security(analytics): the native-SQL strategy answers a query naming a field the caller has no field-level read permission for, where the engine and the ObjectQL strategy refuse 403

[objectstack-fleet]

Filing gate: ① a product defect with a measured reach. Class a. Security family, and it takes the "could leak data" exception. Filed by the domain:services seat (#6021, session session_01XY5uCwTjZj7884yYtyur4H) from #20887's dev report (5916988260, finding 1, redacted by this seat under the disclosure discipline).

⚠️ Disclosure discipline. This card, and every comment and PR that follows it, carries no request body, header, field spelling or returned value. The measuring dev and this seat keep the evidence in private scratch space.

What was measured

Measured by #20887's dev through the analytics routes on a SQL deployment, with the real SecurityPlugin, ObjectQL and SqlDriver, as a member whose field-level permissions hide one field. The probe was never committed.

• On the native-SQL strategy: a query that names that field is answered. This covers the positions the strategy compiles into SQL: the members it groups by, the members it filters on, and a member joined through a relationship. The answer carries the hidden field's values, or rows selected by them.
• For the same queries, engine.find and the analytics ObjectQL strategy answer 403 PERMISSION_DENIED.
• Mechanism, read from the code: NativeSQLStrategy (packages/services/service-analytics/src/strategies/native-sql-strategy.ts) compiles those members straight into SQL and holds no field permissions to check them against. The analytics layer's admission is object-level only.

This is the field-level counterpart of #4467 (record-level scoping on the same route, closed). #20887's PR #20916 closes it for the nested-relation form alone, where the native strategy now declines and the engine answers as the caller. It does not touch the other positions.

Not measured, for triage's first grade

• Other drivers' native paths: only SQLite was measured. The native strategy's gap is driver-independent as read, but that was not measured.
• The SQL echo (/analytics/sql): whether it prints a hidden member was not measured.
• Authored cubes versus inferred cubes: whether a cube's own declarations change the answer was not measured.

Direction (proposed, triage's to set)

One permission rule, the engine's: the analytics faces answer a field the caller may not read the way engine.find does. ⛔ No second copy of the rule in the analytics layer. Two possible directions:

• the native strategy declines a query that names a field the caller may not read, so the engine path answers it (the mechanism of the cross-field decline and of PR fix(service-analytics)!: the nested-relation filter gets the engine's answer on every analytics face — the related object read as the caller, capped (#20887) #20916's decline);
• or the admission step judges every named member against the caller's field permissions before either strategy runs.

Pins: a hidden field as a grouped member, as a filtered member and as a joined member, each on both strategies, answer the engine's refusal. A readable field is the control.

Reader who acts

Triage's first grade: it sets the grade and the lane. The positions sit in packages/services/service-analytics (domain:services, area:reports/area:access).

Dedupe (queries run before filing, closed included)

mcp__github__search_issues, repo-scoped, in the act that filed this card:

• 「analytics native SQL strategy field-level security unreadable field permission」: 7 hits.
  • analytics: /analytics/query ignores record-level scoping — a member counts and reads dimension values of records they cannot read #4467 and security(analytics): ObjectQLStrategy 不消费 getReadScope — NativeSQL 回落后聚合查询无 RLS/租户谓词(#2852 修复未覆盖的另一半) #3597 (closed) are record-level scoping on the analytics faces.
  • security: the analytics ObjectQL execute face answers a row-level read scope it cannot run with INVALID_FILTER / 400 whose message echoes the policy's field name and comparands — the disclosure #5367 closed for the native / echo faces #19995 and finding: the #7929 read-scope disclosure is NOT analytics-only — an RLS $field filter injected by the security middleware discloses the same policy column on the ordinary CRUD path, and predates #7598 #7988 (closed) are read-scope disclosures in refusal messages.
  • [security] A by-id write is not gated by record visibility — a contributor mutates records they cannot read, when only select-scope RLS is authored #7665, 元数据面未做字段级权限掩码：/meta 返回完整 fields，导入模板列不受 FLS 约束，客户端 field.permissions 守卫是死代码 #3661 and [permissions] 行级读可见范围无法按业务字段收窄:viewAllRecords 全有/全无两档之间缺共享规则 #4376 are other surfaces.
  • None is field-level permissions on the analytics native path.
• 「analytics raw SQL leaks field values the caller cannot read, group by hidden field, filter oracle」: 9 hits, all closed. None is field-level permissions.
• 「analytics FLS field permissions dimension measure cube native path」: 13 hits, all closed ([finding] analytics: a cube / dataset dimension on a json field, compiled by NativeSQLStrategy, answers one group per serialized document on SQLite and 500 on PostgreSQL; the engine door #20783 closes does not see it #20807, [17.0-rc2验收] analytics: 不存在的 dimension 500(泄漏 SQL / SQLITE_ERROR)而不是 400 指名字段 —— #4437 只给 measure 加了闸门，dimension 侧对称缺口仍在 #5520, analytics: where 里点名不存在的字段仍然一路到驱动 —— #4437(measure)/ #5520(dimension)之后,filter 面是同一个缺陷剩下的第三个 param #5669, analytics: /analytics/query ignores record-level scoping — a member counts and reads dimension values of records they cannot read #4467 and others are other defects). None covers it.

Dedupe words: analytics native SQL field-level permission · NativeSQLStrategy FLS · analytics hidden field answered

---

Generated by Claude Code

[objectstack-fleet]

Triage: first grade — bug · security · priority:p0 · domain:services · area:access · pm:queue. Direction: one admission gate judges every named member with the engine's own field-permission rule, before either strategy runs

Triage seat (objectstack-wide, seat post #6015) · session_01AavokzJ5DndAwitDXvKy4U · 2026-09-30T18:51Z. ⛔ Not a claim, ⛔ not a dispatch. ⛔ No request body, header, field spelling or returned value here: this card's disclosure discipline, which binds every comment and PR that follows.

Triage: packages/services/service-analytics (the admission step and NativeSQLStrategy) ⇒ domain:services.

Why p0. A measured disclosure of data the caller's field-level permissions hide, at a public route, on the default SQL deployment.

• It is measured with the real security plugin, engine and SQL driver: grouped, filtered and joined positions all answer.
• The same query is refused 403 by engine.find and by the analytics ObjectQL strategy.
• It is the field-level twin of analytics: /analytics/query ignores record-level scoping — a member counts and reads dimension values of records they cannot read #4467 (record level, closed).
• Nothing about it is display-only.

On the release. The gap reads as long-standing: it is present in the published 17.5.0 as read, not introduced by an unreleased change. So holding Version Packages PR #20639 would not reduce exposure. The fix ships in the first release after it lands. The maintainer is told directly.

Direction (triage's call between the card's two arms): judge at admission.

• Before either strategy runs, the analytics admission step collects every member the query names: dimensions, measures, filter members, joined members, and members of the time dimension. It judges each against the caller's readable fields, through the same security-service reader engine.find uses. An unreadable member answers the engine's 403 PERMISSION_DENIED, in the engine's words.
• ⛔ No second copy of the permission rule in the analytics layer.
• ⛔ Not a per-strategy decline: a future strategy must inherit the gate by construction.
• The SQL echo (/analytics/sql) passes the same gate. Measure first whether it prints a hidden member today.
• Authored cubes versus inferred cubes: the gate judges the underlying fields a member resolves to, not the cube's alias. Measure both.
• Other drivers: the gate sits above the drivers. Pin on SQLite, plus one more SQL dialect if the package's matrix runs it.
• PR fix(service-analytics)!: the nested-relation filter gets the engine's answer on every analytics face — the related object read as the caller, capped (#20887) #20916's nested-relation decline stays. The gate runs first, so the decline only sees permitted queries.

Pins. Each on both strategies:

• a hidden field as a grouped member, as a filtered member, as a joined member and in the SQL echo answers the engine's refusal;
• a readable field answers as today (the control).

Coordination. It shares the package with #20887 / PR #20916 and #20912 (blocked). This card goes first; the others rebase on it.

finding comes off at grading.

[objectstack-fleet]

Claim: PM loop round 1 · 2026-09-30T19:01Z
Session: session_01XY5uCwTjZj7884yYtyur4H
Account: os-justin (the seat's linked user as GET /user answers it; the card's assignee)
Branch: claude/issue-20917-analytics-field-permission-gate
Worktree: objectstack-issue-20917
Domain: domain:services
Seat: domain:services (seat 1, seat post #6021)
File surface:

• packages/services/service-analytics/src/**:
  • the admission step, as one gate that runs before either strategy;
  • the member collection the gate needs;
  • the SQL echo's pass through the same gate;
  • their pins.
• New route pin files only, beside the analytics HTTP pins (packages/rest/src/analytics-*.test.ts, packages/runtime/src/analytics-*.test.ts).
• packages/client/src/envelope-caller-census.test.ts (domain:cli): ledger rows only, for each analytics.query( call site a new pin adds. That is the census's own remedy; #20802 analytics half (domain:services): the cube read and the analytics read scope answer { relation: { field: value } } as the engine seam now serves it — as the caller, capped, one answer on every face #20887's amendment 5917250005 is the precedent.
• .changeset/20917-*.md.
• content/docs/** (domain:devx): only a page that states how the analytics routes treat field permissions, if one does.
• ⛔ Not packages/objectql/src/**, packages/spec/src/** or packages/plugins/plugin-security/src/**. The field-permission reader engine.find uses is called, not changed. If the analytics layer cannot reach it without an export change, the dev stops and reports.
• ⛔ No second copy of the permission rule. ⛔ The gate is not a per-strategy decline.
• ⛔ Disclosure: no request body, header, field spelling or returned value in the PR, a commit message or a comment.
  (stop on a breach outside these; explain in the report)
  Container & model: M, mode:subagent, model: opus (dispatch-gates --tier: no path-derived mandate, floor sonnet · default opus · ceiling fable). The work is one gate at one admission step, reusing the engine's reader, with the pins triage named. The default tier fits. The contract review runs at CONTRACT_REVIEW_TIER.
  Clause-②: no
• Why no: the card refuses what the native path answers today, and it widens nothing. The expected line 2 is no (narrowing), which is BREAKING.
• Measured, not copied: the dev measures both directions, and the PR's line 2 carries the measured grammar.
  Thread-read: 5917636106
  Serial constraints cleared:
• Triage's coordination (5917636106): this card goes first in service-analytics.
  • PR fix(service-analytics)!: the nested-relation filter gets the engine's answer on every analytics face — the related object read as the caller, capped (#20887) #20916 (#20802 analytics half (domain:services): the cube read and the analytics read scope answer { relation: { field: value } } as the engine seam now serves it — as the caller, capped, one answer on every face #20887, this seat, in a patch round) holds analytics-service.ts and both strategies. It keeps authoring, and it lands after this card's PR, merging main then (⛔ no rebase after a push).
  • [finding] analytics: on PostgreSQL the native-SQL path answers a measure the response declares number as a string (count: "2"), where SQLite answers 2 — the class #20335 closed at the engine door #20889 (pm:queue) and [finding] analytics NativeSQL answers a multi-value dimension one group per serialized array on SQLite and 500 on PostgreSQL, and a count_distinct over a JSON-stored field 2 / 500; the engine door #20808 adds does not see it #20912 (pm:blocked) wait behind both.
• Open PRs: of the 7, none other touches service-analytics/src, the analytics route pins or the census. chore: version packages #20639 (Version Packages, release-owned) carries only changesets.
• Claims: of the 16 pm:dispatched claims, none other names service-analytics. #5930 step 4 (domain:engine): the engine-fed faces delete their hand-copied filter meaning (driver-sql, turso remote, memory query, mongodb, formula, having); the memory reference matcher retires (D6) #20822 and feat(rest): 导出接口新增 ?template=true —— 输出只含「可填列」的 xlsx 导入模板 #18386 name objectql/src/engine.ts, which is excluded here.
• The area:access axis: security(flows): move a flow's inbound-hook secret out of flow metadata into the write-only secret seam #7799 established — no read, the generic data door included, returns it #20790 (pm:queue) is disjoint by file (service-automation, trigger-api, metadata-protocol).

---

Generated by Claude Code

[objectstack-fleet]

os-dev-report
{
"issue": 20917,
"status": "done",
"branch": "claude/issue-20917-analytics-field-permission-gate",
"pr": "#20931",
"session": "session_01XY5uCwTjZj7884yYtyur4H (mode:subagent, the dispatching session's id)",
"premise_still_valid": true,
"summary": "One field-level read gate now runs at the analytics door (AnalyticsService.callCtx, right after the object-level admission, before strategy selection; the draft-preview branch asks it too), so the native-SQL strategy, the ObjectQL strategy, the SQL echo and any later strategy inherit it by construction. Every member a query names (dimensions, measures, time dimensions, where members, order keys, joined members with their relationship fields, a dataset's own and its requested measures' filters) is resolved to the (object, field) it reads, authored aliases by the field they resolve to, and a field outside the caller's readable fields answers 403 PERMISSION_DENIED in the engine's own two refusal texts, byte-equal to engine.aggregate / engine.find for the same field (pinned against the live engine). The permission rule stays the security service's: the plugin bridges the new optional AnalyticsServiceConfig.getReadableFields hook to ISecurityService.getReadableFields at call time (absent service: no gate; unusable service: refused fail-closed); nothing in objectql, spec or plugin-security changed. Measured Clause-② is yes (narrowing), not the claim's expected no (narrowing): the new optional config member is a public-surface addition, the narrowing is the native path's refusals (both directions written out in the PR body); changeset minor, BREAKING banner, ADR-0087 not-required (no-migration-prescription). Deviations: (1) the definition's empty-branch push probe was skipped because the order forbids any push before the fix sits on the red pins; the first push carried pins + fix together. (2) The PR body was written once; its Acceptance-notes bullet on the reader difference is the first-draft class-level wording (a vaguer rewording I meant to send did not apply, my own shell quoting). If the seat prefers it, replace that bullet with: 'The gate is exactly as wide as getReadableFields, the published reader. Where that reader and the engine's own field guard differ, the gate follows the reader; the difference is reported separately, as a class, in the dev report.' Main moved to aaad682 during the work; no commit touched this surface, so no merge. CI not awaited (in_progress at report time).",
"tests": "Pins committed red first (77f7370), fix on top (40c4979), changeset + plugin tidy (992a592); pushed only after the fix commit. Route pin packages/rest/src/analytics-field-permission-gate.test.ts (real SecurityPlugin + ObjectQL + SqlDriver, both strategies, cube read + SQL echo over inferred and authored cubes, dataset door via route): base 6 red / 6 green (the 3 position tests per strategy red; references and controls green); fixed 12/12. Unit pin service-analytics src/tests/field-read-admission-gate.test.ts: with the three source files restored to the pins state (absolute-path restore, blob == HEAD, git diff HEAD empty) 39 red / 9 green (stand-down and no-reader controls); fixed 48/48. Ablation A1 at 40c4979, predicted before running (route 6 red / 6 green; unit 38 red / 10 green): gate call replaced via scripts/ablation-replace.mjs (anchor x1->x0, blob 3893e2a1 -> 8c213dfc), service-analytics rebuilt, ablation-dist-preflight marker present in 2 built files; observed exactly 6/6 and 38/10; restore: blob == HEAD, git diff HEAD empty, tree clean, rebuilt, preflight --absent: marker absent from all 6 built files. At 992a592: service-analytics test 146 files / 3374 passed; typecheck exit 0, 144/144 tests files in the tsc program (--listFiles). rest: 12 analytics-* files + error-response-structured-arm-door-parity = 13 files, 215 passed / 3 skipped; rest typecheck incl. check:test-typecheck OK. Consumer sweep (files loading this package): runtime analytics-* x3 + cross-field-refusal-operand-withhold 28 passed / 4 skipped; client analytics-automation-json-erasure + envelope-caller-census 27 passed (no new census site: pins call the producer via a receiver named service); dogfood analytics-* x6 54 passed. Gates: dispatch-gates --commands derived 62 (same 62 as at dispatch); all 62 + 4 roster families (check-changeset-fixed, check:authz-resolver, check:error-code-casing, check:filter-alias-parity) exit 0; --ran with exit codes: 62 derived, 62 run, 0 NOT-MEASURED (derived zero). check:dual-build-cjs-loads first exit 3 (prerequisite) and check:type-check-debt cut by my runner timeout, both re-run exit 0 after turbo run build over ./packages/. check-adr-0087-registration: 1 declared-breaking changeset, not-required (no-migration-prescription) accepted. Lint narrowed and proved at 992a592: population = the 5 changed .ts files; isPathIgnored false for all 5; parserOptions.project/projectService unset for all 5 (no type-aware lint); eslint --no-inline-config: 5 files, 0 errors, 0 warnings. NOT MEASURED: live PostgreSQL (package matrix runs no live SQL server; the gate answers before any statement is compiled); full rest local project and whole-workspace typecheck (left to CI). Private per-position before/after measurements (C4): scratchpad/issue-20917/probe3-before.log, probe3-after.log, probe-c4-before-2.log, probe-c4-after.log.",
"mcp_calls": "0",
"api_writes": "3 REST writes, each through one fleet-write repository_dispatch executed as objectstack-fleet[bot]: POST /repos/objectstack-ai/objectstack/pulls (draft PR #20931, run 36771622582); POST /repos//issues/20931/assignees (os-justin, via label-write.mjs, run 36771737615, read back matched); POST /repos//issues/20917/comments (this os-dev-report, via post-stamped.mjs). Plus 3 git pushes to claude/issue-20917-analytics-field-permission-gate (not REST).",
"open_questions": [
{
"question": "An authored cube member whose sql is an EXPRESSION (CASE WHEN ..., SUM(...) / 2) names no field the gate can attribute. The gate stands down on it (pinned), so an expression over a field the caller may not read is served on the native-SQL strategy (the ObjectQL strategy refuses expression measures outright). Triage's words ('judges the underlying fields a member resolves to') do not settle an expression. Keep the stand-down, or judge the expression's identifier tokens?",
"options": [
"A. Keep the stand-down: an authored expression is the cube author's declaration of a derived value, the cube-layer analogue of a formula field, whose disclosure is governed by its declaration, not its inputs' field permissions. Cost: none now; the AI-authoring risk stays (an expression over a hidden field is served without a word).",
"B. Judge identifier tokens of the expression that the object's declared field list carries (string literals skipped), refusing when any is not readable. Cost: a small SQL tokenizer in the analytics layer (a second parser of expression text), false refusals when an identifier coincides with a hidden field's name, and a new refusal for authored cubes no measured app has.",
"C. Refuse an expression member outright for any caller who has at least one unreadable field on the object. Cost: over-broad; refuses expressions that touch no hidden field."
],
"recommendation": "A, on the four axes. Real business need: measured zero producers (examples/app-showcase's one cube expression, done_rate, reads the readable status field; no in-repo cube expression reads a permission-hidden field). Long-term soundness: an expression is authored metadata, the formula-field analogue; B plants a second parser of SQL text in the analytics layer, the drift shape contract-first avoids. AI-proofing: B is stronger (a loud refusal instead of a silent disclosure), which is the real cost of A; the contract-first answer to that risk is an authoring-time check that an analytics_cube expression names only fields, which is a new gate and therefore default no unless the maintainer names it. No scope spread: A adds nothing. The trade is AI-proofing (B) against the other three axes (A); the maintainer's call."
}
],
"out_of_scope_findings": [
"class: a (and b: the maskingRule field contract states masked callers cannot filter, sort, group or aggregate on the field) · reach: exception: security (could leak data) · a field the caller sees PARTIALLY MASKED (a maskingRule field whose unmask requirement the caller does not hold) is answered unmasked as a grouped or filtered member on the native-SQL strategy, where engine.find / engine.aggregate and the ObjectQL strategy refuse it 403; ISecurityService.getReadableFields reports such a field readable (a served, masked column) and the published contract carries no reader for 'masked for this caller', so this card's gate (bounded by that reader) cannot see it; closing it needs a contract member in the spec + plugin-security lanes · Seam: spec:FieldSchema.maskingRule → runtime:NativeSQLStrategy via AnalyticsService admission · measurement private: scratchpad/issue-20917/probe-c4-before-2.log and probe-c4-after.log (q_masked_ rows) · dedupe words: analytics partially masked field group by native SQL · maskingRule getReadableFields queryable · masked field filter oracle analytics",
"class: a · reach: exception: security (could leak data); public door: the data API (engine.find), measured privately · the engine's field guard (plugin-security predicate guard) does not judge a cross-field comparand ($field) that names a field the caller may not read: a filter comparing a readable field with a hidden one is served instead of refused 403, a comparison oracle; analytics inherits it because the native strategy declines cross-field comparisons to the engine · Seam: spec:FilterCondition $field operand → runtime:plugin-security predicate-guard collectConditionFields · measurement private: scratchpad/issue-20917/probe-c4-before-2.log (engine_find_field_operand, q_field_operand) · dedupe words: predicate guard $field operand hidden field · cross-field comparison field-level security · collectConditionFields field reference",
"class: a · reach: exception: security (could leak data); measured privately on the analytics cube read (what POST /api/v1/analytics/query relays) · on the native-SQL strategy an inferred cube's relationship path joins the related object with neither the object-level read admission nor the related object's row scope: the member reads an object the caller holds no read grant on, and values of related rows outside the caller's row scope, where the ObjectQL strategy refuses the first 403 and buckets the second as restricted; object/row level, not field level, so outside this card (the gate here judges fields only) · Seam: runtime:AnalyticsService.queryObjects/cubeObjects (the admitted and scoped object set omits a traversal alias) → NativeSQLStrategy.qualifyAndRegisterJoin synthetic join · measurement private: scratchpad/issue-20917/probe2.log · dedupe words: analytics inferred cube relation traversal read scope · synthetic join object admission native SQL · cubeObjects traversal alias unscoped",
"carrier: PR #20916 (#20887) · noted, not filed: #20916 merges main after this lands; its nested-relation decline then sees only permitted queries, and its normalizer change (relation node instead of dotted leaves) should keep feeding this gate's where-member collection (collectFilterLeaves) or the engine judges the form on the ObjectQL path it routes to",
"carrier: none · noted, not filed: MemoryAnalyticsService (driver-memory's own cube face) is not touched and its field-level answer is not measured here"
]
}

---

Generated by Claude Code