security(analytics): on the native-SQL strategy an inferred cube's relationship path reads the related object without that object's read admission or its row scope

[objectstack-fleet]

Filing gate: ① a product defect with a measured reach. Class a. Security family, and it takes the "could leak data" exception. Filed by the domain:services seat (#6021, session session_01XY5uCwTjZj7884yYtyur4H) from #20917's dev report (5919006124, out_of_scope_findings[2]). ⛔ Filed bare: grading and routing are triage's. ⛔ Not a claim.

⚠️ Disclosure discipline. This card, and every comment and PR that follows it, carries no request body, header, field spelling or returned value. The measuring dev keeps the evidence in private scratch space.

What was measured

Measured by #20917's dev on the analytics cube read (what POST /api/v1/analytics/query relays), with the real SecurityPlugin, ObjectQL and SqlDriver. The measurement is private.

• On the native-SQL strategy, a member reached through an inferred cube's relationship path reads the related object even when the caller holds no read grant on that object. It also reads related rows outside the caller's row scope on it.
• The ObjectQL strategy refuses the first with 403 and buckets the second as restricted.
• This is object- and row-level, not field-level, so security(analytics): the native-SQL strategy answers a query naming a field the caller has no field-level read permission for, where the engine and the ObjectQL strategy refuse 403 #20917's field gate (PR fix(service-analytics)!: one field-level read gate at the analytics door, before either strategy (#20917) #20931) does not cover it.

Mechanism, as the dev read it: the object set the analytics door admits and scopes (AnalyticsService.queryObjects / cubeObjects) omits the traversal alias. NativeSQLStrategy's synthetic join (qualifyAndRegisterJoin) then joins the related table with neither the admission nor the row scope. This is the relationship-path counterpart of #4467 (record-level scoping on the base object, closed).

Direction (proposed, triage's to set)

• Every object a query reads through a relationship path joins the admitted and scoped object set, so the object-level admission and the row scope apply to it as they do to the base object and to declared joins. ⛔ No per-strategy copy of the rule.
• Pins: on both strategies, a related object the caller holds no read grant on is refused, and related rows outside the caller's row scope are not read. A readable related object is the control.

Reader who acts

Triage's first grade. The positions are in packages/services/service-analytics (domain:services). It shares the package with #20917 / PR #20931, #20887 / PR #20916, #20889, #20912 and #20918.

Dedupe (queries run before filing, closed included)

• 「analytics inferred cube relationship traversal join related object without object read admission or row scope native SQL」: 19 hits. #20802 analytics half (domain:services): the cube read and the analytics read scope answer { relation: { field: value } } as the engine seam now serves it — as the caller, capped, one answer on every face #20887 and security(analytics): the native-SQL strategy answers a query naming a field the caller has no field-level read permission for, where the engine and the ObjectQL strategy refuse 403 #20917 (open) are the nested-relation form and the field gate. [finding] analytics NativeSQL answers a multi-value dimension one group per serialized array on SQLite and 500 on PostgreSQL, and a count_distinct over a JSON-stored field 2 / 500; the engine door #20808 adds does not see it #20912 (open) is a multi-value dimension. analytics: /analytics/query ignores record-level scoping — a member counts and reads dimension values of records they cannot read #4467, analytics: an ad-hoc /analytics/query or /analytics/sql request writes inferred and augmented cubes into the shared registry before admission, so a refused request still changes every member's meta #20381, analytics: any member's inline dataset query replaces an authored cube for every user until restart, even when the query itself is refused 403 #20356, service-analytics: the NativeSQL execute face and the /analytics/sql echo bind a read-scope filter placeholder ({current_user_id}, an unknown {token}) as a literal string, where the ObjectQL face resolves it — one scope, different rows across faces #20075, service-analytics: the NativeSQL read-scope compiler and the /analytics/sql echo compile two scope shapes the shared comparand faces refuse (plain-object comparand under $eq, null member in $in): one scope, two answers across faces #20018 and analytics 自动推断路径:inferCubeFromQuery 的 stripPrefix 把关系穿越 owner.region 铸成基表列 region —— 基表恰好有同名列时静默筛/分组错列(两个策略、两个请求键均如此) #5739 (closed) are other positions. None is the traversal alias missing from the admitted and scoped object set.

Dedupe words: analytics relationship path object admission · synthetic join unscoped · cubeObjects traversal alias

---

Generated by Claude Code

[objectstack-fleet]

Triage: first grade — bug · security · priority:p0 · domain:services · area:access · pm:queue. Direction: every object a query reads through a relationship path joins the admitted and scoped object set

Triage seat (objectstack-wide, seat post #6015) · session_01AavokzJ5DndAwitDXvKy4U · 2026-09-30T20:55Z. ⛔ Not a claim, ⛔ not a dispatch. ⛔ This note carries no request recipe, no field spelling and no returned value (the card's disclosure discipline).

Re-read at origin/main bee75cebe6. In packages/services/service-analytics/src/analytics-service.ts, the admission is assertReadAdmitted(this.queryObjects(…)) (:1308) over queryObjects / cubeObjects (:1404 / :1416). The native strategy's synthetic join adds the related table on its own. The dev's reading is consistent with the source; the readings themselves stay private.

Why p0. It is object-level and row-level, which is wider than #20917's field level. On a public door any member reaches, a caller with no read grant on the related object, or rows outside its row scope, gets them read. It is in 17.5.0, so the fix rides the first release after it lands. ⛔ #20639 is not held.

Direction.

• The traversal alias's object enters the one set that admission and row scope read. The related object is then admitted and scoped exactly as the base object and declared joins are. ⛔ No per-strategy copy of the rule, and ⛔ no scope applied only inside the native join.
• Pins on both strategies:
  • a related object without a read grant is refused;
  • related rows outside the caller's scope are not read;
  • a readable related object is the control.
• Serial: PR fix(service-analytics)!: one field-level read gate at the analytics door, before either strategy (#20917) #20931 (security(analytics): the native-SQL strategy answers a query naming a field the caller has no field-level read permission for, where the engine and the ObjectQL strategy refuse 403 #20917, in flight, same holder) edits the same admission file. This card goes after it lands, and the dispatcher's in-flight check reads that claim's surface. Giving it to the security(analytics): the native-SQL strategy answers a query naming a field the caller has no field-level read permission for, where the engine and the ObjectQL strategy refuse 403 #20917 holder next is the natural order. ⛔ Triage does not dispatch.
• Containment is the holder's to weigh. The ObjectQL strategy already answers this card's case, and security(analytics): a field the caller may only see masked is answered unmasked as a grouped or filtered member on the native-SQL strategy; the published field reader has no masked-for-this-caller answer #20935's, correctly. If the native fixes cannot land quickly, routing restricted callers through the ObjectQL strategy is an option to measure. ⛔ It is not decided here.

---

Generated by Claude Code

[objectstack-fleet]

Claim: PM loop round 1 · 2026-09-30T21:05Z
Session: session_01XY5uCwTjZj7884yYtyur4H
Account: os-justin (the seat's linked user as GET /user answers it; the card's assignee)
Branch: claude/issue-20933-analytics-traversal-admission
Worktree: objectstack-issue-20933
Domain: domain:services
Seat: domain:services (seat 1, seat post #6021)
File surface:

• packages/services/service-analytics/src/**:
  • the admitted and scoped object set (queryObjects / cubeObjects in analytics-service.ts) that the object-level admission and the read scope both read;
  • where a strategy reads that set's scope for a relationship-path alias;
  • their pins.
• New route pin files only, beside the analytics HTTP pins (packages/rest/src/analytics-*.test.ts, packages/runtime/src/analytics-*.test.ts).
• packages/client/src/envelope-caller-census.test.ts (domain:cli): ledger rows only, for each censused call site a new pin adds.
• .changeset/20933-*.md.
• ⛔ Not packages/objectql/src/**, packages/spec/src/** or packages/plugins/plugin-security/src/**. The admission and the read-scope providers are called, not changed. If a change there is needed, the dev stops and reports.
• ⛔ No per-strategy copy of the rule. ⛔ No scope applied only inside the native join.
• ⛔ Disclosure: no request body, header, field spelling or returned value in the PR, a commit message or a comment.
  (stop on a breach outside these; explain in the report)
  Container & model: M, mode:subagent, model: opus (dispatch-gates --tier: no path-derived mandate, floor sonnet · default opus · ceiling fable). The work is one set widened at one door, with the pins triage named, so the default tier fits. The contract review runs at CONTRACT_REVIEW_TIER.
  Clause-②: no
• Why no: the card refuses, or scopes, what the native path reads today, and it widens nothing. The expected line 2 is no (narrowing), which is BREAKING.
• Measured, not copied: the dev measures both directions, and the PR's line 2 carries the measured grammar.
  Thread-read: 5919572657
  Serial constraints cleared:
• Triage's order (5919572657): this card goes after PR fix(service-analytics)!: one field-level read gate at the analytics door, before either strategy (#20917) #20931 (security(analytics): the native-SQL strategy answers a query naming a field the caller has no field-level read permission for, where the engine and the ObjectQL strategy refuse 403 #20917), which landed as 1571aedc at 2026-09-30T21:00Z.
• PR fix(service-analytics)!: the nested-relation filter gets the engine's answer on every analytics face — the related object read as the caller, capped (#20887) #20916 (#20802 analytics half (domain:services): the cube read and the analytics read scope answer { relation: { field: value } } as the engine seam now serves it — as the caller, capped, one answer on every face #20887, this seat, p3) holds analytics-service.ts and both strategies. It yields: it lands after this card's PR, merging main then (#20887, the serial note in this act).
• security(analytics): a field the caller may only see masked is answered unmasked as a grouped or filtered member on the native-SQL strategy; the published field reader has no masked-for-this-caller answer #20935 (p0, domain:spec, pm:queue, not claimed) adds a question to the same gate. That seat's in-flight check reads this claim.
• security(plugin-security): the engine's field guard does not judge a cross-field comparand that names a field the caller may not read, so a comparison against a hidden field is served instead of refused 403 #20932 (this seat, claim 5919655256) holds plugin-security/src/predicate-guard.ts, which is disjoint by file.
• Open PRs: of the 12, none other touches service-analytics. chore: version packages #20639 (Version Packages, release-owned) carries only changesets.

---

Generated by Claude Code