fix: harden write path policy escapes

Author: rockyshi1993

changelogs/unreleased.md

@@ -18,6 +18,7 @@
 - Added a short-lived read-cache dirty barrier around writes and transaction commits. Cached reads now bypass and avoid refilling query cache while a namespace is being invalidated, reducing stale-cache windows when a process exits between a database write and post-write invalidation.
 - Added optional Change Stream sync idempotency gates (`sync.idempotency`) with per-target keys and duplicate stats, so supervised restarts can skip targets already marked as applied before saving the shared resume token.
 - Added `writePathPolicy` with default `allow-both` behavior and optional `model-only` namespace enforcement across collection, db, legacy, raw, management, batch, and aggregate `$out` / `$merge` write paths.
+- Hardened `writePathPolicy` guard coverage for native client access, legacy `dropDatabase`, management-operation target namespaces, and instance-scoped database-level rules.
 - Added strict optimistic-locking support to Model `updateBatch(..., { versionMode: 'strict' })`; default `counter` behavior remains unchanged.
 - Clarified the runtime consistency contract across cache, transactions, Change Stream sync, and CountQueue; `transaction.distributedLock` now warns as a v1 compatibility placeholder because v2 transaction cache locks remain process-local.
 - Added an event-level barrier for Change Stream sync target failures, passed a cooperative `AbortSignal` through `CountQueue.execute()` timeouts, and unified ObjectId auto-conversion field matching across query/write paths including nested array path segments.

src/adapters/mongodb/common/collection-accessor.ts

@@ -612,13 +612,13 @@ export class MongoCollectionAccessor<TSchema extends Document = Document> {
 
     /** Creates a collection (or a named alternative) with the given options. */
     async createCollection(name?: string, options: Record<string, unknown> = {}): Promise<boolean> {
-        this.assertWritePath('createCollection', 'management');
+        this.assertManagementWriteTargets('createCollection', name);
         return createCollectionForAccessor(this.collectionRef, this.collectionName, this.dbRef, name, options);
     }
 
     /** Creates a MongoDB view backed by the given source collection and aggregation pipeline. */
     async createView(name: string, source: string, pipeline: unknown[] = []): Promise<boolean> {
-        this.assertWritePath('createView', 'management');
+        this.assertManagementWriteTargets('createView', name);
         return createViewForAccessor(this.collectionRef, this.dbRef, name, source, pipeline);
     }
 
@@ -655,7 +655,7 @@ export class MongoCollectionAccessor<TSchema extends Document = Document> {
 
     /** Renames the collection, optionally dropping an existing target collection. */
     async renameCollection(newName: unknown, options: { dropTarget?: boolean } = {}): Promise<{ renamed: boolean; from: string; to: string }> {
-        this.assertWritePath('renameCollection', 'management');
+        this.assertManagementWriteTargets('renameCollection', newName);
         return renameCollectionForAccessor(this.collectionRef, this.collectionName, newName, options);
     }
 
@@ -683,6 +683,21 @@ export class MongoCollectionAccessor<TSchema extends Document = Document> {
         });
     }
 
+    private assertManagementWriteTargets(operation: string, targetCollectionName?: unknown): void {
+        this.assertWritePath(operation, 'management');
+        if (
+            typeof targetCollectionName === 'string'
+            && targetCollectionName.length > 0
+            && targetCollectionName !== this.collectionName
+        ) {
+            this.assertWritePath(
+                operation,
+                'management',
+                this.buildNamespaceView(this.dbName, targetCollectionName),
+            );
+        }
+    }
+
     private batchContext(operation: string) {
         this.assertWritePath(operation, 'batch');
         return {

src/capabilities/write-path-policy/index.ts

@@ -20,7 +20,7 @@ export interface WritePathPolicyOptions {
 }
 
 export type WritePathOperationCategory = 'write' | 'batch' | 'management' | 'raw';
-export type WritePathSource = 'collection' | 'model' | 'legacy' | 'db';
+export type WritePathSource = 'collection' | 'model' | 'legacy' | 'db' | 'client';
 
 export interface WritePathNamespace {
     iid?: string;
@@ -249,12 +249,16 @@ export function assertWritePathAllowed(config: {
 }
 
 function namespaceRuleMatchesDb(ruleKey: string, dbName: string): boolean {
-    if (ruleKey.includes(':')) {
-        const [, scoped] = ruleKey.split(':', 2);
-        return scoped?.startsWith(`${dbName}.`) ?? false;
-    }
     if (ruleKey.includes('.')) {
-        return ruleKey.startsWith(`${dbName}.`);
+        const scoped = ruleKey.includes(':') ? ruleKey.slice(ruleKey.lastIndexOf(':') + 1) : ruleKey;
+        return scoped.startsWith(`${dbName}.`);
+    }
+    const parts = ruleKey.split(':');
+    if (parts.length >= 3) {
+        return parts[parts.length - 2] === dbName;
+    }
+    if (parts.length === 2) {
+        return parts[0] === dbName;
     }
     return true;
 }
@@ -320,6 +324,47 @@ export function assertDbLevelWritePathAllowed(config: {
     throw createError(ErrorCodes.INVALID_OPERATION, message, [details]);
 }
 
+export function shouldBlockClientLevelWritePath(
+    policy: NormalizedWritePathPolicy | undefined,
+): boolean {
+    if (!policy) return false;
+    if (blocksDbLevelCategory(policy.default, 'raw')) {
+        return true;
+    }
+    return Object.values(policy.namespaces).some((rule) => blocksDbLevelCategory(rule, 'raw'));
+}
+
+export function assertClientLevelWritePathAllowed(config: {
+    policy?: NormalizedWritePathPolicy;
+    operation: string;
+    logger?: Pick<Logger, 'warn'>;
+}): void {
+    const policy = config.policy;
+    if (!policy) return;
+
+    const matches: Array<{ key: string; rule: NormalizedWritePathRule }> = [
+        { key: 'default', rule: policy.default },
+        ...Object.entries(policy.namespaces).map(([key, rule]) => ({ key, rule })),
+    ];
+    const blocked = matches.find(({ rule }) => blocksDbLevelCategory(rule, 'raw'));
+    if (!blocked) return;
+
+    const details = {
+        operation: config.operation,
+        category: 'raw' satisfies WritePathOperationCategory,
+        source: 'client' satisfies WritePathSource,
+        namespace: {},
+        matchedRule: blocked.key,
+        rule: blocked.rule,
+    };
+    const message = buildViolationMessage(config.operation, 'raw', 'client');
+    if (blocked.rule.onViolation === 'warn') {
+        config.logger?.warn?.(`[WritePathPolicy] ${message}`, details);
+        return;
+    }
+    throw createError(ErrorCodes.INVALID_OPERATION, message, [details]);
+}
+
 export function runWithModelWriteSource<T>(fn: () => T): T {
     return modelWriteSourceStorage.run('model', fn);
 }

src/entry/runtime-admin-bridge.ts

@@ -21,13 +21,17 @@ import {
     type SlowQueryLogEntry,
 } from '../capabilities/slow-query-log';
 import { ErrorCodes, createError } from '../core/errors';
-import { assertWritePathAllowed, type WritePathOperationCategory } from '../capabilities/write-path-policy';
+import {
+    assertClientLevelWritePathAllowed,
+    assertWritePathAllowed,
+    type WritePathOperationCategory,
+} from '../capabilities/write-path-policy';
+import type { Logger } from '../core/logger';
 import type { AdminBuildInfoView, DbStatsView, ServerStatusView } from '../../types/collection';
 import type { RuntimeDefaults } from '../types/internal/query';
 import type { AdapterBridgeLike, LegacyAdapterBridgeLike } from '../types/internal/runtime';
 import type { MonSQLizeOptions } from '../../types/monsqlize';
 import type { MongoDbAccessor as DbFacade } from '../adapters/mongodb/common/accessors';
-import { isProductionEnvironment } from '../adapters/mongodb/common/drop-database-safety';
 import { resolveAggregateWriteTarget } from '../adapters/mongodb/common/collection-accessor-cache-helpers';
 
 /**
@@ -43,6 +47,8 @@ type AdapterBridgeConfig = {
     getDb: () => Db | null;
     /** Returns the current MongoClient (null when not connected). */
     getClient: () => MongoClient | null;
+    /** Asserts that public native-client access is allowed. */
+    assertClientAccess: () => void;
     /** Returns the current cache instance (may be null). */
     getCache: () => CacheLike | null;
     /** Replaces the current cache instance. */
@@ -204,7 +210,13 @@ function createAdapterBridge(config: AdapterBridgeConfig): LegacyAdapterBridgeLi
         },
         client: {
             enumerable: true,
-            get: config.getClient,
+            get: () => {
+                const client = config.getClient();
+                if (client) {
+                    config.assertClientAccess();
+                }
+                return client;
+            },
         },
         cache: {
             enumerable: true,
@@ -280,6 +292,7 @@ export type RuntimeAdapterBridgeHost = {
     _client: MongoClient | null;
     _iidCache: MemoryCache | null;
     _runtimeDefaults: RuntimeDefaults;
+    _logger: Logger;
     _slowQueryLogManager: SlowQueryLogManager | null;
     resolveAdapterCache(): CacheLike | null;
     setAdapterCache(value: CacheLike | null): void;
@@ -302,6 +315,11 @@ export function createRuntimeAdapterBridge(host: RuntimeAdapterBridgeHost): Lega
     return createAdapterBridge({
         getDb: () => host._defaultDb?.raw() ?? null,
         getClient: () => host._client,
+        assertClientAccess: () => assertClientLevelWritePathAllowed({
+            policy: host._runtimeDefaults.writePathPolicy,
+            operation: 'client',
+            logger: host._logger,
+        }),
         getCache: () => host.resolveAdapterCache(),
         setCache: (value) => host.setAdapterCache(value),
         getInstanceId: () => host._runtimeDefaults.namespace?.instanceId,
@@ -331,26 +349,11 @@ export function createRuntimeAdapterBridge(host: RuntimeAdapterBridgeHost): Lega
             if (!name || typeof name !== 'string') {
                 throw createError(ErrorCodes.INVALID_DATABASE_NAME, 'Database name is required and must be a non-empty string');
             }
-            if (!adminOptions?.confirm) {
-                const error = new Error(
-                    'dropDatabase requires explicit confirmation. Pass { confirm: true } to proceed.\n\n' +
-                    '⚠️  WARNING: This will DELETE ALL DATA in the database!\n' +
-                    '⚠️  This operation CANNOT BE UNDONE!',
-                ) as Error & { code: string };
-                error.code = 'CONFIRMATION_REQUIRED';
-                throw error;
-            }
-            const isProduction = isProductionEnvironment();
-            if (isProduction && !adminOptions.allowProduction) {
-                const error = new Error('dropDatabase is blocked in production. Pass { allowProduction: true } to override.') as Error & { code: string };
-                error.code = 'PRODUCTION_BLOCKED';
-                throw error;
-            }
-            if (!host._client) {
-                throw createError(ErrorCodes.NOT_CONNECTED, 'MonSQLize is not connected yet.');
-            }
-            await host._client.db(name).dropDatabase();
-            return { dropped: true, database: name, timestamp: new Date() };
+            return host.db(name).dropDatabase({
+                confirm: adminOptions?.confirm === true,
+                allowProduction: adminOptions?.allowProduction,
+                user: adminOptions?.user,
+            });
         },
         listCollections: async (adminOptions) => {
             host.ensureConnected();

src/entry/runtime-core-hosts.ts

@@ -13,6 +13,7 @@ type RuntimeCoreAdapterBridgeState = {
     options: MonSQLizeOptions;
     _cache: CacheLike;
     _adapterCacheOverride: CacheLike | null | undefined;
+    _logger: Logger;
 } & Pick<
     RuntimeAdapterBridgeHost,
     '_defaultDb' | '_client' | '_iidCache' | '_runtimeDefaults' | '_slowQueryLogManager' |
@@ -57,6 +58,7 @@ export function createRuntimeCoreAdapterBridgeHost(runtime: unknown): RuntimeAda
         get _iidCache() { return state._iidCache; },
         set _iidCache(value) { state._iidCache = value; },
         _runtimeDefaults: state._runtimeDefaults,
+        _logger: state._logger,
         get _slowQueryLogManager() { return state._slowQueryLogManager; },
         resolveAdapterCache: () => resolveAdapterCache(state),
         setAdapterCache: (value) => {
@@ -105,4 +107,4 @@ export function createRuntimeCoreAccessors<TRuntime extends object>(runtime: TRu
             state._iidCache = value;
         },
     });
-}
+}

test/unit/coverage/core-helpers.test.ts

@@ -1185,6 +1185,7 @@ describe('coverage core helpers', () => {
             _client: { db: () => ({ collection: () => nativeCollection, dropDatabase: async () => true }) },
             _iidCache: null,
             _runtimeDefaults: { namespace: { instanceId: 'iid' } },
+            _logger: { warn: () => undefined },
             _slowQueryLogManager: { save: async (entry: unknown) => saved.push(entry) },
             resolveAdapterCache: () => null,
             setAdapterCache: (value: unknown) => { host.cache = value; },
@@ -1196,6 +1197,15 @@ describe('coverage core helpers', () => {
                 listDatabases: async () => [{ name: 'db' }],
                 listCollections: async () => [{ name: 'items' }],
                 runCommand: async (cmd: unknown) => ({ cmd }),
+                dropDatabase: async (options: { confirm?: boolean; allowProduction?: boolean } = {}) => {
+                    if (!options.confirm) {
+                        throw new Error('dropDatabase requires explicit confirmation. Pass { confirm: true } to proceed.');
+                    }
+                    if (['production', 'prod', 'live'].includes(process.env['NODE_ENV'] ?? '') && !options.allowProduction) {
+                        throw new Error('dropDatabase is blocked in production. Pass { allowProduction: true } to override.');
+                    }
+                    return { dropped: true, database: 'db', timestamp: new Date() };
+                },
             }),
             emit: (event: string, payload: unknown) => emitted.push({ event, payload }),
         };