@harperfast/harper 5.2.0-alpha.4 → 5.2.0-alpha.6

package/dist/resources/Table.js

@@ -43,6 +43,7 @@ var __importDefault = (this && this.__importDefault) || function (mod) {
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.EVICTED = exports.INVALIDATED = void 0;
 exports.freezeRecord = freezeRecord;
+exports.frozenRecordView = frozenRecordView;
 exports.makeTable = makeTable;
 exports.coerceType = coerceType;
 const hdbTerms_ts_1 = require("../utility/hdbTerms.js");
@@ -133,6 +134,45 @@ function freezeRecord(value) {
     if (value !== null && typeof value === 'object' && !ArrayBuffer.isView(value) && !(value instanceof ArrayBuffer))
         Object.freeze(value);
 }
+// Returns a read-only VIEW of `record` for evaluation (e.g. a record-scoped allowRead guard)
+// without mutating the original. Locally-loaded records are already frozen by loadLocalRecord, so
+// this is a no-op there; the source-revalidation path hands back the SAME object its deferred
+// commit still writes to (createdAt/updatedAt) and persists, so that object can't be frozen
+// directly. A write-blocking Proxy is used instead of a shallow copy: a copy would eagerly invoke
+// every getter (breaking a caching table's lazy structPrototype decode) and silently drop
+// non-enumerable properties like Array.length. Only ordinary objects/arrays are wrapped — Date,
+// Map, Set, RegExp, etc. carry internal slots that throw "incompatible receiver" when their
+// methods run against anything but the exact original instance (a Proxy included), so those are
+// returned unwrapped rather than risk breaking an override that calls a method on one; a cached
+// record CAN legitimately be one of these (getFromSource only requires `typeof === 'object'`).
+function frozenRecordView(record) {
+    if (record === null || typeof record !== 'object' || ArrayBuffer.isView(record) || record instanceof ArrayBuffer)
+        return record;
+    if (Object.isFrozen(record))
+        return record;
+    const tag = Object.prototype.toString.call(record);
+    if (tag !== '[object Object]' && tag !== '[object Array]')
+        return record;
+    return new Proxy(record, {
+        get(target, prop) {
+            // receiver = target (not this proxy) so a lazy-decode getter runs with `this` bound to
+            // the real record, matching its behavior when read directly.
+            return Reflect.get(target, prop, target);
+        },
+        set() {
+            return false;
+        },
+        defineProperty() {
+            return false;
+        },
+        deleteProperty() {
+            return false;
+        },
+        setPrototypeOf() {
+            return false;
+        },
+    });
+}
 exports.INVALIDATED = 1;
 exports.EVICTED = 8; // note that 2 is reserved for timestamps
 const TEST_WRITE_KEY_BUFFER = Buffer.allocUnsafeSlow(8192);
@@ -144,6 +184,12 @@ const REPLAY_YIELD_INTERVAL = 100; // yield to the event loop every N records du
 // buffer the entire backward chain per record, synchronously, on every worker — pinning the JS heap
 // until the worker OOMs (issue #1114). Beyond this depth we fall back to a bounded reconciliation.
 const MAX_OUT_OF_ORDER_AUDIT_DEPTH = 1000;
+// Cap on audit records inspected while backfilling a subscription's `previousCount` history,
+// independent of `count` (the number of AUTHORIZED events collected). `count` only decrements on
+// records that pass the row-level allowRead filter, so an all-deny override would otherwise force
+// a full walk of the retained audit log (#1786) — this bounds that walk regardless of how many
+// records the filter accepts.
+const MAX_PREVIOUS_COUNT_SCAN = 10_000;
 const FULL_PERMISSIONS = {
     read: true,
     insert: true,
@@ -2459,18 +2505,44 @@ function makeTable(options) {
                 throw new Error('No query provided');
             if (target.parseError)
                 throw target.parseError; // if there was a parse error, we can throw it now
+            // An application-overridden allowRead is a RECORD-scoped check (#1422 gap 2 / #1241): it is
+            // evaluated once per record during query execution with `this` = the record, instead of once
+            // at entry where `this` is a collection resource with nothing loaded. The framework defaults
+            // (marked isDefaultAllowRead) are this-free table/RBAC checks and keep the entry evaluation.
+            // Record-scoping is SYNC-only: async-declared overrides keep entry-check semantics (the
+            // authorize wrapper awaits them and fails closed) rather than entering the sync traversal.
+            const recordScopedAllowRead = target.checkPermission &&
+                !this.allowRead?.isDefaultAllowRead &&
+                this.allowRead?.constructor?.name !== 'AsyncFunction'
+                ? this.allowRead
+                : undefined;
             if (target.checkPermission) {
-                // requesting authorization verification
-                let allowed;
-                try {
-                    allowed = this.allowRead(context.user, target, context);
-                }
-                catch {
-                    // allow* threw — fail closed rather than letting the request proceed
-                    throw new hdbError_ts_1.AccessViolation(context.user);
+                if (recordScopedAllowRead) {
+                    // Compose with role-level column RBAC: the DEFAULT table allowRead is also the
+                    // enforcement point for attribute_permissions (it narrows target.select). Run it here
+                    // for that side effect — before `select` is captured below — with its verdict
+                    // superseded by the per-record override. A per-record super.allowRead call could NOT
+                    // restore this: the select-driven output transform is built before iteration starts.
+                    try {
+                        TableResource.prototype.allowRead.call(this, context.user, target, context);
+                    }
+                    catch {
+                        // narrowing is best-effort under an override; access is governed per record
+                    }
                 }
-                if (!allowed) {
-                    throw new hdbError_ts_1.AccessViolation(context.user);
+                else {
+                    // requesting authorization verification
+                    let allowed;
+                    try {
+                        allowed = this.allowRead(context.user, target, context);
+                    }
+                    catch {
+                        // allow* threw — fail closed rather than letting the request proceed
+                        throw new hdbError_ts_1.AccessViolation(context.user);
+                    }
+                    if (!allowed) {
+                        throw new hdbError_ts_1.AccessViolation(context.user);
+                    }
                 }
             }
             if (context)
@@ -2672,27 +2744,54 @@ function makeTable(options) {
             // scans), the read transaction reads against the latest committed data without pinning a
             // consistent snapshot, so the scan doesn't hold a snapshot that blocks compaction.
             const readTxn = txn.useReadTxn(target.snapshot === false);
-            // Record-level read guard (#1241): a resource may define a static allowReadRecord(user, record)
-            // that participates in query execution (pushed into HNSW traversal for vector sorts, applied as a
-            // post-filter otherwise). Resolve off the actual (possibly subclassed) constructor so overrides win.
-            // SCOPE: this is a QUERY-result filter, not a general read-authorization boundary — direct
-            // single-record get(id) does not consult it (use allowRead/instance hooks for that). It must be
-            // synchronous, side-effect free, and fast; it can run once per candidate record during traversal.
-            const allowReadRecord = this.constructor.allowReadRecord;
-            const recordAccess = typeof allowReadRecord === 'function' || typeof target.vectorFilter === 'function'
-                ? { allowReadRecord, user: context?.user, vectorFilter: target.vectorFilter }
+            // Record-level allowRead guard (#1241/#1422): an application-overridden allowRead runs once
+            // per record with `this` = the (frozen) record, participating in query execution — pushed
+            // into HNSW traversal for vector sorts, applied as a post-filter otherwise. It must be
+            // synchronous, side-effect free, and fast; a throw denies that record (fail closed, #1422
+            // gap 1 parity). Dispatched via the method resolved from the resource — never via a
+            // `record.allowRead` property lookup, so a record attribute named allowRead can't shadow it.
+            let recordGuard;
+            if (recordScopedAllowRead) {
+                const user = context?.user;
+                let warnedAsync = false;
+                recordGuard = (record) => {
+                    let allowed;
+                    try {
+                        allowed = recordScopedAllowRead.call(record, user, target, context);
+                    }
+                    catch {
+                        return false; // fail closed on a throwing check
+                    }
+                    if (typeof allowed?.then === 'function') {
+                        // A sync-declared override that returns a thenable can't be awaited mid-traversal:
+                        // deny the record (fail closed, #1422 gap 1 semantics) rather than fail open on
+                        // promise truthiness or abort the whole query. Declared-async overrides never get
+                        // here — they keep the awaited entry check. We're not observing this rejection, so
+                        // attach a no-op handler — otherwise a rejected thenable reaches the global
+                        // unhandledRejection logger once per denied candidate. Use `.then(undefined, ...)`,
+                        // not `.catch` — a thenable is only guaranteed to have `.then`.
+                        allowed.then(undefined, () => { });
+                        if (!warnedAsync) {
+                            warnedAsync = true;
+                            logger_ts_1.logger.warn?.(`allowRead on ${tableName} returned a promise during per-record evaluation; records are denied (record-scoped allowRead must be synchronous)`);
+                        }
+                        return false;
+                    }
+                    return Boolean(allowed);
+                };
+            }
+            const recordAccess = recordGuard || typeof target.vectorFilter === 'function'
+                ? { recordGuard, vectorFilter: target.vectorFilter }
                 : undefined;
             const entries = (0, search_ts_1.executeConditions)(conditions, operator, TableResource, readTxn, target, context, (results, filters) => transformToEntries(results, select, context, readTxn, filters), filtered, recordAccess);
             const ensure_loaded = target.ensureLoaded !== false;
-            // Authoritative RBAC enforcement (#1241): the guards inside executeConditions evaluate the LOCAL
-            // record, but on a caching table transformEntryForSelect may then revalidate an expired/invalidated
-            // row from source and return a DIFFERENT record. An authorization check must hold on the record
-            // actually returned, so allowReadRecord is re-checked there, after materialization (the earlier
-            // evaluation stays as a prune that also bounds HNSW traversal). vectorFilter and condition filters
-            // intentionally keep the local-record semantics all query filters have on caching tables.
-            const recordGuard = typeof allowReadRecord === 'function'
-                ? (record) => allowReadRecord(context?.user, record)
-                : undefined;
+            // Authoritative enforcement point (#1241): the guards inside executeConditions evaluate the
+            // LOCAL record, but on a caching table transformEntryForSelect may then revalidate an
+            // expired/invalidated row from source and return a DIFFERENT record. An authorization check
+            // must hold on the record actually returned, so the record-scoped allowRead is re-checked
+            // there, after materialization (the earlier evaluation stays as a prune that also bounds HNSW
+            // traversal). vectorFilter and condition filters intentionally keep the local-record
+            // semantics all query filters have on caching tables.
             const transformToRecord = TableResource.transformEntryForSelect(select, context, readTxn, filtered, ensure_loaded, true, recordGuard);
             let results = TableResource.transformToOrderedSelect(entries, select, postOrdering, context, readTxn, transformToRecord);
             // apply any offset/limit after all the sorting and filtering
@@ -2989,8 +3088,10 @@ function makeTable(options) {
                     return canSkip ? extended_iterable_1.SKIP : record;
                 // Record-level RBAC (#1241): enforced here because `record` is now the final, materialized
                 // record — a caching table's source revalidation (above) may have replaced the local copy the
-                // query filters evaluated. Fail closed on the record actually being returned.
-                if (recordGuard && !recordGuard(record))
+                // query filters evaluated. Fail closed on the record actually being returned. The guard sees a
+                // frozen view (frozenRecordView) so an allowRead override that writes through `this` can't
+                // mutate a record the source-revalidation path's deferred commit still needs to write and encode.
+                if (recordGuard && !recordGuard(frozenRecordView(record)))
                     return canSkip ? extended_iterable_1.SKIP : undefined;
                 if (select && !(select[0] === '*' && select.length === 1)) {
                     let promises;
@@ -3162,6 +3263,58 @@ function makeTable(options) {
             let reloadResnapshotRunning = false;
             let reloadResnapshotPending = false;
             const thisId = requestTargetToId(request) ?? null; // treat undefined and null as the root
+            // Record-scoped allowRead on subscription delivery (#1419, reviving #1524 on the unified
+            // model): the subscribe entry check already granted the connection (topic ACL / collection
+            // scope); here we ADDITIONALLY re-evaluate a sync application-overridden allowRead per
+            // record-bearing event with `this` = the event's record, the delivery-path analog of the
+            // per-record query guard. Gated to (1) an overridden allowRead (the default is
+            // record-independent and already enforced at connect, so the common case stays zero-overhead)
+            // and (2) an authorization-checked subscription — the entry check clears checkPermission
+            // before we get here and an anonymous-but-checked subscription has no user to key on, so the
+            // wrapper stamps a durable `rowLevelAuthChecked` flag; internal subscribers (replication,
+            // system watchers) never set it and keep full delivery.
+            // Fails closed: a throwing or thenable-returning override drops the event rather than leaks it.
+            //
+            // Known limitation (as in #1524): only put/invalidate events carry the authoritative full
+            // record. delete (tombstone, null value), message payloads, and rawEvents partial values may
+            // mis-decide an override keyed on row fields; closing the primary leak (record updates) is
+            // the goal here — authorizing non-record-bearing event types against the full row is deferred.
+            const subContext = this.getContext();
+            const subAllowRead = this.allowRead;
+            const filterRowReads = request?.rowLevelAuthChecked && !subAllowRead?.isDefaultAllowRead;
+            let warnedAsyncEvent = false;
+            const allowsEvent = filterRowReads
+                ? (event) => {
+                    if (event.type === 'end_txn' || event.type === 'reload')
+                        return true; // control markers, no record
+                    // Freeze the record before the override sees it, mirroring the query path — event.value
+                    // is the shared primaryStore object, so an override that writes to `this` would otherwise
+                    // mutate the cache for every reader on the node.
+                    if (event.value)
+                        freezeRecord(event.value);
+                    let decision;
+                    try {
+                        // Evaluate against the LIVE context user, not a subscribe-time snapshot: #1414 re-auth
+                        // updates subContext.user in place, so a role/claims change must be reflected per event.
+                        decision = subAllowRead.call(event.value ?? null, subContext.user, request, subContext);
+                    }
+                    catch {
+                        return false; // fail closed: a throwing override drops the event
+                    }
+                    if (decision != null && typeof decision.then === 'function') {
+                        // Not observing this rejection — attach a no-op handler so it doesn't reach the
+                        // global unhandledRejection logger once per dropped event. Use `.then(undefined,
+                        // ...)`, not `.catch` — a thenable is only guaranteed to have `.then`.
+                        decision.then(undefined, () => { });
+                        if (!warnedAsyncEvent) {
+                            warnedAsyncEvent = true;
+                            logger_ts_1.logger.warn?.(`allowRead on ${tableName} returned a promise during subscription event evaluation; events are dropped (record-scoped allowRead must be synchronous)`);
+                        }
+                        return false;
+                    }
+                    return Boolean(decision);
+                }
+                : null;
             const subscription = (0, transactionBroadcast_ts_1.addSubscription)(TableResource, thisId, function (id, auditRecord, localTime, beginTxn) {
                 if (dropDuringReplay)
                     return;
@@ -3206,9 +3359,13 @@ function makeTable(options) {
                         type,
                         beginTxn,
                     };
+                    // Queued events are filtered when the queue drains through send() below; events sent
+                    // directly (queue already drained) are filtered here. Each event is filtered once.
                     if (pendingRealTimeQueue)
                         pendingRealTimeQueue.push(event);
                     else {
+                        if (allowsEvent && !allowsEvent(event))
+                            return;
                         if (databaseName !== 'system') {
                             (0, write_ts_1.recordAction)(auditRecord.size ?? 1, 'db-message', tableName, null);
                         }
@@ -3287,25 +3444,45 @@ function makeTable(options) {
                     }
                     else if (count) {
                         const history = [];
+                        let inspected = 0;
                         // we are collecting the history in reverse order to get the right count, then reversing to send
                         for (const auditRecord of auditStore.getRange({ start: 'z', end: false, reverse: true })) {
                             if (++recordsSinceYield >= REPLAY_YIELD_INTERVAL) {
                                 recordsSinceYield = 0;
                                 await rest();
+                                // Subscription.end() nulls `subscriptions` on close; stop backfilling a dead
+                                // subscriber rather than continuing to walk the retained audit log.
+                                if (!subscription.subscriptions)
+                                    break;
                             }
                             try {
                                 if (auditRecord.tableId !== tableId)
                                     continue;
                                 const id = auditRecord.recordId;
                                 if (thisId == null || isDescendantId(thisId, id)) {
+                                    // Bound entries INSPECTED for THIS scope, independent of `count` (entries
+                                    // AUTHORIZED) — an all-deny allowRead override must not force a full walk of
+                                    // the retained audit log (#1786), even though it returns fewer than `count`
+                                    // authorized events. Counted only once a record is known to be in scope (right
+                                    // table, right id) so unrelated cross-table/cross-scope audit traffic in a busy
+                                    // shared log can't spuriously cut a backfill short.
+                                    if (++inspected > MAX_PREVIOUS_COUNT_SCAN) {
+                                        logger_ts_1.logger.warn?.(`previousCount backfill on ${tableName} stopped after inspecting ${MAX_PREVIOUS_COUNT_SCAN} in-scope audit records without collecting ${request.previousCount} authorized event(s); returning ${history.length} instead`);
+                                        break;
+                                    }
                                     const value = auditRecord.getValue(primaryStore, getFullRecord, auditRecord.localTime);
-                                    history.push({
+                                    const historyEntry = {
                                         id,
                                         localTime: auditRecord.localTime,
                                         value,
                                         version: auditRecord.version,
                                         type: auditRecord.type,
-                                    });
+                                    };
+                                    // Filter denied rows BEFORE they consume a previousCount slot, so an authorized
+                                    // subscriber still receives up to `count` readable events (#1419).
+                                    if (allowsEvent && !allowsEvent(historyEntry))
+                                        continue;
+                                    history.push(historyEntry);
                                     if (--count <= 0)
                                         break;
                                 }
@@ -3458,6 +3635,9 @@ function makeTable(options) {
                 subscription.send(error);
             });
             function send(event) {
+                // Covers the pendingRealTimeQueue drain and the reload re-snapshot (#495) delivery.
+                if (allowsEvent && !allowsEvent(event))
+                    return;
                 if (databaseName !== 'system') {
                     (0, write_ts_1.recordAction)(event.size ?? 1, 'db-message', tableName, null);
                 }
@@ -3663,21 +3843,27 @@ function makeTable(options) {
         }
         // #section: validation
         validate(record, patch) {
+            // Accumulate structured per-field issues so the 400 carries `{ path, code,
+            // message }[]` matching the emitted OpenAPI, instead of a single joined string. The joined
+            // message is still built for the HTTP title, preserving back-compat for callers that read it.
             let validationErrors;
+            const addError = (path, code, message) => {
+                (validationErrors || (validationErrors = [])).push({ path, code, message });
+            };
             const validateValue = (value, attribute, name) => {
                 if (attribute.type && value != null) {
                     if (patch && value.__op__)
                         value = value.value;
                     if (attribute.properties) {
                         if (typeof value !== 'object') {
-                            (validationErrors || (validationErrors = [])).push(`Value ${stringify(value)} in property ${name} must be an object${attribute.type ? ' (' + attribute.type + ')' : ''}`);
+                            addError(name, 'type', `Value ${stringify(value)} in property ${name} must be an object${attribute.type ? ' (' + attribute.type + ')' : ''}`);
                         }
                         const properties = attribute.properties;
                         for (let i = 0, l = properties.length; i < l; i++) {
                             const attribute = properties[i];
                             if (attribute.relationship || attribute.computed) {
                                 if (record.hasOwnProperty(attribute.name)) {
-                                    (validationErrors || (validationErrors = [])).push(`Computed property ${name}.${attribute.name} may not be directly assigned a value`);
+                                    addError(`${name}.${attribute.name}`, 'computed', `Computed property ${name}.${attribute.name} may not be directly assigned a value`);
                                 }
                                 continue;
                             }
@@ -3688,7 +3874,7 @@ function makeTable(options) {
                         if (attribute.sealed && value != null && typeof value === 'object') {
                             for (const key in value) {
                                 if (!properties.find((property) => property.name === key)) {
-                                    (validationErrors || (validationErrors = [])).push(`Property ${key} is not allowed within object in property ${name}`);
+                                    addError(`${name}.${key}`, 'unknown_property', `Property ${key} is not allowed within object in property ${name}`);
                                 }
                             }
                         }
@@ -3697,35 +3883,35 @@ function makeTable(options) {
                         switch (attribute.type) {
                             case 'Int':
                                 if (typeof value !== 'number' || value >> 0 !== value)
-                                    (validationErrors || (validationErrors = [])).push(`Value ${stringify(value)} in property ${name} must be an integer (from -2147483648 to 2147483647)`);
+                                    addError(name, 'type', `Value ${stringify(value)} in property ${name} must be an integer (from -2147483648 to 2147483647)`);
                                 break;
                             case 'Long':
                                 if (typeof value !== 'number' || !(Math.floor(value) === value && Math.abs(value) <= 9007199254740992))
-                                    (validationErrors || (validationErrors = [])).push(`Value ${stringify(value)} in property ${name} must be an integer (from -9007199254740992 to 9007199254740992)`);
+                                    addError(name, 'type', `Value ${stringify(value)} in property ${name} must be an integer (from -9007199254740992 to 9007199254740992)`);
                                 break;
                             case 'Float':
                                 if (typeof value !== 'number')
-                                    (validationErrors || (validationErrors = [])).push(`Value ${stringify(value)} in property ${name} must be a number`);
+                                    addError(name, 'type', `Value ${stringify(value)} in property ${name} must be a number`);
                                 break;
                             case 'ID':
                                 if (!(typeof value === 'string' ||
                                     (value?.length > 0 && value.every?.((value) => typeof value === 'string'))))
-                                    (validationErrors || (validationErrors = [])).push(`Value ${stringify(value)} in property ${name} must be a string, or an array of strings`);
+                                    addError(name, 'type', `Value ${stringify(value)} in property ${name} must be a string, or an array of strings`);
                                 break;
                             case 'String':
                                 if (typeof value !== 'string')
-                                    (validationErrors || (validationErrors = [])).push(`Value ${stringify(value)} in property ${name} must be a string`);
+                                    addError(name, 'type', `Value ${stringify(value)} in property ${name} must be a string`);
                                 break;
                             case 'Boolean':
                                 if (typeof value !== 'boolean')
-                                    (validationErrors || (validationErrors = [])).push(`Value ${stringify(value)} in property ${name} must be a boolean`);
+                                    addError(name, 'type', `Value ${stringify(value)} in property ${name} must be a boolean`);
                                 break;
                             case 'Date':
                                 if (!(value instanceof Date)) {
                                     if (typeof value === 'string' || typeof value === 'number')
                                         return new Date(value);
                                     else
-                                        (validationErrors || (validationErrors = [])).push(`Value ${stringify(value)} in property ${name} must be a Date`);
+                                        addError(name, 'type', `Value ${stringify(value)} in property ${name} must be a Date`);
                                 }
                                 break;
                             case 'BigInt':
@@ -3733,14 +3919,14 @@ function makeTable(options) {
                                     // do coercion because otherwise it is rather difficult to get numbers to consistently be bigints
                                     if (typeof value === 'string' || typeof value === 'number')
                                         return BigInt(value);
-                                    (validationErrors || (validationErrors = [])).push(`Value ${stringify(value)} in property ${name} must be a bigint`);
+                                    addError(name, 'type', `Value ${stringify(value)} in property ${name} must be a bigint`);
                                 }
                                 break;
                             case 'Bytes':
                                 if (!(value instanceof Uint8Array)) {
                                     if (typeof value === 'string')
                                         return Buffer.from(value);
-                                    (validationErrors || (validationErrors = [])).push(`Value ${stringify(value)} in property ${name} must be a Buffer or Uint8Array`);
+                                    addError(name, 'type', `Value ${stringify(value)} in property ${name} must be a Buffer or Uint8Array`);
                                 }
                                 break;
                             case 'Blob':
@@ -3750,7 +3936,7 @@ function makeTable(options) {
                                     if (value instanceof Buffer) {
                                         return createBlob(value, { type: 'text/plain' });
                                     }
-                                    (validationErrors || (validationErrors = [])).push(`Value ${stringify(value)} in property ${name} must be a Blob`);
+                                    addError(name, 'type', `Value ${stringify(value)} in property ${name} must be a Blob`);
                                 }
                                 break;
                             case 'array':
@@ -3765,20 +3951,20 @@ function makeTable(options) {
                                     }
                                 }
                                 else
-                                    (validationErrors || (validationErrors = [])).push(`Value ${stringify(value)} in property ${name} must be an Array`);
+                                    addError(name, 'type', `Value ${stringify(value)} in property ${name} must be an Array`);
                                 break;
                         }
                     }
                 }
                 if (attribute.nullable === false && value == null) {
-                    (validationErrors || (validationErrors = [])).push(`Property ${name} is required (and not does not allow null values)`);
+                    addError(name, 'required', `Property ${name} is required (and not does not allow null values)`);
                 }
             };
             for (let i = 0, l = attributes.length; i < l; i++) {
                 const attribute = attributes[i];
                 if (attribute.relationship || attribute.computed) {
                     if (Object.hasOwn(record, attribute.name)) {
-                        (validationErrors || (validationErrors = [])).push(`Computed property ${attribute.name} may not be directly assigned a value`);
+                        addError(attribute.name, 'computed', `Computed property ${attribute.name} may not be directly assigned a value`);
                     }
                     continue;
                 }
@@ -3791,12 +3977,12 @@ function makeTable(options) {
             if (sealed) {
                 for (const key in record) {
                     if (!attributes.find((attribute) => attribute.name === key)) {
-                        (validationErrors || (validationErrors = [])).push(`Property ${key} is not allowed`);
+                        addError(key, 'unknown_property', `Property ${key} is not allowed`);
                     }
                 }
             }
             if (validationErrors) {
-                throw new hdbError_ts_1.ClientError(validationErrors.join('. '));
+                throw new hdbError_ts_1.ValidationError(validationErrors, validationErrors.map((issue) => issue.message).join('. '));
             }
         }
         // #section: stats-admin
@@ -4284,6 +4470,26 @@ function makeTable(options) {
     }, () => {
         throw new hdbError_ts_1.ServerError('Service unavailable, exceeded request queue limit for resolving cache record', 503);
     });
+    // Mark the table-level allowRead as a framework default (it is a this-free table/RBAC check):
+    // only an APPLICATION override is record-scoped and evaluated per record during query execution
+    // (#1422 gap 2 / #1241). supportsRowLevelAllowRead tells the authorization wrapper in
+    // Resource.ts that this class has the per-record machinery to defer collection reads to.
+    TableResource.prototype.allowRead.isDefaultAllowRead = true;
+    TableResource.supportsRowLevelAllowRead = true;
+    // Records can be asked directly (`record.allowRead(user, target, context)`), delegating to the
+    // table's allowRead with `this` = the record. Non-enumerable so it never serializes; defined on
+    // the per-table record prototype alongside computed properties. Engine-level enforcement does
+    // NOT route through this (it resolves the active resource class's allowRead, which honors
+    // endpoint subclass overrides and can't be shadowed by a record attribute of the same name).
+    if (primaryStore?.encoder?.structPrototype) {
+        Object.defineProperty(primaryStore.encoder.structPrototype, 'allowRead', {
+            value: function (user, target, context) {
+                return TableResource.prototype.allowRead.call(this, user, target, context);
+            },
+            configurable: true,
+            writable: true,
+        });
+    }
     TableResource.updatedAttributes(); // on creation, update accessors as well
     if (expirationMs)
         TableResource.setTTLExpiration(expirationMs / 1000);