fix(service-analytics): refuse a caller-named non-column member at the analytics query door in every tier (#21156)

[objectstack-fleet]

Fixes #21156

Clause-②: no

Summary

An analytics query path could carry caller-supplied member text into the native statement, in a tier the field gate does not judge. A member the caller names — in dimensions, timeDimensions, a where leaf, or an order key — that is neither a declared cube member nor a column reference (a field, a relationship path, or '*') names nothing any field gate can attribute to a column. Where the field-level read gate (#20917/#20935/#20965) does not judge the queried object, that member reached the SQL strategy as written.

This refuses such a member at the query door, in every tier, before a strategy compiles it — PERMISSION_DENIED / 403, the same refusal the field-level gate reaches where it judges the object (#20965's fieldReadUnjudgeableError), so there is one judge, one shape, no new error code. The cube author's own declared members are untouched: a declared expression member keeps the read gate's verdict where it applies and the parse's (#20943) otherwise.

The two tiers this closes (by class)

The field-level read gate judges a member only where a reader answers for its object. Two tiers are outside that:

1. No security service — no field reader is wired, so the gate is a no-op.
2. An object the reader answers undefined for — the gate stands down for that object.

In both, a caller-named non-column member previously reached the native statement unjudged. The new gate is provider-independent: it asks only whether the member names a column or a member the cube's author declared, so it applies in every tier.

Shape of the fix

• One check at the query door (analytics-service.ts, beside where the existence gates and namedQueryFields run), so both doors (query and generateSql) and both strategies inherit the verdict by construction. native-sql-strategy.ts is not touched.
• The member is judged against the cube as it existed before ad-hoc inference — an inferred cube mints every caller member into itself, which would otherwise launder caller text into a "declared" member. A probe cube with the base object but no declared members stands in for the inferred case.
• A dataset's own filter is author text and is deliberately not judged here; the existing gate judges it where it applies.
• Runs after the cube/object-existence check, so a non-existent cube still answers 404 first.

Pins and ablation

packages/services/service-analytics/src/__tests__/caller-member-column-reference-gate.test.ts pins, in each tier (no security service; an object the reader answers undefined for) × each strategy × an ad-hoc and a registered cube × each query position: the member is refused PERMISSION_DENIED / 403 on both doors, with nothing executed. A judged object with a real column is the control (same refusal, one door earlier). Positive controls confirm a real column member and a bare count are served in every tier, and a non-regression pin confirms an author-declared expression member still reaches the strategy with no security service.

Every refusal pin was ablated: with the door gate disabled on disk, the 32 tier pins turn red (the member reaches the strategy) while the control, positive and non-regression pins stay green; restored and re-run green. The ablation used the repo's on-disk-verified mutation tool.

Validation

• pnpm --filter @objectstack/service-analytics typecheck — pass.
• pnpm --filter @objectstack/service-analytics test — 158 files, 3648 passed, 21 skipped, 0 failed (at 31a582c9).
• The dispatch-derived gate families (scripts/pm/dispatch-gates.mjs --repo objectstack-ai/objectstack): 62 derived, 62 run, 61 pass; check:dual-build-cjs-loads reports PREREQUISITE NOT MET (it reads a full-repo build this checkout did not produce) — left to CI, not a measured failure.

Acceptance notes

• The ADR-0037 draft-preview path (answerDataset's in-memory branch) evaluates a selection over seed rows in memory and does not reach this door's gate. It compiles no native statement, so it is not a native-statement vector; it keeps the field-level read gate it already runs. Boundary noted, not extended.

Patch round 1 (130e8c0c): the measure position, and the census

Added by the reviewing seat (domain:services seat 2, #21118), from the dev's round-1 report. The dev writes the PR body once.

The measure position. The door gate now also judges a caller-named measure. After the inference rule strips its suffix (the no-suffix default included), it must reduce to count / '*' or to a column reference (a bare identifier or a relationship path). Otherwise it is refused with the same fieldReadUnjudgeableError (PERMISSION_DENIED / 403): one judge, no new error code.

• The judged tier already refused it: the minted measure reads as a declared expression member, and fix(service-analytics): the field-level read gate refuses a cube member that names no field instead of standing down (#20965) #21153's gate catches it.
• The ungated tiers did not refuse it. This round closes them.
• Author-declared measures are untouched. A dotted non-qualifier measure keeps analytics 自动推断路径:measures 上的关系穿越点号 member 仍被剥成基表列 —— owner.region_count_distinct 静默聚合基表 region(#5739 裁决未覆盖的第四个铸造点) #5918's refusal, which fires ahead of this gate.
• native-sql-strategy.ts is still untouched.

Census: every caller-supplied slot of an analytics query that could reach a statement.

Slot	Verdict
cube	already judged: it must name a registered object, and a non-bare name is refused
measures[]	judged by this PR (round 1), plus the existing source-field existence check
dimensions[]	judged by this PR, plus the existing existence check
timeDimensions[].dimension	judged by this PR, plus the existing existence check
timeDimensions[].granularity	not free text: a closed enum, and any other value is refused by the schema
timeDimensions[].dateRange	not an identifier: a closed preset vocabulary, or explicit bounds bound as parameters. An unrecognised string is refused 400
where leaves	the member is judged by this PR, plus the existing check; values are bound parameters
order keys	the member is judged by this PR, plus the existing check; the direction is a closed enum
limit / offset	numbers, not string slots
timezone	not an identifier in the native statement: it resolves date ranges (parameterised comparands) and is forwarded to engine bucketing
segments / having	not slots: the query schema is closed and declares neither

Evidence for this round:

• Measure pins in each tier × strategy × ad-hoc and registered cube × the suffixed and the no-suffix forms: refused on both doors, with nothing executed. Positive controls, and an author-declared expression-measure non-regression pin.
• The ablation of the measure refusal turns exactly the 16 ungated-tier measure pins red, while the judged-tier pins stay green (fix(service-analytics): the field-level read gate refuses a cube member that names no field instead of standing down (#20965) #21153).
• The package suite has 3679 passed. All 62 derived gate families pass, check:dual-build-cjs-loads included.

---

Generated by Claude Code

[github-actions]

📓 Docs Drift Check

This PR changes 1 package(s): @objectstack/service-analytics, touching 8 documentable anchor(s).

⛔ 2 release-owned page(s) name something this change touched. These are read-only:

• content/docs/releases/v14.mdx (via generateSql (symbol, a method of class AnalyticsService))
• content/docs/releases/v17/17-5.mdx (via AnalyticsService (symbol, a top-level class), generateSql (symbol, a method of class AnalyticsService))

content/docs/releases/ is RELEASE-OWNED (AGENTS.md "Documentation Guardrails"): release
notes are written centrally at release time, and a code PR that edits them is the exact PR
that guardrail exists to stop. They are still audited — read-only. If one of them is actually
wrong, file an issue or open a dedicated docs-only PR; do not edit it here.

What this run could not see

• 1 name(s) were too generic to anchor anything (single lowercase words)
• the SDK route bridge reached 54 of 206 client-bound route-ledger rows — the other 152 have no registrar path: tail to select them, so pages documenting THEIR client methods cannot appear above, on this or any run. Of those 152: 0 are remediable by widening that discovery convention (an in-repo file declares the path; the convention did not scan it); 55 are structural — on a ledger where NOT ONE row is declared in-repo, so no discovery change reaches them at any price; 97 are undecided (no in-repo declaration, on a ledger that has other in-repo registrars — absence and an unreadable spelling are not distinguishable here). The rows themselves: node scripts/docs-audit/affected-docs.mjs --bridge-coverage
• a page that states a rule by its inputs shares no identifier with the emitter that implements the rule, so an emitter-only diff cannot list it — not on this run and not on any run. Measured on fix(driver-sql): emit varchar(maxLength) for a text field a declared index keys on #11430: content/docs/protocol/objectql/types.mdx documents the text-family column mapping by the ObjectQL type names it maps FROM (text / textarea / html) while the diff changed createColumn; it went unlisted, and it was the page that diff falsified, in four places. No shared token exists to detect this on, so a rule your change carries has to be re-read by hand in the pages that restate it.
• a key NAME is not a key, so the hand re-read the line above prescribes can land on the wrong schema. The same spelling is authorable on one governed type and a [REMOVED] tombstone on another for each of active, aria, joins, objects, template, tools and version (censused on [finding] tools is a key on BOTH AgentSchema (tombstoned, dead) and SkillSchema (live, cloud-attested), so a name-based search attributes skill examples to the agent key — it produced a false stop-the-line alarm on PR #19059 #19093 over the liveness ledger's governed types, top-level keys); nothing in a search result distinguishes the two, so a grep hit on a LIVE example reads as evidence about the DEAD key. Measured on fix(spec): the agent.tools liveness row says dead — it claimed live on a key the schema tombstoned #19059: content/docs/ai/agents.mdx was reported as contradicting the agent.tools tombstone over its tools: example at :161, which is inside the defineSkill({ block opened at :155 — the page was already correct. Settle ownership by PARSING the value against both schemas, never by the name: that literal PASSES SkillSchema, and as an AgentSchema it FAILS at tools with the tombstone prescription. ⛔ These names are not the whole class — a key retired through a .strict() guidance map leaves no tombstone in the walked shape and none of them here (tool.category, live as AIToolDefinition.category).

Coarse fallback — 10 page(s) merely mention a changed package (the pre-#9192 predicate, kept for the deliberately-wide backstop): node scripts/docs-audit/affected-docs.mjs --json 2c1cef3345738b5f2486eed5b0608687dba36f11 → packageMentionDocs.

Which tree this was computed on

This run read content/docs from ff256647d9f2eb8878b785b93f0e488beba8482a — the merge of head 52d6bfac9e2ded1c7328a2d9432ab3e32a13d0cc into base 2c1cef3345738b5f2486eed5b0608687dba36f11, which is what actions/checkout gives a pull_request run. Not the PR head.

A worktree cut from an older main holds a different content/docs, so re-deriving there can legitimately return a different list — that is a different tree, not a wrong row. To answer on the same tree:

# while this PR is open — GitHub drops the merge commit once it closes
git fetch origin ff256647d9f2eb8878b785b93f0e488beba8482a && git checkout ff256647d9f2eb8878b785b93f0e488beba8482a
# afterwards, rebuild it from the two parents, which stay fetchable
git fetch origin 2c1cef3345738b5f2486eed5b0608687dba36f11 52d6bfac9e2ded1c7328a2d9432ab3e32a13d0cc && git checkout -B drift-repro 2c1cef3345738b5f2486eed5b0608687dba36f11 && git merge --no-ff 52d6bfac9e2ded1c7328a2d9432ab3e32a13d0cc

node scripts/docs-audit/affected-docs.mjs --json 2c1cef3345738b5f2486eed5b0608687dba36f11

⚠️ That checkout carried uncommitted changes, so the commit above does not fully identify what was read.

Advisory only, and a precision-first one (#9192): a page is listed because it names a
symbol, wire route or SDK method this diff touched — not because it mentions a changed
package. Each row says which anchor put it there, so a wrong row is reportable rather than
merely annoying. To re-verify, run the docs-accuracy-audit workflow scoped to these files:
node scripts/docs-audit/affected-docs.mjs 2c1cef3345738b5f2486eed5b0608687dba36f11 → pass the list as
args.docs, on the commit named under Which tree this was computed on.