         timestampsConfig?: ModelTimestampConfig;
         versionConfig?: ModelVersionConfig;
+        schemaValidationContext?: ModelSchemaValidationContext;
         nowFactory?: () => Date;
     } = {},
 ): Promise<TDocument & Record<string, unknown>> {
@@ -366,6 +369,9 @@ export async function saveModelDocument<TDocument>(
                 options.versionConfig,
                 expectedVersion,
             ) as Record<string, unknown>;
+            if (options.schemaValidationContext) {
+                validateModelSchemaPayload(options.schemaValidationContext, replacement);
+            }
             const result = await collection.replaceOne(
                 { _id: payload._id, [options.versionConfig.field]: expectedVersion },
                 replacement,
@@ -375,13 +381,19 @@ export async function saveModelDocument<TDocument>(
             Object.assign(document, replacement);
             return document;
         }
+        if (options.schemaValidationContext) {
+            validateModelSchemaPayload(options.schemaValidationContext, payload);
+        }
         await collection.replaceOne({ _id: payload._id }, payload, { upsert: true });
         return document;
     }
     payload = applyModelInsertVersion(
         applyModelInsertTimestamps(payload, options.timestampsConfig ?? null, nowFactory),
         options.versionConfig ?? null,
     );
+    if (options.schemaValidationContext) {
+        validateModelSchemaPayload(options.schemaValidationContext, payload);
+    }
     const result = await collection.insertOne(payload);
     Object.assign(document, payload);
     (document as Record<string, unknown>)._id = result.insertedId;

src/capabilities/model/model-mutation-orchestrator.ts

@@ -445,6 +445,11 @@ export async function orchestrateModelReplaceOne<TDocument = Record<string, unkn
         context.versionConfig,
         lock.expectedVersion,
     );
+    validateModelSchemaPayload({
+        validateEnabled: context.validateEnabled,
+        schemaCache: context.schemaCache,
+        schemaValidateFn: context.schemaValidateFn,
+    }, nextReplacement as Record<string, unknown>, lock.driverOptions as Record<string, unknown> | undefined);
     const result = await context.collection.replaceOne(lock.filter, nextReplacement, lock.driverOptions);
     assertModelOptimisticLockMatched(result, context.versionConfig);
     if (context.hooksFactory) {
@@ -500,6 +505,11 @@ export async function orchestrateModelFindOneAndReplace<TDocument = Record<strin
         context.versionConfig,
         lock.expectedVersion,
     );
+    validateModelSchemaPayload({
+        validateEnabled: context.validateEnabled,
+        schemaCache: context.schemaCache,
+        schemaValidateFn: context.schemaValidateFn,
+    }, nextReplacement as Record<string, unknown>, lock.driverOptions as Record<string, unknown> | undefined);
     const result = await context.extendedCollection().findOneAndReplace(lock.filter, nextReplacement, lock.driverOptions);
     assertModelOptimisticLockDocument(result, context.versionConfig);
     if (context.hooksFactory) {

src/capabilities/model/model-registry.ts

@@ -22,7 +22,7 @@ import { validateCollectionName, validateDefinition, processTimestamps } from '.
  * Static model registry.
  *
  * Typical usage:
- *   Model.define('users', { schema: (dsl) => dsl({ name: 'string!' }) });
+ *   Model.define('users', { schema: (s) => s({ name: 'string!' }) });
  *   const registered = Model.get('users');
  */
 export class Model {

src/capabilities/model/model-write-helpers.ts

@@ -42,7 +42,7 @@ type ModelSchemaValidationResult = {
 
 export type ModelSchemaValidateFn = ((schema: unknown, document: unknown) => ModelSchemaValidationResult) | null;
 
-type ModelSchemaValidationContext = {
+export type ModelSchemaValidationContext = {
     validateEnabled: boolean;
     schemaCache: unknown;
     schemaValidateFn: ModelSchemaValidateFn;

src/capabilities/model/schema-dsl-function-scopes.ts

@@ -1,6 +1,8 @@
 import { findLocalDeclarationEnd } from './schema-dsl-local-declarations';
 
-const functionIdentifierPattern = /[A-Za-z_$][\w$]*/g;
+const functionIdentifierPattern = /[$_\p{ID_Start}][$\u200c\u200d\p{ID_Continue}]*/gu;
+const simpleFunctionIdentifierPattern = /^[$_\p{ID_Start}][$\u200c\u200d\p{ID_Continue}]*$/u;
+const functionIdentifierPartPattern = /[$\u200c\u200d\p{ID_Continue}]/u;
 
 export type FunctionScopeInfo = {
     start: number;
@@ -19,7 +21,7 @@ function addIdentifiersFromPattern(pattern: string, identifiers: Set<string>): v
 }
 
 function isIdentifierPart(char: string | undefined): boolean {
-    return char !== undefined && /[A-Za-z_$\d]/.test(char);
+    return char !== undefined && functionIdentifierPartPattern.test(char);
 }
 
 function splitTopLevel(source: string, delimiter: string): string[] {
@@ -114,7 +116,7 @@ function isIndexInRanges(index: number, ranges: ReadonlyArray<{ start: number; e
 function addBindingIdentifiers(pattern: string, identifiers: Set<string>): void {
     let binding = stripTopLevelDefault(pattern).replace(/^\s*\.\.\./, '').trim();
     if (!binding) return;
-    if (/^[A-Za-z_$][\w$]*$/.test(binding)) {
+    if (simpleFunctionIdentifierPattern.test(binding)) {
         identifiers.add(binding);
         return;
     }
@@ -314,7 +316,7 @@ function getClassMethodNameBinding(header: string, headerStart: number): Functio
     if (remaining.startsWith('[')) {
         return null;
     }
-    const match = /^#?([A-Za-z_$][\w$]*)\s*\(/.exec(remaining);
+    const match = /^#?([$_\p{ID_Start}][$\u200c\u200d\p{ID_Continue}]*)\s*\(/u.exec(remaining);
     if (!match) {
         return null;
     }
@@ -335,7 +337,7 @@ function stripClassMethodModifiers(header: string): string {
 
 function isClassMethodHeader(header: string): boolean {
     const remaining = stripClassMethodModifiers(header);
-    return remaining.startsWith('[') || /^#?[A-Za-z_$][\w$]*\s*\(/.test(remaining);
+    return remaining.startsWith('[') || /^#?[$_\p{ID_Start}][$\u200c\u200d\p{ID_Continue}]*\s*\(/u.test(remaining);
 }
 
 function getTrailingClassMethodHeader(header: string): { header: string; offset: number } | null {
@@ -357,7 +359,7 @@ function isObjectMethodHeader(header: string): boolean {
     }
     return remaining.startsWith('(')
         || remaining.startsWith('[')
-        || /^(?:\d+(?:\.\d+)?|#?[A-Za-z_$][\w$]*)\s*\(/.test(remaining);
+        || /^(?:\d+(?:\.\d+)?|#?[$_\p{ID_Start}][$\u200c\u200d\p{ID_Continue}]*)\s*\(/u.test(remaining);
 }
 
 function includeMethodModifiers(source: string, start: number): number {
@@ -424,7 +426,7 @@ function getClassFieldNameBinding(header: string, headerStart: number): Function
     if (remaining.startsWith('[')) {
         return null;
     }
-    const match = /^#?([A-Za-z_$][\w$]*)/.exec(remaining);
+    const match = /^#?([$_\p{ID_Start}][$\u200c\u200d\p{ID_Continue}]*)/u.exec(remaining);
     if (!match) {
         return null;
     }
@@ -478,7 +480,7 @@ function isClassDeclarationBinding(source: string, classIndex: number): boolean
 
 function findClassMemberScopes(source: string): FunctionScopeInfo[] {
     const scopes: FunctionScopeInfo[] = [];
-    for (const match of source.matchAll(/\bclass(?:\s+([A-Za-z_$][\w$]*))?/g)) {
+    for (const match of source.matchAll(/\bclass(?:\s+([$_\p{ID_Start}][$\u200c\u200d\p{ID_Continue}]*))?/gu)) {
         const classIndex = match.index ?? 0;
         const className = match[1];
         if (className) {
@@ -666,7 +668,7 @@ export function addScopedLocalIdentifiers(
         }
         declarationPattern.lastIndex = Math.max(declarationPattern.lastIndex, declarationEnd);
     }
-    for (const match of scopeSource.matchAll(/\bclass\s+([A-Za-z_$][\w$]*)/g)) {
+    for (const match of scopeSource.matchAll(/\bclass\s+([$_\p{ID_Start}][$\u200c\u200d\p{ID_Continue}]*)/gu)) {
         const matchIndex = start + (match.index ?? 0);
         if (isIndexInRanges(matchIndex, excludedRanges)) {
             continue;
@@ -711,7 +713,7 @@ export function findNestedFunctionScopes(source: string, rootArrowIndex: number,
         const bodyEnd = findMatchingBrace(source, bodyStart);
         if (bodyEnd > bodyStart) {
             const header = source.slice(functionIndex, bodyStart);
-            const functionMatch = /function(?:\s+([A-Za-z_$][\w$]*))?\s*\(([^)]*)\)/.exec(header);
+            const functionMatch = /function(?:\s+([$_\p{ID_Start}][$\u200c\u200d\p{ID_Continue}]*))?\s*\(([^)]*)\)/u.exec(header);
             const boundIdentifiers = new Set<string>();
             if (functionMatch?.[1]) {
                 boundIdentifiers.add(functionMatch[1]);