test(mock): judge plain data through the owner

The two mock files each kept a private isPlainObject that accepted any non-null, non-array object, beside the engine's owner in src/plain-data.ts, which also refuses a foreign prototype. Both copies go and both files import the owner; its predicate type is the type the mock's Json alias names, so no wrapper or cast is needed.

A live_state seed can carry a foreign prototype after all: the yaml parser turns !!timestamp into a Date and !!set into a Set, and the schema passes them through as unknown. Under the owner such a seed replaces like a scalar, as the engine treats the same tag in a settings file, where the copies spread it into an empty mapping.

deepMerge assigned out[key], so a seed key spelled __proto__ set the merged object's prototype, and under the stricter predicate reslugRepo then skipped that owner mapping. It now reads through own and writes through put from the same owner, and a test pins the seed as data with the owner still reslugged.

Author: Vivswan

test/e2e/mock/request-body.ts

@@ -5,9 +5,10 @@
  * handler that stored the body verbatim would hide both from every scenario.
  */
 
+import { isPlainObject } from "../../../src/plain-data.js";
 import type { Route } from "../../../src/sections/contract/endpoints.js";
 import { sharedValidator } from "../openapi/validate.js";
-import type { Json, MockResponse } from "./support.js";
+import type { MockResponse } from "./support.js";
 
 /**
  * Fields GitHub accepts (verified live) that its descriptor omits, so the spec-derived allowlist would
@@ -19,10 +20,6 @@ export const UNDOCUMENTED_BODY_FIELDS: ReadonlyMap<Route, readonly string[]> = n
   ["PATCH /repos/{owner}/{repo}", ["has_discussions"]],
 ]);
 
-function isPlainObject(value: unknown): value is Json {
-  return value !== null && typeof value === "object" && !Array.isArray(value);
-}
-
 /**
  * The body a handler receives for `route`: the documented top-level fields of an object body, every
  * other shape untouched (a raw string, an array, no body: the OpenAPI validator's concern). Nested

test/e2e/mock/state.test.ts

@@ -33,6 +33,7 @@ import {
   environmentFromPut,
   invitationFromPut,
   LIST_MOCKS,
+  type LiveState,
   type MockState,
   normalizePinnedSeed,
   protectionFromPut,
@@ -209,6 +210,17 @@ describe("buildState overlay semantics", () => {
     expect((third.repo.owner as Record<string, unknown>).login).toBe("e2e-owner");
     expect(third.repo.full_name).toBe("e2e-owner/e2e-repo");
   });
+
+  test("a seed key named __proto__ is data, as a YAML file can spell it: an own key after the merge, the owner still reslugged", () => {
+    // Parsed, not a literal: `__proto__` in an object literal sets the prototype.
+    const seed = JSON.parse('{"repo": {"owner": {"__proto__": {"example": true}}}}') as LiveState;
+    const owner = buildState(seed, "org", "other-owner/svc").repo.owner as Record<string, unknown>;
+    expect({
+      proto: Object.getPrototypeOf(owner),
+      ownKey: Object.getOwnPropertyDescriptor(owner, "__proto__")?.value,
+      login: owner.login,
+    }).toEqual({ proto: Object.prototype, ownKey: { example: true }, login: "other-owner" });
+  });
 });
 
 describe("protectionFromPut round trip", () => {

test/e2e/mock/state.ts

@@ -9,6 +9,7 @@
  *   collaboratorFromPut  -> role_name via roleForPermission, the same map the section runs on its declaration
  */
 
+import { isPlainObject, own, put } from "../../../src/plain-data.js";
 import {
   GRAPHQL_BOOLEAN_TWINS,
   GRAPHQL_REVIEW_TWINS,
@@ -380,10 +381,6 @@ export function normalizePinnedSeed(
   return pins.sort((a, b) => a.position - b.position);
 }
 
-function isPlainObject(value: unknown): value is Json {
-  return typeof value === "object" && value !== null && !Array.isArray(value);
-}
-
 /**
  * Runs last in buildState, after the repo is re-slugged and `state.slug` is fixed: the slug is part of
  * every id, so an id minted earlier would name the fixture. Write handlers mint with the same codec
@@ -418,8 +415,8 @@ export function restRepoSurface(repo: Json): Json {
 function deepMerge(base: Json, overlay: Json): Json {
   const out: Json = { ...base };
   for (const [key, value] of Object.entries(overlay)) {
-    const prev = out[key];
-    out[key] = isPlainObject(prev) && isPlainObject(value) ? deepMerge(prev, value) : value;
+    const prev = own(out, key);
+    put(out, key, isPlainObject(prev) && isPlainObject(value) ? deepMerge(prev, value) : value);
   }
   return out;
 }