fix(service-analytics): also refuse a caller-named measure that reduces to a non-column source (#21156)

The member-shape door gate skipped the measure position: namedQueryFields drops
an undeclared measure (the strategies refuse one the cube does not carry), so a
caller-named measure that inference mints — its sql built from the caller's own
text by inferMeasure — slipped the gate and reached the aggregate position of
the native statement verbatim in the ungated tiers (no security service; an
object the reader answers undefined for). The judged tier already refused it
(the minted measure reads as a declared expression member and #21153 catches
it); the ungated tiers did not.

Judge the inferred source here too, against the same rule inference applies: a
caller-named measure must reduce — after inferMeasure's suffix strip, the
no-suffix default included — to count / '*' or to a column reference (bare
identifier / relationship path), or it is refused with the same
fieldReadUnjudgeableError (PERMISSION_DENIED / 403). Author-declared measures
are untouched; a dotted non-qualifier measure is already refused by #5918 ahead
of this.

Co-authored-by: Claude <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01DiCSbmJrkzNhuEAier4VoJ

Author: claude

packages/services/service-analytics/src/__tests__/caller-member-column-reference-gate.test.ts

@@ -43,13 +43,25 @@ const REGISTERED: Cube = {
   title: 'Ledger',
   sql: OBJ,
   public: true,
-  measures: { count: { type: 'count', sql: '*', label: 'Count' } },
+  measures: {
+    count: { type: 'count', sql: '*', label: 'Count' },
+    author_expr_measure: { type: 'number', sql: 'amount + 1', label: 'Author expression measure' },
+  },
   dimensions: {
     status: { type: 'string', sql: 'status', label: 'Status' },
     author_expr: { type: 'number', sql: 'amount + 1', label: 'Author expression' },
   },
 } as Cube;
 
+/**
+ * A measure the CALLER names itself whose inferred source is not a column
+ * reference: the suffixed form (`inferMeasure` strips `_sum` → `amount + 1`)
+ * and the no-suffix default (the whole key → `amount + 1`). Both reach the
+ * aggregate position verbatim before this gate.
+ */
+const CALLER_MEASURE_SUFFIXED = 'amount + 1_sum';
+const CALLER_MEASURE_NOSUFFIX = 'amount + 1';
+
 /** A member the CALLER names itself, spelled as no column is. Neutral, not a payload. */
 const CALLER_EXPR = 'amount + 1';
 
@@ -182,4 +194,64 @@ describe('[#21156] analytics — a caller-named non-column member is refused at
       expect(executed.length).toBeGreaterThan(0);
     });
   });
+
+  // An author-declared expression MEASURE is a native-SQL-only feature (the
+  // ObjectQL aggregate AST cannot carry a raw SQL expression — a pre-existing
+  // strategy refusal, not this gate's). The non-regression claim is that THIS
+  // gate does not refuse it: on NativeSQL it still reaches the strategy with no
+  // security service.
+  it('an author-declared expression measure is not refused by this gate (served on NativeSQL, no security service)', async () => {
+    const { service, executed } = makeService({ capabilities: nativeSqlOnly });
+    await service.query({ cube: 'cm_cube', measures: ['author_expr_measure'] } as never, CALLER);
+    expect(executed.length).toBeGreaterThan(0);
+  });
+
+  // ── The MEASURE position (#21156 rework) ──────────────────────────────────
+  //
+  // A caller-named measure whose inferred source (after inferMeasure's suffix
+  // strip, the no-suffix default included) is not a column reference reached
+  // the aggregate position of the statement verbatim in the ungated tiers. It
+  // is refused here, in every tier, before a strategy compiles it.
+  describe('a caller-named measure that reduces to a non-column source is refused', () => {
+    const MEASURES = [
+      { label: 'a suffixed inferred measure', measure: CALLER_MEASURE_SUFFIXED },
+      { label: 'the no-suffix default', measure: CALLER_MEASURE_NOSUFFIX },
+    ];
+    describe.each([...UNJUDGED_TIERS, { label: 'judged object', readers: JUDGED }])(
+      'tier: $label',
+      ({ readers }) => {
+        describe.each(STRATEGY_PATHS)('$label', ({ capabilities }) => {
+          describe.each(CUBES)('on $label', ({ cube }) => {
+            it.each(MEASURES)('$label: refused PERMISSION_DENIED / 403 on both doors, nothing executed', async ({ measure }) => {
+              const { service, executed } = makeService({ capabilities, ...(readers as object) });
+              const q = { cube, measures: [measure] };
+              for (const run of [
+                () => service.query(q as never, CALLER),
+                () => service.generateSql(q as never, CALLER),
+              ]) {
+                const refusal = await run().then(() => null, (e: unknown) => e as Record<string, unknown>);
+                expect(refusal).toMatchObject({ code: 'PERMISSION_DENIED', status: 403, member: measure });
+              }
+              expect(executed).toEqual([]);
+            });
+          });
+        });
+      },
+    );
+
+    // No false positives: a valid inferred measure over a real column, and a
+    // bare count, are served in every tier.
+    describe.each([...UNJUDGED_TIERS, { label: 'judged object', readers: JUDGED }])(
+      'the positive control in tier: $label',
+      ({ readers }) => {
+        it.each(STRATEGY_PATHS)('$label: a valid _sum measure and a bare count are served', async ({ capabilities }) => {
+          for (const cube of ['cm_adhoc', 'cm_cube']) {
+            const { service, executed } = makeService({ capabilities, ...(readers as object) });
+            await service.query({ cube, measures: ['amount_sum', 'count'] } as never, CALLER);
+            expect(executed.length).toBeGreaterThan(0);
+          }
+        });
+      },
+    );
+  });
 });

packages/services/service-analytics/src/analytics-service.ts

@@ -50,6 +50,7 @@ import { readScopeUnresolvedError } from './read-scope-refusal.js';
 import {
   assertNamedFieldsReadable,
   assertCallerMembersJudgeable,
+  fieldReadUnjudgeableError,
   type QueryableFieldsProvider,
   type NamedField,
   type NamedRead,
@@ -1833,6 +1834,23 @@ export class AnalyticsService implements IAnalyticsService {
    * caller-supplied. A dataset's own filter is author text and is deliberately
    * not judged here (no `datasetScope` is passed); #21153's gate judges it
    * where it applies.
+   *
+   * ## The measure position
+   *
+   * {@link namedQueryFields} skips a measure the cube does not declare (both
+   * strategies refuse one it does not carry), so a caller-named measure that
+   * {@link inferCubeFromQuery} MINTS — its `sql` built from the caller's own
+   * text by {@link inferMeasure} — is not in that list. Judged on the inferred
+   * cube (the judged tier), the minted measure reads as a declared expression
+   * member and #21153 refuses it; in the ungated tiers nothing did, and the
+   * caller's text reached the aggregate position of the statement verbatim.
+   * So the inferred `sql` is judged here too, against the same rule, before a
+   * strategy compiles it: a caller-named measure must reduce — after
+   * {@link inferMeasure}'s suffix strip, the no-suffix default included — to
+   * `count` / `'*'` or to a column reference, or it is refused. Author-declared
+   * measures are skipped (handled where #21153 / the parse #20943 judge them),
+   * and a dotted non-qualifier measure has already been refused by #5918 in
+   * {@link ensureCube} ahead of this.
    */
   private assertCallerMembersResolvable(
     query: AnalyticsQuery,
@@ -1845,6 +1863,34 @@ export class AnalyticsService implements IAnalyticsService {
       authorCube ?? ({ name, title: name, sql: name, measures: {}, dimensions: {} } as Cube);
     const named = namedQueryFields(query, probeCube, undefined, this.hopReference);
     assertCallerMembersJudgeable(named, this.logger, context);
+
+    // [#21156] The measure position, which `namedQueryFields` does not carry.
+    const baseObject = typeof probeCube.sql === 'string' ? probeCube.sql.trim() : '';
+    if (!baseObject || !BARE_IDENTIFIER.test(baseObject)) return;
+    for (const measure of query.measures ?? []) {
+      if (typeof measure !== 'string' || measure === '') continue;
+      // Author-declared measures are not this gate's business.
+      if (authorCube && declaredMemberEntry(authorCube, measure, 'measure')) continue;
+      const inferredSql = inferredCallerMeasureSql(measure, name);
+      // `null` — a dotted non-qualifier measure #5918 already refused — and a
+      // column reference (`'*'`, a bare identifier, a relationship path) both
+      // pass; anything else is caller text reaching the aggregate unjudged.
+      if (
+        inferredSql === null ||
+        inferredSql === '*' ||
+        BARE_IDENTIFIER.test(inferredSql) ||
+        IDENTIFIER_PATH.test(inferredSql)
+      ) {
+        continue;
+      }
+      this.logger.warn(
+        `[Analytics] field-level read admission refused caller-named measure "${measure}" on ` +
+          `"${baseObject}" (user ${String((context as { userId?: unknown } | undefined)?.userId ?? 'unknown')}) — ` +
+          `it reduces to a source that is not a column reference, so no field it aggregates can be ` +
+          `judged, in any tier (fail-closed)`,
+      );
+      throw fieldReadUnjudgeableError(baseObject, measure);
+    }
   }
 
   private async assertFieldsReadable(
@@ -3756,6 +3802,25 @@ export function inferMeasure(key: string): { label: string; type: 'count' | 'sum
   return { label: key, type: 'sum', sql: key };
 }
 
+/**
+ * [#21156] The `sql` {@link inferMeasure} would mint for a caller-named measure
+ * — the text that reaches the aggregate position — or `null` for a dotted
+ * non-qualifier measure, which {@link mintableMeasureKey} / #5918 refuses in
+ * {@link AnalyticsService.ensureCube} ahead of the member-shape gate. Mirrors
+ * `mintableMeasureKey`'s qualifier strip WITHOUT its throw (that refusal has
+ * already happened), then reads {@link inferMeasure}'s source. The gate judges
+ * whether the result is a column reference.
+ */
+function inferredCallerMeasureSql(measure: string, cubeName: string): string | null {
+  let key = measure;
+  const dot = measure.indexOf('.');
+  if (dot >= 0) {
+    if (measure.slice(0, dot) === cubeName) key = measure.slice(dot + 1);
+    else return null;
+  }
+  return inferMeasure(key).sql;
+}
+
 /**
  * FallbackDelegateStrategy — Internal strategy for fallback service delegation.
  *