woods 2.0.0 → 2.1.0

data/lib/woods/console/embedded_executor.rb

@@ -10,6 +10,7 @@ require_relative 'eval_guard'
 require_relative 'input_contract'
 require_relative 'model_validator'
 require_relative 'safe_context'
+require_relative 'redactor'
 require_relative 'scope_predicate_parser'
 require_relative 'sql_validator'
 require_relative 'sql_noise_stripper'
@@ -92,7 +93,7 @@ module Woods
 
         normalize_params!(tool, params)
         start_time = Process.clock_gettime(Process::CLOCK_MONOTONIC)
-        result = @safe_context.execute { with_mysql_quote_modes { dispatch(tool, params) } }
+        result = @safe_context.execute { with_mysql_quote_modes { dispatch_with_key_redaction(tool, params) } }
         elapsed = ((Process.clock_gettime(Process::CLOCK_MONOTONIC) - start_time) * 1000).round(1)
 
         { 'ok' => true, 'result' => result, 'timing_ms' => elapsed }
@@ -112,6 +113,58 @@ module Woods
 
       private
 
+      def dispatch_with_key_redaction(tool, params)
+        output = dispatch(tool, params)
+        return output if @safe_context.redacted_key_values.empty?
+
+        Redactor.apply(output, typed_redaction_context(tool, params))
+      end
+
+      def typed_redaction_context(tool, params)
+        types = Hash.new { |hash, key| hash[key] = [] }
+        typed_redaction_models(tool, params).each do |name, model|
+          @safe_context.redacted_key_values.each do |pattern|
+            key = pattern['key_column']
+            types[key] << model.type_for_attribute(key) if @model_validator.columns_for(name).include?(key)
+          end
+        end
+        @safe_context.with_key_value_types(types, raw: %w[sql query].include?(tool))
+      end
+
+      def typed_redaction_models(tool, params)
+        tables = if tool == 'sql'
+                   SqlTableScanner.identifiers_in(params['sql'], dialect: sql_dialect, mysql_modes: mysql_quote_modes)
+                 else
+                   selected_source_tables(params)
+                 end
+        @model_validator.model_names.filter_map do |name|
+          model = resolve_model(name)
+          next unless model.respond_to?(:type_for_attribute)
+          next unless typed_model_source?(model, name, params, tables)
+
+          [name, model]
+        rescue NameError
+          # Injectable registries can describe models without loading Rails.
+          next
+        end
+      end
+
+      def typed_model_source?(model, name, params, tables)
+        return true if name == params['model']
+        return false unless model.respond_to?(:table_name)
+
+        # Match the scanner's unquoted final segment, as the identifier gates
+        # do. Keep all matching models across schemas: every possible type
+        # contributes to masking rather than selecting one ambiguous source.
+        tables.any? { |table| table.split('.').last.casecmp?(model.table_name.split('.').last) }
+      end
+
+      def selected_source_tables(params)
+        Array(params['select'] || params['columns']).filter_map do |column|
+          column.split('.')[0...-1].join('.') if column.include?('.')
+        end
+      end
+
       def sanitize_execution_error(error)
         klass = error.class.name
         # Well-known AR wrappers that contain the adapter error as their cause —
@@ -530,7 +583,7 @@ module Woods
         raise ValidationError, 'columns must contain at least one item' if columns && columns.empty?
 
         @model_validator.validate_columns!(params['model'], columns) if columns
-        refuse_orphan_eav_value_selection!(Array(columns)) if columns
+        refuse_orphan_eav_value_selection!(Array(columns), params['model']) if columns
         model = resolve_model(params['model'])
         limit = params.fetch('limit', 100)
         scope = apply_scope(model, params['scope'], model_name: params['model'])
@@ -567,9 +620,9 @@ module Woods
 
       def handle_association_count(params)
         model = resolve_model(params['model'])
-        association_name = params['association']
+        association_name = params['association'].to_sym
         requested_scope = params['scope']
-        reflection = model.reflect_on_association(association_name.to_sym)
+        reflection = model.reflect_on_association(association_name)
 
         raise ValidationError, "Unknown association '#{association_name}' on #{params['model']}" unless reflection
 
@@ -584,13 +637,38 @@ module Woods
         # association's own model before any database I/O runs (not just
         # before the association is read): `model.find` below is itself a
         # query, and a request with a bad scope should never reach it.
-        validate_scope_columns!(requested_scope, reflection.klass.name) if requested_scope
+        validate_association_scope!(requested_scope, reflection)
 
         record = checked_relation(model).find(params['id'])
-        scope = record.public_send(association_name)
+        association = record.association(association_name)
+        return { 'count' => 0 } if empty_polymorphic_association?(association, reflection)
+
+        scope = association.scope
+        return { 'count' => 0 } unless scope
+
         scope = apply_scope(scope, requested_scope, model_name: reflection.klass.name) if requested_scope
         gate_association_sql!(scope)
-        { 'count' => scope.count }
+        { 'count' => association_count(scope, reflection) }
+      end
+
+      def validate_association_scope!(scope, reflection)
+        return unless scope
+
+        if reflection.respond_to?(:polymorphic?) && reflection.polymorphic?
+          raise ValidationError, 'Rejected: scoped polymorphic association counts require a concrete target model.'
+        end
+
+        validate_scope_columns!(scope, reflection.klass.name)
+      end
+
+      def empty_polymorphic_association?(association, reflection)
+        reflection.respond_to?(:polymorphic?) && reflection.polymorphic? && association.klass.nil?
+      end
+
+      def association_count(scope, reflection)
+        return scope.count if reflection.collection?
+
+        scope.exists? ? 1 : 0
       end
 
       # Materialize a model's default scope once, inspect the resolved SQL,
@@ -752,7 +830,7 @@ module Woods
         limit = params.fetch('limit', 10)
 
         @model_validator.validate_column!(params['model'], order_by)
-        refuse_redacted_column!(order_by)
+        refuse_protected_predicate_column!(order_by)
         unless %w[asc desc].include?(direction)
           raise ValidationError, "direction must be asc or desc (got #{direction.inspect})"
         end
@@ -782,12 +860,8 @@ module Woods
         sql = params['sql']
         raise ValidationError, 'Missing required parameter: sql' unless sql
 
-        require_relative 'sql_validator'
-        SqlValidator.new(dialect: sql_dialect, mysql_modes: mysql_quote_modes).validate!(sql)
-        validate_protected_sql_usage!(sql)
-        # Post-validation, pre-execution TableGate — blocks every configured
-        # table even if the sql is otherwise well-formed.
-        gate_sql!(sql)
+        require_sql_dialect!
+        validate_sql_policy!(sql)
 
         limit = params['limit']
         # EXPLAIN's output is plan rows, not the query's own row set: wrapping
@@ -800,14 +874,61 @@ module Woods
                                  'Resubmit without limit.'
         end
 
-        query_sql = limit ? "SELECT * FROM (#{sql}) AS _limited LIMIT #{limit}" : sql
+        query_sql = limit ? "SELECT * FROM (\n#{sql}\n) AS _limited LIMIT #{limit}" : sql
+        validate_sql_policy!(query_sql) if limit
         result = active_connection.select_all(query_sql)
+        validate_sql_result_types!(result)
 
         { 'columns' => result.columns, 'rows' => result.rows, 'count' => result.rows.size }
       rescue SqlValidationError => e
         raise ValidationError, e.message
       end
 
+      def require_sql_dialect!
+        return if sql_dialect
+
+        raise ValidationError, 'Rejected: console_sql requires a recognized database adapter family; ' \
+                               'use a structured Console tool.'
+      end
+
+      # A row cap changes the statement. Check both the caller's complete
+      # statement and the exact SQL sent to the adapter, including the cap.
+      def validate_sql_policy!(sql)
+        # Alias-list identity is its own policy, even when an alias also
+        # looks like a function name to the SQL validator.
+        sql_security_views(sql).each { |stripped| refuse_sql_column_alias_lists!(stripped) }
+        SqlValidator.new(dialect: sql_dialect, mysql_modes: mysql_quote_modes).validate!(sql)
+        validate_protected_sql_usage!(sql)
+        gate_sql!(sql)
+      end
+
+      # PostgreSQL represents unregistered composite/opaque types (including
+      # arrays of them) with a nil type identity. Their output headers cannot
+      # tell the redactor which nested fields are protected. This final fence
+      # complements pre-execution checks without relying on alias spelling.
+      # Legitimate custom types can also refuse while redaction is active.
+      def validate_sql_result_types!(result)
+        return unless sql_dialect == :postgres
+        return if @safe_context.redacted_columns.empty? && redacted_kv_columns.empty?
+
+        return if recognized_sql_result_types?(result)
+
+        raise ValidationError,
+              'Rejected: PostgreSQL returned an unrecognized result type that cannot preserve ' \
+              'protected field identity. ' \
+              'Select ordinary scalar columns or use a structured Console tool.'
+      end
+
+      def recognized_sql_result_types?(result)
+        types = result.column_types if result.respond_to?(:column_types)
+        return false unless types
+
+        result.columns.each_with_index.all? do |column, index|
+          type = types[index] || types[column]
+          type&.type
+        end
+      end
+
       # @param sql [String] Validated SQL (already passed SqlValidator)
       # @return [Boolean] true when the statement starts with EXPLAIN
       def explain_statement?(sql)
@@ -819,16 +940,11 @@ module Woods
       # and PostgreSQL quote/comment grammars differ (`\'` escapes, `#`
       # comments); validating with the matching dialect accepts dialect-valid
       # literals and still rejects every known bypass form. Unknown adapters
-      # return nil and get the conservative union of supported dialects.
+      # remain available to structured tools but refuse raw console_sql requests.
       #
       # @return [Symbol, nil]
       def sql_dialect
-        adapter = active_connection.adapter_name.to_s.downcase
-        return :mysql if adapter.include?('mysql')
-        return :postgres if adapter.include?('postgre')
-        return :sqlite if adapter.include?('sqlite')
-
-        nil
+        AdapterFamily.for(active_connection)
       end
 
       # Keep session reads local to this request and execution context. Restore
@@ -899,8 +1015,10 @@ module Woods
       # @return [Hash] normalized, validated query clauses
       def validated_query_clauses(model, params)
         model_name = params['model']
+        # Keep execution and typed source inference on the same validated projection.
+        params['select'] = validated_select(params['select'], model_name) if params['select']
         {
-          select: params['select'] ? validated_select(params['select'], model_name) : nil,
+          select: params['select'],
           joins: validated_query_joins(model, params['joins']),
           scope: params.key?('scope') ? validated_query_scope(params['scope'], model_name, model) : nil,
           group_by: params['group_by']&.any? ? validated_columns(params['group_by'], model_name) : nil,
@@ -961,7 +1079,7 @@ module Woods
         expressions = Array(select).map do |expr|
           validate_select_expression!(expr.strip, model_name)
         end
-        refuse_orphan_eav_value_selection!(expressions)
+        refuse_orphan_eav_value_selection!(expressions, model_name)
         expressions
       end
 
@@ -976,21 +1094,41 @@ module Woods
       #
       # @param expressions [Array<String>] validated select expressions
       # @raise [ValidationError] when a value column is selected without its key
-      def refuse_orphan_eav_value_selection!(expressions)
+      def refuse_orphan_eav_value_selection!(expressions, model_name = nil)
         selected = directly_selected_columns(expressions)
 
         @safe_context.redacted_key_values.each do |pattern|
-          next unless selected.include?(pattern['value_column'])
-          next if selected.include?(pattern['key_column'])
+          values = selected.select { |column| base_column_name(column).casecmp?(pattern['value_column']) }
+          values.select! { |column| eav_source_has_key?(column, pattern, model_name) }
+          next if values.empty?
+
+          keys = selected.select { |column| base_column_name(column).casecmp?(pattern['key_column']) }
+          next if paired_eav_sources?(keys, values)
 
           raise ValidationError,
                 "Rejected: selecting EAV value column '#{pattern['value_column']}' without its paired " \
                 "key column '#{pattern['key_column']}' bypasses redaction; select both columns so the " \
-                'value can be masked.'
+                'value can be masked. Both columns must have the same unambiguous source.'
         end
       end
 
-      # The bare, unaliased columns referenced by a validated select list.
+      def eav_source_has_key?(column, pattern, model_name)
+        columns = if column.include?('.')
+                    @model_validator.columns_for_table(column.split('.')[0...-1].join('.'))
+                  elsif model_name
+                    @model_validator.columns_for(model_name)
+                  end
+        columns.nil? || columns.include?(pattern['key_column'])
+      end
+
+      def paired_eav_sources?(keys, values)
+        return false unless keys.one? && values.one?
+
+        keys.first.split('.')[0...-1] == values.first.split('.')[0...-1]
+      end
+
+      # Unaliased column references, retaining source qualifiers so a joined
+      # key cannot stand in for the key paired with another source's value.
       # Aggregates and aliases cannot appear here — the per-expression
       # validation refuses them over protected columns before this runs.
       #
@@ -1004,7 +1142,7 @@ module Woods
           fn_arg, bare_col, alias_name = match.captures[1..]
           next if fn_arg || alias_name
 
-          base_column_name(bare_col)
+          bare_col
         end
       end
 
@@ -1513,8 +1651,7 @@ module Woods
         # `SqlNoiseStripper` is the same module SqlValidator uses. The
         # combined single-pass strip_noise resolves comments and literals
         # together so a comment marker inside a literal can't hide a keyword.
-        stripped = SqlNoiseStripper.strip_noise(template, dialect: sql_dialect || :postgres, **mysql_quote_modes)
-        if SCOPE_TEMPLATE_FORBIDDEN.match?(stripped)
+        if sql_security_views(template).any? { |stripped| SCOPE_TEMPLATE_FORBIDDEN.match?(stripped) }
           raise ValidationError,
                 'scope template contains forbidden SQL keywords ' \
                 '(subqueries, UNION, time-based functions, DML/DDL are not allowed). ' \
@@ -1543,7 +1680,7 @@ module Woods
         return unless params['columns']
 
         @model_validator.validate_columns!(params['model'], params['columns'])
-        refuse_orphan_eav_value_selection!(params['columns'])
+        refuse_orphan_eav_value_selection!(params['columns'], params['model'])
       end
 
       # Raw SQL preserves redaction identity only for direct, unaliased
@@ -1551,14 +1688,29 @@ module Woods
       # predicates, CTEs, and other result shapes can rename a protected
       # value or turn it into an oracle, so they fail closed before execution.
       def validate_protected_sql_usage!(sql)
+        # This exact wrapper only preserves the inner statement's output
+        # headers. SqlValidator has already checked balanced delimiters.
+        limited = /\ASELECT \* FROM \(\n(.*)\n\) AS _limited LIMIT \d+\z/m.match(sql)
+        if limited
+          SqlValidator.new(dialect: sql_dialect, mysql_modes: mysql_quote_modes).validate!(limited[1])
+          return validate_protected_sql_usage!(limited[1])
+        end
+
+        sql_security_views(sql).each { |stripped| validate_protected_sql_view!(stripped) }
+      end
+
+      def validate_protected_sql_view!(stripped)
+        refuse_sql_column_alias_lists!(stripped)
+        refuse_composite_sql_projection!(stripped)
+        refuse_ambiguous_eav_sql!(stripped)
+        refuse_protected_sql_positions!(stripped)
         protected = (@safe_context.redacted_columns + redacted_kv_columns).uniq
-        referenced = protected.select { |column| sql_identifier_referenced?(sql, column) }
+        referenced = protected.select { |column| sql_identifier_referenced?(stripped, column) }
         return if referenced.empty?
 
-        stripped = SqlNoiseStripper.strip_noise(sql, dialect: sql_dialect || :postgres, **mysql_quote_modes)
         expressions, tail = protected_sql_projection(stripped)
         selected = expressions.filter_map { |expression| direct_sql_column_name(expression) }
-        unsafe = unsafe_protected_sql_column(referenced, expressions, selected, tail)
+        unsafe = unsafe_protected_sql_column(referenced, expressions, selected, tail, stripped)
         return unless unsafe
 
         raise ValidationError,
@@ -1567,17 +1719,225 @@ module Woods
               'and unaliased, or use a structured Console tool.'
       end
 
-      def unsafe_protected_sql_column(referenced, expressions, selected, tail)
+      # Relation/CTE column lists rename fields by position, before output
+      # headers are available. Refuse them whenever either policy is active,
+      # independently of protected-name references or function validation.
+      def refuse_sql_column_alias_lists!(stripped)
+        return if @safe_context.redacted_columns.empty? && redacted_kv_columns.empty?
+
+        identifier = /(?:[A-Za-z_\u0080-\u{10ffff}][A-Za-z0-9_$\u0080-\u{10ffff}]*|"(?:""|[^"])+"|`(?:``|[^`])+`)/u
+        list = /#{identifier}\s*\(\s*#{identifier}(?:\s*,\s*#{identifier})*\s*\)/
+        cte = /#{list}\s*AS\s*(?:(?:NOT\s+)?MATERIALIZED\s*)?\(/i
+        relation = /\A\s*(?:AS\s+)?#{list}/i
+        renamed = stripped.match?(cte) || SqlTableScanner.relation_factors(stripped).any? do |factor|
+          sql_relation_alias_tail(factor).match?(relation)
+        end
+        return unless renamed
+
+        raise ValidationError,
+              'Rejected: SQL relation or CTE column alias lists cannot preserve redaction identity. ' \
+              'Select protected columns directly and unaliased, or use a structured Console tool.'
+      end
+
+      # Consume only the leading source, leaving its optional alias. Balanced
+      # sources include subqueries, ONLY(table), and table-function arguments;
+      # scalar functions elsewhere in the clause are not alias declarations.
+      def sql_relation_alias_tail(factor)
+        tokens = sql_policy_tokens(factor)
+        index = %w[ONLY LATERAL].include?(sql_token_text(tokens, 0)) ? 1 : 0
+        unless sql_token_text(tokens, index) == '('
+          index += 1
+          index += 2 while sql_token_text(tokens, index) == '.'
+        end
+        index = sql_after_parentheses(tokens, index) if sql_token_text(tokens, index) == '('
+        index += 1 if sql_token_text(tokens, index) == '*'
+        tokens[index] ? factor[tokens[index][:start]..] : ''
+      end
+
+      def sql_after_parentheses(tokens, index)
+        depth = tokens[index][:depth]
+        closing = ((index + 1)...tokens.length).find do |offset|
+          tokens[offset][:text] == ')' && tokens[offset][:depth] == depth
+        end
+        closing ? closing + 1 : tokens.length
+      end
+
+      # Result metadata provides column names, not their table provenance.
+      # A joined/derived EAV row can supply a key from a different source.
+      # Keep direct single-source SQL reads and qualified structured joins;
+      # refuse ambiguous SQL shapes before fetching their values.
+      def refuse_ambiguous_eav_sql!(stripped)
+        return if sql_eav_patterns(stripped).empty?
+        return if SqlTableScanner.relation_factors(stripped).size <= 1
+        return unless stripped.include?('*') || redacted_eav_value_columns.any? do |column|
+          sql_identifier_referenced?(stripped, column)
+        end
+
+        raise ValidationError,
+              'Rejected: SQL EAV values require one unambiguous source; use a structured Console query.'
+      end
+
+      # PostgreSQL can return a table alias as one composite-valued column.
+      # Its header carries no identities for the protected fields inside it.
+      # Reject source names used as projection values, including nested forms.
+      def refuse_composite_sql_projection!(stripped)
+        return if @safe_context.redacted_columns.empty? && redacted_kv_columns.empty?
+
+        sources = SqlTableScanner.relation_factors(stripped).flat_map { |factor| sql_relation_names(factor) }
+        tokens = sql_policy_tokens(stripped)
+        return unless whole_row_value?(tokens, sources)
+
+        raise ValidationError,
+              'Rejected: whole-row SQL values cannot preserve protected field identity; select columns.'
+      end
+
+      # Track each query's clause separately, including correlated expressions
+      # without a FROM clause. Relation declarations and qualified columns are
+      # not values; a source token anywhere else may be a composite row.
+      def whole_row_value?(tokens, sources)
+        clauses = {}
+        query_levels = {}
+        tokens.each_with_index.any? do |token, index|
+          clause = sql_clause_at_token(token, clauses, query_levels)
+          next false unless clause && !%w[FROM JOIN STRAIGHT_JOIN].include?(clause)
+          next false unless sources.any? { |source| sql_unquote(token[:text]).casecmp?(source) }
+
+          !sql_nonvalue_reference?(tokens, index)
+        end
+      end
+
+      def sql_clause_at_token(token, clauses, query_levels)
+        word, depth = token.values_at(:text, :depth)
+        keyword = word.upcase
+        if word == '('
+          clauses[depth + 1] = 'EXPRESSION'
+          query_levels.delete(depth + 1)
+        end
+        if word == ')'
+          clauses.delete(depth + 1)
+          query_levels.delete(depth + 1)
+        end
+        query_levels[depth] = true if keyword == 'SELECT'
+        boundaries = %w[SELECT FROM JOIN STRAIGHT_JOIN ON WHERE HAVING ORDER GROUP LIMIT OFFSET]
+        clauses[depth] = keyword if query_levels[depth] && boundaries.include?(keyword)
+        clauses[depth]
+      end
+
+      def sql_nonvalue_reference?(tokens, index)
+        previous = index.positive? ? tokens[index - 1][:text].upcase : nil
+        return true if ['.', 'AS'].include?(previous)
+        return true if sql_token_text(tokens, index + 1) == '.' && sql_token_text(tokens, index + 2) != '*'
+
+        direct_sql_wildcard?(tokens, index)
+      end
+
+      def sql_token_text(tokens, index)
+        tokens[index]&.fetch(:text)&.upcase
+      end
+
+      def direct_sql_wildcard?(tokens, index)
+        return false unless sql_token_text(tokens, index + 1) == '.' && sql_token_text(tokens, index + 2) == '*'
+
+        previous = index.positive? ? sql_token_text(tokens, index - 1) : nil
+        following = sql_token_text(tokens, index + 3)
+        %w[SELECT ,].include?(previous) && [nil, ',', 'FROM'].include?(following)
+      end
+
+      # Comments and literal bodies have already been removed. Token offsets
+      # let projection and ordinal checks retain complete nested expressions.
+      def sql_policy_tokens(stripped)
+        depth = 0
+        stripped.to_enum(:scan, /"(?:[^"]|"")*"|`(?:[^`]|``)*`|''|
+                                   [A-Za-z_\u0080-\u{10ffff}][A-Za-z0-9_$\u0080-\u{10ffff}]*|[0-9]+|::|[^\s]/ux).map do
+          match = Regexp.last_match
+          word = match[0]
+          depth -= 1 if word == ')'
+          token = { text: word, depth: depth, start: match.begin(0), finish: match.end(0) }
+          depth += 1 if word == '('
+          token
+        end
+      end
+
+      def sql_unquote(identifier)
+        identifier.sub(/\A["`]/, '').sub(/["`]\z/, '').gsub('""', '"').gsub('``', '`')
+      end
+
+      def sql_select_lists(stripped)
+        tokens = sql_policy_tokens(stripped)
+        tokens.each_with_index.filter_map do |token, index|
+          next unless token[:text].casecmp?('SELECT')
+
+          finish = tokens[(index + 1)..].find { |candidate| sql_projection_end?(candidate, token) }
+          finish_at = finish ? finish[:start] : stripped.length
+          { expressions: sql_projection_expressions(stripped[token[:finish]...finish_at]),
+            depth: token[:depth], start: token[:start], finish: finish_at }
+        end
+      end
+
+      def sql_projection_end?(candidate, token)
+        candidate[:depth] < token[:depth] ||
+          (candidate[:depth] == token[:depth] &&
+            %w[FROM WHERE GROUP HAVING ORDER LIMIT UNION INTERSECT EXCEPT].include?(candidate[:text].upcase))
+      end
+
+      def refuse_protected_sql_positions!(stripped)
+        lists = sql_select_lists(stripped)
+        sql_policy_tokens(stripped).each_cons(3) do |clause, by, position|
+          next unless %w[ORDER GROUP].include?(clause[:text].upcase) && by[:text].casecmp?('BY')
+
+          list = sql_projection_before(lists, clause)
+          next unless list
+          next unless sql_projection_expressions(stripped[position[:start]..]).any? do |item|
+            protected_sql_ordinal?(item, list[:expressions])
+          end
+
+          raise ValidationError,
+                'Rejected: positional SQL ordering or grouping cannot reference protected output columns.'
+        end
+      end
+
+      def sql_projection_before(lists, clause)
+        lists.reverse.find do |candidate|
+          candidate[:depth] == clause[:depth] && candidate[:start] < clause[:start]
+        end
+      end
+
+      def protected_sql_ordinal?(item, expressions)
+        ordinal = /\A\s*\(*\s*([0-9]+)\s*\)*(?:\s|\z)/.match(item)
+        return false unless ordinal && ordinal[1].to_i.positive?
+
+        expression = expressions[ordinal[1].to_i - 1]
+        return false unless expression
+        return true if expression.include?('*')
+
+        (@safe_context.redacted_columns + redacted_eav_value_columns).any? do |column|
+          sql_identifier_referenced?(expression, column)
+        end
+      end
+
+      def sql_relation_names(factor)
+        identifier = /(?:[A-Za-z_\u0080-\u{10ffff}][A-Za-z0-9_$\u0080-\u{10ffff}]*|"(?:""|[^"])+"|`(?:``|[^`])+`)/u
+        source = /\A\s*(?:ONLY\b\s*\(?\s*)?(#{identifier})(?:\s*\.\s*(#{identifier}))?/i
+        match = source.match(factor)
+        names = match ? [match[2] || match[1]] : []
+        rest = match ? factor[match.end(0)..].sub(/\A\s*\*/, '') : factor
+        aliases = /(?:\A|\))\s*(?:AS\s+)?(#{identifier})/i
+        names.concat(rest.scan(aliases).flatten)
+
+        names.map { |name| sql_unquote(name) }
+      end
+
+      def unsafe_protected_sql_column(referenced, expressions, selected, tail, stripped)
         referenced.find do |column|
           unsafe_protected_sql_reference?(column, expressions, selected, tail)
-        end || orphan_eav_sql_value(selected)
+        end || orphan_eav_sql_value(selected, stripped)
       end
 
       def protected_sql_projection(stripped)
-        match = /\ASELECT\s+(.*?)\s+FROM\b/im.match(stripped)
-        return [[], stripped] unless match
+        list = sql_select_lists(stripped).first
+        return [[], stripped] unless list && list[:start].zero?
 
-        [sql_projection_expressions(match[1]), stripped[match.end(1)..]]
+        [list[:expressions], stripped[list[:finish]..]]
       end
 
       def unsafe_protected_sql_reference?(column, expressions, selected, tail)
@@ -1592,15 +1952,31 @@ module Woods
         @safe_context.redacted_columns.include?(column) || redacted_eav_value_columns.include?(column)
       end
 
-      def orphan_eav_sql_value(selected)
-        pattern = @safe_context.redacted_key_values.find do |candidate|
+      def orphan_eav_sql_value(selected, stripped)
+        pattern = sql_eav_patterns(stripped).find do |candidate|
           selected.include?(candidate['value_column']) && !selected.include?(candidate['key_column'])
         end
         pattern&.fetch('value_column')
       end
 
+      def sql_eav_patterns(stripped)
+        tables = SqlTableScanner.identifiers_in(stripped, dialect: sql_dialect, mysql_modes: mysql_quote_modes)
+        @safe_context.redacted_key_values.select do |pattern|
+          tables.any? do |table|
+            columns = @model_validator.columns_for_table(table)
+            columns.nil? || [pattern['key_column'], pattern['value_column']].all? { |column| columns.include?(column) }
+          end
+        end
+      end
+
       def sql_projection_expressions(projection)
-        projection.split(',').map(&:strip)
+        commas = sql_policy_tokens(projection).select { |token| token[:text] == ',' && token[:depth].zero? }
+        start = 0
+        commas.map do |token|
+          expression = projection[start...token[:start]].strip
+          start = token[:finish]
+          expression
+        end + [projection[start..].strip]
       end
 
       def direct_sql_column_name(expression)
@@ -1621,8 +1997,16 @@ module Woods
       end
 
       def sql_identifier_referenced?(sql, column)
-        stripped = SqlNoiseStripper.strip_noise(sql, dialect: sql_dialect || :postgres, **mysql_quote_modes)
-        stripped.match?(/(?<![A-Za-z0-9_$])#{Regexp.escape(column)}(?![A-Za-z0-9_$])/i)
+        sql_security_views(sql).any? do |stripped|
+          stripped.match?(/(?<![A-Za-z0-9_$])#{Regexp.escape(column)}(?![A-Za-z0-9_$])/i)
+        end
+      end
+
+      def sql_security_views(sql)
+        dialects = sql_dialect ? [sql_dialect] : SqlValidator::KNOWN_DIALECTS
+        dialects.flat_map do |dialect|
+          SqlNoiseStripper.security_views(sql, dialect: dialect, mysql_modes: sql_dialect ? mysql_quote_modes : nil)
+        end.uniq
       end
 
       # Apply column selection to a relation.
@@ -1662,8 +2046,7 @@ module Woods
       #
       # @return [Arel::Nodes::SqlLiteral]
       def random_function
-        adapter = active_connection.adapter_name.downcase
-        func = adapter.include?('mysql') ? 'RAND' : 'RANDOM'
+        func = sql_dialect == :mysql ? 'RAND' : 'RANDOM'
         Arel.sql("#{func}()")
       end
 

data/lib/woods/console/model_validator.rb

@@ -87,6 +87,14 @@ module Woods
         validate_column!(model_name, column_name)
       end
 
+      # Return known table columns without guessing an unknown table's shape.
+      # @param table_name [String]
+      # @return [Array<String>, nil] nil when this table is not registered
+      def columns_for_table(table_name)
+        model = @model_by_table[table_name.to_s]
+        @registry[model] if model
+      end
+
       # List all known model names.
       #
       # @return [Array<String>]