|
| 1 | +// Copyright (c) 2026 ObjectStack. Licensed under the Apache-2.0 license. |
| 2 | + |
| 3 | +/** |
| 4 | + * [#5669] `POST /analytics/dataset/query` — the caller's own view of the `where` |
| 5 | + * source-field gate. |
| 6 | + * |
| 7 | + * The third and last param of the defect #4437 (measures) and #5520 (dimensions) |
| 8 | + * closed one key at a time. A filter naming a field the object does not have |
| 9 | + * reached the driver, came back as a driver error with no envelope, and this |
| 10 | + * route answered `500 ANALYTICS_QUERY_FAILED` for what is a plain typo — the |
| 11 | + * same classification fault, on the request key most likely to carry a |
| 12 | + * hand-typed field name. Measured on this harness against `origin/main`: |
| 13 | + * |
| 14 | + * ``` |
| 15 | + * {"dataset":…,"selection":{"measures":["account_count"],"runtimeFilter":{"bogus_col":"x"}}} |
| 16 | + * → SELECT COUNT(*) AS "account_count" FROM "crm_account" WHERE bogus_col = $1 |
| 17 | + * → 500 ANALYTICS_QUERY_FAILED |
| 18 | + * ``` |
| 19 | + * |
| 20 | + * Why this file exists next to the service-side pin |
| 21 | + * (`service-analytics`'s `where-source-field-gate.test.ts`): "the service throws |
| 22 | + * the right shape" and "the caller receives it" are different facts, separated by |
| 23 | + * this route's catch. The gate needs no rest-layer change at all — #5352's |
| 24 | + * envelope branch ① reads `code` + 4xx `status` and carries the verdict through — |
| 25 | + * and that is precisely the claim worth pinning end to end, because it is a |
| 26 | + * claim about a seam neither side's unit tests cross. So the provider here is a |
| 27 | + * REAL `AnalyticsService` whose driver double fails the way SQLite/knex does |
| 28 | + * (statement prefixed to the cause), not a mock that would assume half the seam. |
| 29 | + * |
| 30 | + * `runtimeFilter` is the load-bearing input for the same reason |
| 31 | + * `analytics-filter-refusal-envelope.test.ts` uses it: it is the |
| 32 | + * presentation-scope filter a dashboard widget carries, i.e. exactly the field |
| 33 | + * an author typos. |
| 34 | + * |
| 35 | + * ## Reverse verification, direction predicted BEFORE running |
| 36 | + * |
| 37 | + * Remove the three `assertWhereFields` calls from `ensureCube` and rebuild |
| 38 | + * `@objectstack/service-analytics` (this file exercises the BUILT package — |
| 39 | + * mutating sources without rebuilding proves nothing here): the three rejection |
| 40 | + * cases go RED, answering `500 ANALYTICS_QUERY_FAILED` again, while the positive |
| 41 | + * control and the `INVALID_FILTER` case — neither of which this gate produces — |
| 42 | + * stay GREEN. Ordinary direction. Predicted 3 red / 2 green; measured exactly |
| 43 | + * that, each red reading `expected 500 to be 400`. |
| 44 | + * |
| 45 | + * Note the "carries no generated SQL" case asserts the 400 as well as the |
| 46 | + * absence of a statement — #5520's file records why: with the gate gone, a |
| 47 | + * leak-free body proves nothing on its own, because the sibling fix (#5520's |
| 48 | + * sanitiser on the 500 branch) withholds the driver message anyway. Each fix |
| 49 | + * must be falsifiable on its own. |
| 50 | + */ |
| 51 | + |
| 52 | +import { describe, it, expect, vi, beforeEach, afterEach } from 'vitest'; |
| 53 | +import type { Logger } from '@objectstack/spec/contracts'; |
| 54 | +import { AnalyticsService } from '@objectstack/service-analytics'; |
| 55 | +import { RestServer } from './rest-server'; |
| 56 | + |
| 57 | +// ── harness (the shape the two sibling analytics rest tests use) ───────────── |
| 58 | + |
| 59 | +function mockServer() { |
| 60 | + return { |
| 61 | + get: vi.fn(), post: vi.fn(), put: vi.fn(), delete: vi.fn(), patch: vi.fn(), |
| 62 | + use: vi.fn(), listen: vi.fn().mockResolvedValue(undefined), close: vi.fn().mockResolvedValue(undefined), |
| 63 | + }; |
| 64 | +} |
| 65 | +function mockProtocol() { |
| 66 | + return { |
| 67 | + getDiscovery: vi.fn().mockResolvedValue({ version: 'v0', endpoints: {} }), |
| 68 | + getMetaTypes: vi.fn().mockResolvedValue([]), |
| 69 | + getMetaItems: vi.fn().mockResolvedValue([]), |
| 70 | + }; |
| 71 | +} |
| 72 | +function mockRes() { |
| 73 | + const res: any = { statusCode: 200, body: undefined }; |
| 74 | + res.status = vi.fn((c: number) => { res.statusCode = c; return res; }); |
| 75 | + res.json = vi.fn((b: any) => { res.body = b; return res; }); |
| 76 | + res.end = vi.fn(() => res); |
| 77 | + return res; |
| 78 | +} |
| 79 | + |
| 80 | +/** The dataset from the issue's repro — one declared dimension, one measure. */ |
| 81 | +const dataset = { |
| 82 | + name: 'account_metrics', |
| 83 | + label: 'Account metrics', |
| 84 | + object: 'crm_account', |
| 85 | + dimensions: [{ name: 'industry', field: 'industry', type: 'string' }], |
| 86 | + measures: [{ name: 'account_count', aggregate: 'count' }], |
| 87 | +}; |
| 88 | + |
| 89 | +const ACCOUNT_FIELDS = ['id', 'name', 'phone', 'industry', 'annual_revenue']; |
| 90 | + |
| 91 | +function buildRoute(analyticsProvider?: any) { |
| 92 | + const rest = new RestServer( |
| 93 | + mockServer() as any, mockProtocol() as any, { api: { requireAuth: false } } as any, |
| 94 | + undefined, undefined, undefined, undefined, undefined, undefined, undefined, |
| 95 | + undefined, undefined, undefined, undefined, |
| 96 | + analyticsProvider, |
| 97 | + ); |
| 98 | + (rest as any).resolveExecCtx = async () => ({ userId: 'test-user' }); |
| 99 | + rest.registerRoutes(); |
| 100 | + return rest.getRoutes().find((r) => r.method === 'POST' && r.path.endsWith('/analytics/dataset/query'))!; |
| 101 | +} |
| 102 | + |
| 103 | +/** |
| 104 | + * A REAL `AnalyticsService` on the native-SQL path whose driver double fails the |
| 105 | + * way the SQLite/knex one does: the statement prefixed to the cause. That is |
| 106 | + * what made the pre-fix 500 body carry the generated SQL, so the harness |
| 107 | + * reproduces it rather than asserting about a hypothetical message. |
| 108 | + */ |
| 109 | +function realAnalytics(): AnalyticsService { |
| 110 | + const silent: Logger = { debug() {}, info() {}, warn() {}, error() {} }; |
| 111 | + return new AnalyticsService({ |
| 112 | + logger: silent, |
| 113 | + queryCapabilities: () => ({ nativeSql: true, objectqlAggregate: false, inMemory: false }), |
| 114 | + executeRawSql: async (_object: string, sql: string) => { |
| 115 | + const bogus = /\b(bogus_col|dropped_column)\b/.exec(sql)?.[0]; |
| 116 | + if (bogus) throw new Error(`${sql} - no such column: ${bogus}`); |
| 117 | + return [{ industry: 'tech', account_count: 3 }]; |
| 118 | + }, |
| 119 | + isRegisteredObject: (n: string) => n === 'crm_account', |
| 120 | + getObjectFieldNames: (n: string) => (n === 'crm_account' ? ACCOUNT_FIELDS : undefined), |
| 121 | + }); |
| 122 | +} |
| 123 | + |
| 124 | +async function post(route: any, body: unknown) { |
| 125 | + const res = mockRes(); |
| 126 | + await route.handler({ method: 'POST', params: {}, headers: {}, body } as any, res); |
| 127 | + return res; |
| 128 | +} |
| 129 | + |
| 130 | +let consoleError: ReturnType<typeof vi.spyOn>; |
| 131 | +beforeEach(() => { |
| 132 | + consoleError = vi.spyOn(console, 'error').mockImplementation(() => {}); |
| 133 | +}); |
| 134 | +afterEach(() => consoleError.mockRestore()); |
| 135 | + |
| 136 | +// ───────────────────────────────────────────────────────────────────────────── |
| 137 | + |
| 138 | +describe('[#5669] a bogus `where` field answers 400 INVALID_FIELD, end to end', () => { |
| 139 | + it('names the field and the object — and is not a 500', async () => { |
| 140 | + const route = buildRoute(async () => realAnalytics()); |
| 141 | + const res = await post(route, { |
| 142 | + dataset, |
| 143 | + selection: { measures: ['account_count'], runtimeFilter: { bogus_col: 'x' } }, |
| 144 | + }); |
| 145 | + |
| 146 | + expect(res.statusCode).toBe(400); |
| 147 | + expect(res.body.code).toBe('INVALID_FIELD'); |
| 148 | + // The defect, asserted as the defect rather than as the fix. |
| 149 | + expect(res.statusCode).not.toBe(500); |
| 150 | + expect(res.body.code).not.toBe('ANALYTICS_QUERY_FAILED'); |
| 151 | + expect(String(res.body.message)).toMatch(/Filter member 'bogus_col' in 'where'/); |
| 152 | + expect(String(res.body.message)).toMatch(/object 'crm_account' does not have/); |
| 153 | + }); |
| 154 | + |
| 155 | + it('carries no generated SQL — because the statement was never built', async () => { |
| 156 | + const route = buildRoute(async () => realAnalytics()); |
| 157 | + const res = await post(route, { |
| 158 | + dataset, |
| 159 | + selection: { measures: ['account_count'], runtimeFilter: { bogus_col: 'x' } }, |
| 160 | + }); |
| 161 | + |
| 162 | + // BOTH halves of the one claim: the answer is the field-naming 400, and that |
| 163 | + // answer carries no statement. See the header for why the second alone is |
| 164 | + // not evidence. |
| 165 | + expect(res.statusCode).toBe(400); |
| 166 | + expect(res.body.code).toBe('INVALID_FIELD'); |
| 167 | + const body = JSON.stringify(res.body); |
| 168 | + expect(body).not.toMatch(/SELECT/i); |
| 169 | + expect(body).not.toMatch(/FROM \\"/); |
| 170 | + expect(body).not.toMatch(/no such column/); |
| 171 | + }); |
| 172 | + |
| 173 | + it('answers the same way for a DATASET-declared filter over a dropped column', async () => { |
| 174 | + // The authored half of the same mistake: a dataset whose object dropped a |
| 175 | + // column its own declared `filter` still names. |
| 176 | + const route = buildRoute(async () => realAnalytics()); |
| 177 | + const res = await post(route, { |
| 178 | + dataset: { ...dataset, filter: { dropped_column: 'x' } }, |
| 179 | + selection: { measures: ['account_count'] }, |
| 180 | + }); |
| 181 | + |
| 182 | + expect(res.statusCode).toBe(400); |
| 183 | + expect(res.body.code).toBe('INVALID_FIELD'); |
| 184 | + expect(String(res.body.message)).toMatch(/constrains field 'dropped_column'/); |
| 185 | + }); |
| 186 | + |
| 187 | + it('a POSITIVE control: the same wiring with real fields → 200 with rows', async () => { |
| 188 | + // Without this the cases above could pass for any reason that makes the route |
| 189 | + // 400, including a pipeline that never reaches the gate. It also pins the |
| 190 | + // contract the gate must not kill: `phone` is a REAL column this dataset |
| 191 | + // never declared as a dimension, and filtering on it still works. |
| 192 | + const route = buildRoute(async () => realAnalytics()); |
| 193 | + |
| 194 | + const declared = await post(route, { |
| 195 | + dataset, |
| 196 | + selection: { measures: ['account_count'], dimensions: ['industry'], runtimeFilter: { industry: 'tech' } }, |
| 197 | + }); |
| 198 | + expect(declared.statusCode).toBe(200); |
| 199 | + expect(declared.body.rows).toEqual([{ industry: 'tech', account_count: 3 }]); |
| 200 | + |
| 201 | + const undeclaredButReal = await post(route, { |
| 202 | + dataset, |
| 203 | + selection: { measures: ['account_count'], runtimeFilter: { phone: '555' } }, |
| 204 | + }); |
| 205 | + expect(undeclaredButReal.statusCode).toBe(200); |
| 206 | + }); |
| 207 | + |
| 208 | + it('does not disturb the INVALID_FILTER family #5352 / #5367 own', async () => { |
| 209 | + // A structurally-invalid filter is a DIFFERENT verdict from a |
| 210 | + // field-that-does-not-exist, and both must keep their own code: the gate |
| 211 | + // stands down on a `where` the normalizer refuses, so `INVALID_FILTER` still |
| 212 | + // comes from where it always did. |
| 213 | + const route = buildRoute(async () => realAnalytics()); |
| 214 | + const res = await post(route, { |
| 215 | + dataset, |
| 216 | + selection: { measures: ['account_count'], runtimeFilter: { industry: { $sortOf: 'tech' } } }, |
| 217 | + }); |
| 218 | + |
| 219 | + expect(res.statusCode).toBe(400); |
| 220 | + expect(res.body.code).toBe('INVALID_FILTER'); |
| 221 | + expect(String(res.body.message)).toMatch(/\$sortOf/); |
| 222 | + }); |
| 223 | +}); |
0 commit comments