security(analytics): ObjectQLStrategy 不消费 getReadScope — NativeSQL 回落后聚合查询无 RLS/租户谓词(#2852 修复未覆盖的另一半) #3597

// native-sql-strategy.ts:193-211 — applyReadScope,只有 NativeSQL 有
if (typeof ctx.getReadScope !== 'function') return;
const filter = ctx.getReadScope(objectName);

// plugin.ts:197-208
const rows = await engine.aggregate(objectName, {
  where: filter, groupBy, aggregations, timezone,   // ← 没有 context
});

// security-plugin.ts:775-781 —— 决定性分支
if (
  positions.length === 0 &&
  explicitPermissionSets.length === 0 &&
  !opCtx.context?.userId
) {
  return next();          // ← 整个安全中间件被跳过,包括 RLS 注入
}

// Copyright (c) 2026 ObjectStack. Licensed under the Apache-2.0 license.
import { describe, it, expect } from 'vitest';
import { DatasetSchema } from '@objectstack/spec/ui';
import type { ExecutionContext } from '@objectstack/spec/kernel';
import type { FilterCondition } from '@objectstack/spec/data';
import { AnalyticsService } from '../analytics-service.js';
import { compileDataset } from '../dataset-compiler.js';

const dataset = DatasetSchema.parse({
  name: 'sales', label: 'Sales', object: 'opportunity',
  dimensions: [{ name: 'region', field: 'region', type: 'string' }],
  measures: [{ name: 'revenue', aggregate: 'sum', field: 'amount' }],
});

/** 两个租户的行在同一张物理表里 */
const TABLE = [
  { id: 1, organization_id: 'org_A', region: 'West', amount: 100 },
  { id: 2, organization_id: 'org_B', region: 'East', amount: 900 },
];

const readScope = (_o: string, context?: ExecutionContext): FilterCondition | undefined =>
  context?.tenantId ? { organization_id: context.tenantId } : undefined;

/** 诚实的 aggregate 桥:它会真的应用收到的 filter。所以谓词没传到 = 真漏,不是 stub 造假 */
function makeAggregate(seen: Record<string, unknown>[]) {
  return async (_objectName: string, opts: any) => {
    seen.push({ filter: opts.filter });
    const rows = TABLE.filter((r) =>
      Object.entries(opts.filter ?? {}).every(([k, v]) => (r as any)[k] === v));
    const buckets = new Map<string, Record<string, unknown>>();
    for (const r of rows) {
      const key = (opts.groupBy ?? []).map((g: string) => String((r as any)[g])).join('|');
      const b = buckets.get(key) ?? Object.fromEntries((opts.groupBy ?? []).map((g: string) => [g, (r as any)[g]]));
      for (const a of opts.aggregations ?? []) {
        if (a.method === 'sum') b[a.alias] = Number(b[a.alias] ?? 0) + Number((r as any)[a.field] ?? 0);
      }
      buckets.set(key, b);
    }
    return [...buckets.values()];
  };
}

const ctxA = { tenantId: 'org_A', userId: 'u_a' } as ExecutionContext;

describe('ObjectQL path — read scope', () => {
  it('scopes a plain aggregate query to the caller tenant', async () => {
    const compiled = compileDataset(dataset);
    const seen: Record<string, unknown>[] = [];
    const service = new AnalyticsService({
      cubes: [compiled.cube],
      queryCapabilities: () => ({ nativeSql: false, objectqlAggregate: true, inMemory: false }),
      executeAggregate: makeAggregate(seen),
      getReadScope: readScope,
    });
    const result = await service.query(
      { cube: 'sales', dimensions: ['region'], measures: ['revenue'] }, ctxA);
    expect(result.rows).toEqual([{ region: 'West', revenue: 100 }]);
    expect(seen[0].filter).toMatchObject({ organization_id: 'org_A' });
  });

  it('scopes when NativeSQL declines at runtime (RAW_SQL_UNSUPPORTED fallback)', async () => {
    const compiled = compileDataset(dataset);
    const seen: Record<string, unknown>[] = [];
    const service = new AnalyticsService({
      cubes: [compiled.cube],
      // 两个都 advertise —— 正是 plugin auto-bridge 的默认产物
      queryCapabilities: () => ({ nativeSql: true, objectqlAggregate: true, inMemory: false }),
      executeRawSql: async () => {
        const err = new Error('driver cannot run SQL') as Error & { code: string };
        err.code = 'RAW_SQL_UNSUPPORTED';
        throw err;
      },
      executeAggregate: makeAggregate(seen),
      getReadScope: readScope,
    });
    const result = await service.query(
      { cube: 'sales', dimensions: ['region'], measures: ['revenue'] }, ctxA);
    expect(seen[0].filter).toMatchObject({ organization_id: 'org_A' });
    expect(result.rows.map((r) => r.region)).toEqual(['West']);
  });

  it('scopes a date-bucketed query (NativeSQL declines on granularity, even on SQL drivers)', async () => {
    const compiled = compileDataset(DatasetSchema.parse({
      name: 'sales_t', label: 'Sales', object: 'opportunity',
      dimensions: [{ name: 'created', field: 'created_at', type: 'date' }],
      measures: [{ name: 'revenue', aggregate: 'sum', field: 'amount' }],
    }));
    const seen: Record<string, unknown>[] = [];
    const service = new AnalyticsService({
      cubes: [compiled.cube],
      queryCapabilities: () => ({ nativeSql: true, objectqlAggregate: true, inMemory: false }),
      executeRawSql: async () => { throw new Error('should not be reached'); },
      executeAggregate: makeAggregate(seen),
      getReadScope: readScope,
    });
    await service.query({
      cube: 'sales_t', measures: ['revenue'],
      timeDimensions: [{ dimension: 'created', granularity: 'month' }],
    }, ctxA);
    expect(seen[0].filter).toMatchObject({ organization_id: 'org_A' });
  });
});