@harperfast/harper 5.2.0-alpha.4 → 5.2.0-alpha.6

package/resources/Table.ts

@@ -28,7 +28,14 @@ import { when, promiseNormalize } from '../utility/when.ts';
 import { DatabaseTransaction, ImmediateTransaction, TRANSACTION_STATE } from './DatabaseTransaction.ts';
 import * as envMngr from '../utility/environment/environmentManager.ts';
 import { addSubscription } from './transactionBroadcast.ts';
-import { handleHDBError, ClientError, ServerError, AccessViolation } from '../utility/errors/hdbError.ts';
+import {
+	handleHDBError,
+	ClientError,
+	ServerError,
+	AccessViolation,
+	ValidationError,
+	type ValidationIssue,
+} from '../utility/errors/hdbError.ts';
 import * as signalling from '../utility/signalling.ts';
 import { SchemaEventMsg, UserEventMsg } from '../server/threads/itc.js';
 import { databases, table } from './databases.ts';
@@ -152,6 +159,43 @@ export function freezeRecord(value: any): void {
 	if (value !== null && typeof value === 'object' && !ArrayBuffer.isView(value) && !(value instanceof ArrayBuffer))
 		Object.freeze(value);
 }
+// Returns a read-only VIEW of `record` for evaluation (e.g. a record-scoped allowRead guard)
+// without mutating the original. Locally-loaded records are already frozen by loadLocalRecord, so
+// this is a no-op there; the source-revalidation path hands back the SAME object its deferred
+// commit still writes to (createdAt/updatedAt) and persists, so that object can't be frozen
+// directly. A write-blocking Proxy is used instead of a shallow copy: a copy would eagerly invoke
+// every getter (breaking a caching table's lazy structPrototype decode) and silently drop
+// non-enumerable properties like Array.length. Only ordinary objects/arrays are wrapped — Date,
+// Map, Set, RegExp, etc. carry internal slots that throw "incompatible receiver" when their
+// methods run against anything but the exact original instance (a Proxy included), so those are
+// returned unwrapped rather than risk breaking an override that calls a method on one; a cached
+// record CAN legitimately be one of these (getFromSource only requires `typeof === 'object'`).
+export function frozenRecordView(record: any): any {
+	if (record === null || typeof record !== 'object' || ArrayBuffer.isView(record) || record instanceof ArrayBuffer)
+		return record;
+	if (Object.isFrozen(record)) return record;
+	const tag = Object.prototype.toString.call(record);
+	if (tag !== '[object Object]' && tag !== '[object Array]') return record;
+	return new Proxy(record, {
+		get(target, prop) {
+			// receiver = target (not this proxy) so a lazy-decode getter runs with `this` bound to
+			// the real record, matching its behavior when read directly.
+			return Reflect.get(target, prop, target);
+		},
+		set() {
+			return false;
+		},
+		defineProperty() {
+			return false;
+		},
+		deleteProperty() {
+			return false;
+		},
+		setPrototypeOf() {
+			return false;
+		},
+	});
+}
 export const INVALIDATED = 1;
 export const EVICTED = 8; // note that 2 is reserved for timestamps
 const TEST_WRITE_KEY_BUFFER = Buffer.allocUnsafeSlow(8192);
@@ -163,6 +207,12 @@ const REPLAY_YIELD_INTERVAL = 100; // yield to the event loop every N records du
 // buffer the entire backward chain per record, synchronously, on every worker — pinning the JS heap
 // until the worker OOMs (issue #1114). Beyond this depth we fall back to a bounded reconciliation.
 const MAX_OUT_OF_ORDER_AUDIT_DEPTH = 1000;
+// Cap on audit records inspected while backfilling a subscription's `previousCount` history,
+// independent of `count` (the number of AUTHORIZED events collected). `count` only decrements on
+// records that pass the row-level allowRead filter, so an all-deny override would otherwise force
+// a full walk of the retained audit log (#1786) — this bounds that walk regardless of how many
+// records the filter accepts.
+const MAX_PREVIOUS_COUNT_SCAN = 10_000;
 const FULL_PERMISSIONS = {
 	read: true,
 	insert: true,
@@ -2640,17 +2690,42 @@ export function makeTable(options) {
 			const txn = txnForContext(context);
 			if (!target) throw new Error('No query provided');
 			if (target.parseError) throw target.parseError; // if there was a parse error, we can throw it now
+			// An application-overridden allowRead is a RECORD-scoped check (#1422 gap 2 / #1241): it is
+			// evaluated once per record during query execution with `this` = the record, instead of once
+			// at entry where `this` is a collection resource with nothing loaded. The framework defaults
+			// (marked isDefaultAllowRead) are this-free table/RBAC checks and keep the entry evaluation.
+			// Record-scoping is SYNC-only: async-declared overrides keep entry-check semantics (the
+			// authorize wrapper awaits them and fails closed) rather than entering the sync traversal.
+			const recordScopedAllowRead =
+				target.checkPermission &&
+				!(this.allowRead as any)?.isDefaultAllowRead &&
+				(this.allowRead as any)?.constructor?.name !== 'AsyncFunction'
+					? this.allowRead
+					: undefined;
 			if (target.checkPermission) {
-				// requesting authorization verification
-				let allowed;
-				try {
-					allowed = this.allowRead((context as any).user, target, context);
-				} catch {
-					// allow* threw — fail closed rather than letting the request proceed
-					throw new AccessViolation((context as any).user);
-				}
-				if (!allowed) {
-					throw new AccessViolation((context as any).user);
+				if (recordScopedAllowRead) {
+					// Compose with role-level column RBAC: the DEFAULT table allowRead is also the
+					// enforcement point for attribute_permissions (it narrows target.select). Run it here
+					// for that side effect — before `select` is captured below — with its verdict
+					// superseded by the per-record override. A per-record super.allowRead call could NOT
+					// restore this: the select-driven output transform is built before iteration starts.
+					try {
+						TableResource.prototype.allowRead.call(this, (context as any).user, target, context);
+					} catch {
+						// narrowing is best-effort under an override; access is governed per record
+					}
+				} else {
+					// requesting authorization verification
+					let allowed;
+					try {
+						allowed = this.allowRead((context as any).user, target, context);
+					} catch {
+						// allow* threw — fail closed rather than letting the request proceed
+						throw new AccessViolation((context as any).user);
+					}
+					if (!allowed) {
+						throw new AccessViolation((context as any).user);
+					}
 				}
 			}
 			if (context) context.lastModified = UNCACHEABLE_TIMESTAMP;
@@ -2854,16 +2929,46 @@ export function makeTable(options) {
 			// scans), the read transaction reads against the latest committed data without pinning a
 			// consistent snapshot, so the scan doesn't hold a snapshot that blocks compaction.
 			const readTxn = txn.useReadTxn(target.snapshot === false);
-			// Record-level read guard (#1241): a resource may define a static allowReadRecord(user, record)
-			// that participates in query execution (pushed into HNSW traversal for vector sorts, applied as a
-			// post-filter otherwise). Resolve off the actual (possibly subclassed) constructor so overrides win.
-			// SCOPE: this is a QUERY-result filter, not a general read-authorization boundary — direct
-			// single-record get(id) does not consult it (use allowRead/instance hooks for that). It must be
-			// synchronous, side-effect free, and fast; it can run once per candidate record during traversal.
-			const allowReadRecord = (this.constructor as any).allowReadRecord;
+			// Record-level allowRead guard (#1241/#1422): an application-overridden allowRead runs once
+			// per record with `this` = the (frozen) record, participating in query execution — pushed
+			// into HNSW traversal for vector sorts, applied as a post-filter otherwise. It must be
+			// synchronous, side-effect free, and fast; a throw denies that record (fail closed, #1422
+			// gap 1 parity). Dispatched via the method resolved from the resource — never via a
+			// `record.allowRead` property lookup, so a record attribute named allowRead can't shadow it.
+			let recordGuard: ((record: any) => boolean) | undefined;
+			if (recordScopedAllowRead) {
+				const user = (context as any)?.user;
+				let warnedAsync = false;
+				recordGuard = (record: any) => {
+					let allowed;
+					try {
+						allowed = recordScopedAllowRead.call(record, user, target, context);
+					} catch {
+						return false; // fail closed on a throwing check
+					}
+					if (typeof allowed?.then === 'function') {
+						// A sync-declared override that returns a thenable can't be awaited mid-traversal:
+						// deny the record (fail closed, #1422 gap 1 semantics) rather than fail open on
+						// promise truthiness or abort the whole query. Declared-async overrides never get
+						// here — they keep the awaited entry check. We're not observing this rejection, so
+						// attach a no-op handler — otherwise a rejected thenable reaches the global
+						// unhandledRejection logger once per denied candidate. Use `.then(undefined, ...)`,
+						// not `.catch` — a thenable is only guaranteed to have `.then`.
+						allowed.then(undefined, () => {});
+						if (!warnedAsync) {
+							warnedAsync = true;
+							logger.warn?.(
+								`allowRead on ${tableName} returned a promise during per-record evaluation; records are denied (record-scoped allowRead must be synchronous)`
+							);
+						}
+						return false;
+					}
+					return Boolean(allowed);
+				};
+			}
 			const recordAccess =
-				typeof allowReadRecord === 'function' || typeof target.vectorFilter === 'function'
-					? { allowReadRecord, user: (context as any)?.user, vectorFilter: target.vectorFilter }
+				recordGuard || typeof target.vectorFilter === 'function'
+					? { recordGuard, vectorFilter: target.vectorFilter }
 					: undefined;
 			const entries = executeConditions(
 				conditions,
@@ -2877,16 +2982,13 @@ export function makeTable(options) {
 				recordAccess
 			);
 			const ensure_loaded = (target as any).ensureLoaded !== false;
-			// Authoritative RBAC enforcement (#1241): the guards inside executeConditions evaluate the LOCAL
-			// record, but on a caching table transformEntryForSelect may then revalidate an expired/invalidated
-			// row from source and return a DIFFERENT record. An authorization check must hold on the record
-			// actually returned, so allowReadRecord is re-checked there, after materialization (the earlier
-			// evaluation stays as a prune that also bounds HNSW traversal). vectorFilter and condition filters
-			// intentionally keep the local-record semantics all query filters have on caching tables.
-			const recordGuard =
-				typeof allowReadRecord === 'function'
-					? (record: any) => allowReadRecord((context as any)?.user, record)
-					: undefined;
+			// Authoritative enforcement point (#1241): the guards inside executeConditions evaluate the
+			// LOCAL record, but on a caching table transformEntryForSelect may then revalidate an
+			// expired/invalidated row from source and return a DIFFERENT record. An authorization check
+			// must hold on the record actually returned, so the record-scoped allowRead is re-checked
+			// there, after materialization (the earlier evaluation stays as a prune that also bounds HNSW
+			// traversal). vectorFilter and condition filters intentionally keep the local-record
+			// semantics all query filters have on caching tables.
 			const transformToRecord = TableResource.transformEntryForSelect(
 				select,
 				context,
@@ -3192,8 +3294,10 @@ export function makeTable(options) {
 				if (record == null) return canSkip ? SKIP : record;
 				// Record-level RBAC (#1241): enforced here because `record` is now the final, materialized
 				// record — a caching table's source revalidation (above) may have replaced the local copy the
-				// query filters evaluated. Fail closed on the record actually being returned.
-				if (recordGuard && !recordGuard(record)) return canSkip ? SKIP : undefined;
+				// query filters evaluated. Fail closed on the record actually being returned. The guard sees a
+				// frozen view (frozenRecordView) so an allowRead override that writes through `this` can't
+				// mutate a record the source-revalidation path's deferred commit still needs to write and encode.
+				if (recordGuard && !recordGuard(frozenRecordView(record))) return canSkip ? SKIP : undefined;
 				if (select && !(select[0] === '*' && select.length === 1)) {
 					let promises: Promise<any>[];
 					const selectAttribute = (attribute, callback) => {
@@ -3362,6 +3466,57 @@ export function makeTable(options) {
 			let reloadResnapshotRunning = false;
 			let reloadResnapshotPending = false;
 			const thisId = requestTargetToId(request) ?? null; // treat undefined and null as the root
+			// Record-scoped allowRead on subscription delivery (#1419, reviving #1524 on the unified
+			// model): the subscribe entry check already granted the connection (topic ACL / collection
+			// scope); here we ADDITIONALLY re-evaluate a sync application-overridden allowRead per
+			// record-bearing event with `this` = the event's record, the delivery-path analog of the
+			// per-record query guard. Gated to (1) an overridden allowRead (the default is
+			// record-independent and already enforced at connect, so the common case stays zero-overhead)
+			// and (2) an authorization-checked subscription — the entry check clears checkPermission
+			// before we get here and an anonymous-but-checked subscription has no user to key on, so the
+			// wrapper stamps a durable `rowLevelAuthChecked` flag; internal subscribers (replication,
+			// system watchers) never set it and keep full delivery.
+			// Fails closed: a throwing or thenable-returning override drops the event rather than leaks it.
+			//
+			// Known limitation (as in #1524): only put/invalidate events carry the authoritative full
+			// record. delete (tombstone, null value), message payloads, and rawEvents partial values may
+			// mis-decide an override keyed on row fields; closing the primary leak (record updates) is
+			// the goal here — authorizing non-record-bearing event types against the full row is deferred.
+			const subContext = this.getContext() as any;
+			const subAllowRead = this.allowRead;
+			const filterRowReads = (request as any)?.rowLevelAuthChecked && !(subAllowRead as any)?.isDefaultAllowRead;
+			let warnedAsyncEvent = false;
+			const allowsEvent = filterRowReads
+				? (event: any): boolean => {
+						if (event.type === 'end_txn' || event.type === 'reload') return true; // control markers, no record
+						// Freeze the record before the override sees it, mirroring the query path — event.value
+						// is the shared primaryStore object, so an override that writes to `this` would otherwise
+						// mutate the cache for every reader on the node.
+						if (event.value) freezeRecord(event.value);
+						let decision;
+						try {
+							// Evaluate against the LIVE context user, not a subscribe-time snapshot: #1414 re-auth
+							// updates subContext.user in place, so a role/claims change must be reflected per event.
+							decision = subAllowRead.call(event.value ?? null, subContext.user, request, subContext);
+						} catch {
+							return false; // fail closed: a throwing override drops the event
+						}
+						if (decision != null && typeof decision.then === 'function') {
+							// Not observing this rejection — attach a no-op handler so it doesn't reach the
+							// global unhandledRejection logger once per dropped event. Use `.then(undefined,
+							// ...)`, not `.catch` — a thenable is only guaranteed to have `.then`.
+							decision.then(undefined, () => {});
+							if (!warnedAsyncEvent) {
+								warnedAsyncEvent = true;
+								logger.warn?.(
+									`allowRead on ${tableName} returned a promise during subscription event evaluation; events are dropped (record-scoped allowRead must be synchronous)`
+								);
+							}
+							return false;
+						}
+						return Boolean(decision);
+					}
+				: null;
 			const subscription = addSubscription(
 				TableResource,
 				thisId,
@@ -3403,8 +3558,11 @@ export function makeTable(options) {
 							type,
 							beginTxn,
 						};
+						// Queued events are filtered when the queue drains through send() below; events sent
+						// directly (queue already drained) are filtered here. Each event is filtered once.
 						if (pendingRealTimeQueue) pendingRealTimeQueue.push(event);
 						else {
+							if (allowsEvent && !allowsEvent(event)) return;
 							if (databaseName !== 'system') {
 								recordAction(auditRecord.size ?? 1, 'db-message', tableName, null);
 							}
@@ -3479,24 +3637,44 @@ export function makeTable(options) {
 						}
 					} else if (count) {
 						const history = [];
+						let inspected = 0;
 						// we are collecting the history in reverse order to get the right count, then reversing to send
 						for (const auditRecord of auditStore.getRange({ start: 'z', end: false, reverse: true })) {
 							if (++recordsSinceYield >= REPLAY_YIELD_INTERVAL) {
 								recordsSinceYield = 0;
 								await rest();
+								// Subscription.end() nulls `subscriptions` on close; stop backfilling a dead
+								// subscriber rather than continuing to walk the retained audit log.
+								if (!subscription.subscriptions) break;
 							}
 							try {
 								if (auditRecord.tableId !== tableId) continue;
 								const id = auditRecord.recordId;
 								if (thisId == null || isDescendantId(thisId, id)) {
+									// Bound entries INSPECTED for THIS scope, independent of `count` (entries
+									// AUTHORIZED) — an all-deny allowRead override must not force a full walk of
+									// the retained audit log (#1786), even though it returns fewer than `count`
+									// authorized events. Counted only once a record is known to be in scope (right
+									// table, right id) so unrelated cross-table/cross-scope audit traffic in a busy
+									// shared log can't spuriously cut a backfill short.
+									if (++inspected > MAX_PREVIOUS_COUNT_SCAN) {
+										logger.warn?.(
+											`previousCount backfill on ${tableName} stopped after inspecting ${MAX_PREVIOUS_COUNT_SCAN} in-scope audit records without collecting ${request.previousCount} authorized event(s); returning ${history.length} instead`
+										);
+										break;
+									}
 									const value = auditRecord.getValue(primaryStore, getFullRecord, auditRecord.localTime);
-									history.push({
+									const historyEntry = {
 										id,
 										localTime: auditRecord.localTime,
 										value,
 										version: auditRecord.version,
 										type: auditRecord.type,
-									});
+									};
+									// Filter denied rows BEFORE they consume a previousCount slot, so an authorized
+									// subscriber still receives up to `count` readable events (#1419).
+									if (allowsEvent && !allowsEvent(historyEntry)) continue;
+									history.push(historyEntry);
 									if (--count <= 0) break;
 								}
 							} catch (error) {
@@ -3638,6 +3816,8 @@ export function makeTable(options) {
 				subscription.send(error);
 			});
 			function send(event: any) {
+				// Covers the pendingRealTimeQueue drain and the reload re-snapshot (#495) delivery.
+				if (allowsEvent && !allowsEvent(event)) return;
 				if (databaseName !== 'system') {
 					recordAction(event.size ?? 1, 'db-message', tableName, null);
 				}
@@ -3852,13 +4032,21 @@ export function makeTable(options) {
 		}
 		// #section: validation
 		validate(record: any, patch?: boolean) {
-			let validationErrors;
+			// Accumulate structured per-field issues so the 400 carries `{ path, code,
+			// message }[]` matching the emitted OpenAPI, instead of a single joined string. The joined
+			// message is still built for the HTTP title, preserving back-compat for callers that read it.
+			let validationErrors: ValidationIssue[] | undefined;
+			const addError = (path: string, code: string, message: string) => {
+				(validationErrors || (validationErrors = [])).push({ path, code, message });
+			};
 			const validateValue = (value, attribute: Attribute, name) => {
 				if (attribute.type && value != null) {
 					if (patch && value.__op__) value = value.value;
 					if (attribute.properties) {
 						if (typeof value !== 'object') {
-							(validationErrors || (validationErrors = [])).push(
+							addError(
+								name,
+								'type',
 								`Value ${stringify(value)} in property ${name} must be an object${
 									attribute.type ? ' (' + attribute.type + ')' : ''
 								}`
@@ -3869,7 +4057,9 @@ export function makeTable(options) {
 							const attribute = properties[i];
 							if (attribute.relationship || attribute.computed) {
 								if (record.hasOwnProperty(attribute.name)) {
-									(validationErrors || (validationErrors = [])).push(
+									addError(
+										`${name}.${attribute.name}`,
+										'computed',
 										`Computed property ${name}.${attribute.name} may not be directly assigned a value`
 									);
 								}
@@ -3881,7 +4071,9 @@ export function makeTable(options) {
 						if (attribute.sealed && value != null && typeof value === 'object') {
 							for (const key in value) {
 								if (!properties.find((property) => property.name === key)) {
-									(validationErrors || (validationErrors = [])).push(
+									addError(
+										`${name}.${key}`,
+										'unknown_property',
 										`Property ${key} is not allowed within object in property ${name}`
 									);
 								}
@@ -3891,13 +4083,17 @@ export function makeTable(options) {
 						switch (attribute.type) {
 							case 'Int':
 								if (typeof value !== 'number' || value >> 0 !== value)
-									(validationErrors || (validationErrors = [])).push(
+									addError(
+										name,
+										'type',
 										`Value ${stringify(value)} in property ${name} must be an integer (from -2147483648 to 2147483647)`
 									);
 								break;
 							case 'Long':
 								if (typeof value !== 'number' || !(Math.floor(value) === value && Math.abs(value) <= 9007199254740992))
-									(validationErrors || (validationErrors = [])).push(
+									addError(
+										name,
+										'type',
 										`Value ${stringify(
 											value
 										)} in property ${name} must be an integer (from -9007199254740992 to 9007199254740992)`
@@ -3905,53 +4101,46 @@ export function makeTable(options) {
 								break;
 							case 'Float':
 								if (typeof value !== 'number')
-									(validationErrors || (validationErrors = [])).push(
-										`Value ${stringify(value)} in property ${name} must be a number`
-									);
+									addError(name, 'type', `Value ${stringify(value)} in property ${name} must be a number`);
 								break;
 							case 'ID':
 								if (!(
 									typeof value === 'string' ||
 									(value?.length > 0 && value.every?.((value) => typeof value === 'string'))
 								))
-									(validationErrors || (validationErrors = [])).push(
+									addError(
+										name,
+										'type',
 										`Value ${stringify(value)} in property ${name} must be a string, or an array of strings`
 									);
 								break;
 							case 'String':
 								if (typeof value !== 'string')
-									(validationErrors || (validationErrors = [])).push(
-										`Value ${stringify(value)} in property ${name} must be a string`
-									);
+									addError(name, 'type', `Value ${stringify(value)} in property ${name} must be a string`);
 								break;
 							case 'Boolean':
 								if (typeof value !== 'boolean')
-									(validationErrors || (validationErrors = [])).push(
-										`Value ${stringify(value)} in property ${name} must be a boolean`
-									);
+									addError(name, 'type', `Value ${stringify(value)} in property ${name} must be a boolean`);
 								break;
 							case 'Date':
 								if (!(value instanceof Date)) {
 									if (typeof value === 'string' || typeof value === 'number') return new Date(value);
-									else
-										(validationErrors || (validationErrors = [])).push(
-											`Value ${stringify(value)} in property ${name} must be a Date`
-										);
+									else addError(name, 'type', `Value ${stringify(value)} in property ${name} must be a Date`);
 								}
 								break;
 							case 'BigInt':
 								if (typeof value !== 'bigint') {
 									// do coercion because otherwise it is rather difficult to get numbers to consistently be bigints
 									if (typeof value === 'string' || typeof value === 'number') return BigInt(value);
-									(validationErrors || (validationErrors = [])).push(
-										`Value ${stringify(value)} in property ${name} must be a bigint`
-									);
+									addError(name, 'type', `Value ${stringify(value)} in property ${name} must be a bigint`);
 								}
 								break;
 							case 'Bytes':
 								if (!(value instanceof Uint8Array)) {
 									if (typeof value === 'string') return Buffer.from(value);
-									(validationErrors || (validationErrors = [])).push(
+									addError(
+										name,
+										'type',
 										`Value ${stringify(value)} in property ${name} must be a Buffer or Uint8Array`
 									);
 								}
@@ -3962,9 +4151,7 @@ export function makeTable(options) {
 									if (value instanceof Buffer) {
 										return createBlob(value, { type: 'text/plain' });
 									}
-									(validationErrors || (validationErrors = [])).push(
-										`Value ${stringify(value)} in property ${name} must be a Blob`
-									);
+									addError(name, 'type', `Value ${stringify(value)} in property ${name} must be a Blob`);
 								}
 								break;
 							case 'array':
@@ -3976,26 +4163,23 @@ export function makeTable(options) {
 											if (updated) value[i] = updated;
 										}
 									}
-								} else
-									(validationErrors || (validationErrors = [])).push(
-										`Value ${stringify(value)} in property ${name} must be an Array`
-									);
+								} else addError(name, 'type', `Value ${stringify(value)} in property ${name} must be an Array`);
 
 								break;
 						}
 					}
 				}
 				if (attribute.nullable === false && value == null) {
-					(validationErrors || (validationErrors = [])).push(
-						`Property ${name} is required (and not does not allow null values)`
-					);
+					addError(name, 'required', `Property ${name} is required (and not does not allow null values)`);
 				}
 			};
 			for (let i = 0, l = attributes.length; i < l; i++) {
 				const attribute = attributes[i];
 				if (attribute.relationship || attribute.computed) {
 					if (Object.hasOwn(record, attribute.name)) {
-						(validationErrors || (validationErrors = [])).push(
+						addError(
+							attribute.name,
+							'computed',
 							`Computed property ${attribute.name} may not be directly assigned a value`
 						);
 					}
@@ -4009,13 +4193,13 @@ export function makeTable(options) {
 			if (sealed) {
 				for (const key in record) {
 					if (!attributes.find((attribute) => attribute.name === key)) {
-						(validationErrors || (validationErrors = [])).push(`Property ${key} is not allowed`);
+						addError(key, 'unknown_property', `Property ${key} is not allowed`);
 					}
 				}
 			}
 
 			if (validationErrors) {
-				throw new ClientError(validationErrors.join('. '));
+				throw new ValidationError(validationErrors, validationErrors.map((issue) => issue.message).join('. '));
 			}
 		}
 		// #section: stats-admin
@@ -4503,6 +4687,26 @@ export function makeTable(options) {
 		}
 	);
 
+	// Mark the table-level allowRead as a framework default (it is a this-free table/RBAC check):
+	// only an APPLICATION override is record-scoped and evaluated per record during query execution
+	// (#1422 gap 2 / #1241). supportsRowLevelAllowRead tells the authorization wrapper in
+	// Resource.ts that this class has the per-record machinery to defer collection reads to.
+	(TableResource.prototype.allowRead as any).isDefaultAllowRead = true;
+	(TableResource as any).supportsRowLevelAllowRead = true;
+	// Records can be asked directly (`record.allowRead(user, target, context)`), delegating to the
+	// table's allowRead with `this` = the record. Non-enumerable so it never serializes; defined on
+	// the per-table record prototype alongside computed properties. Engine-level enforcement does
+	// NOT route through this (it resolves the active resource class's allowRead, which honors
+	// endpoint subclass overrides and can't be shadowed by a record attribute of the same name).
+	if (primaryStore?.encoder?.structPrototype) {
+		Object.defineProperty(primaryStore.encoder.structPrototype, 'allowRead', {
+			value: function (user: User, target: RequestTarget, context: Context) {
+				return TableResource.prototype.allowRead.call(this, user, target, context);
+			},
+			configurable: true,
+			writable: true,
+		});
+	}
 	TableResource.updatedAttributes(); // on creation, update accessors as well
 	if (expirationMs) TableResource.setTTLExpiration(expirationMs / 1000);
 	if (expiresAtProperty) runRecordExpirationEviction();

package/resources/analytics/read.ts

@@ -192,47 +192,52 @@ interface GetAnalyticsOpts {
 
 export async function get(metric: string, opts?: GetAnalyticsOpts): Promise<Metric[]> {
 	const { getAttributes, startTime, endTime, additionalConditions, log: logName } = opts ?? {};
-	const conditions: Conditions = [{ attribute: 'metric', comparator: 'equals', value: metric }];
+
+	// A two-sided time window bounds the primary-key (`id` = [time, nodeId]) range on both ends. When we
+	// have one, lead with it and pin execution order (below) so it drives the scan. `Table.search`
+	// otherwise reorders conditions by estimated cost, but the planner estimates a primary-key `between`
+	// as a flat 10% of the table (search.ts BETWEEN_ESTIMATE) rather than from the actual range width —
+	// so on a large `hdb_analytics` table a narrow window looks costlier than `metric equals`, iteration
+	// is driven off the metric index, and the metric's entire history is decoded instead of the window
+	// (#1796). The proper long-term fix is a range-width-aware cost estimate in search.ts.
+	const boundedWindow = startTime != null && endTime != null;
+	const conditions: Conditions = [];
+	if (boundedWindow) {
+		conditions.push({ attribute: 'id', comparator: 'between', value: [startTime, endTime] });
+	}
+	conditions.push({ attribute: 'metric', comparator: 'equals', value: metric });
 	if (logName !== undefined) {
 		conditions.push({ attribute: 'log', comparator: 'equals', value: logName });
 	}
 	if (additionalConditions) {
 		conditions.push(...additionalConditions.map(conformCondition));
 	}
+	// An open-ended range (only start or only end) can span the whole table, so we append it and leave
+	// ordering to the planner rather than forcing an unbounded range to drive — which could scan the
+	// full table for a selective metric.
+	if (!boundedWindow) {
+		if (startTime != null) {
+			conditions.push({ attribute: 'id', comparator: 'greater_than_equal', value: startTime });
+		}
+		if (endTime != null) {
+			conditions.push({ attribute: 'id', comparator: 'less_than', value: endTime });
+		}
+	}
+
 	const select = getAttributes ?? [];
 
-	// ensure we're always selecting id
+	// ensure we're always selecting id (an empty select array already selects everything, including id)
 	if (!isSelected(select, 'id')) {
 		select.push('id');
 	}
 
-	if (startTime && endTime) {
-		conditions.push({
-			attribute: 'id',
-			comparator: 'between',
-			value: [startTime, endTime],
-		});
-	} else {
-		if (startTime) {
-			conditions.push({
-				attribute: 'id',
-				comparator: 'greater_than_equal',
-				value: startTime,
-			});
-		}
-		if (endTime) {
-			conditions.push({
-				attribute: 'id',
-				comparator: 'less_than',
-				value: endTime,
-			});
-		}
-	}
-
 	// `snapshot: false` lets these (potentially long-running) analytics scans read against the
 	// latest committed data without holding a consistent read snapshot open, so they stay easier
 	// on the rest of the system (a pinned snapshot would block compaction for the scan's duration).
 	const request: any = { conditions, allowConditionsOnDynamicAttributes: true, snapshot: false };
+	if (boundedWindow) {
+		request.enforceExecutionOrder = true;
+	}
 	if (select.length > 0) {
 		request['select'] = select;
 	}