@objectstack/service-analytics 8.0.0 → 8.0.1

package/dist/index.cjs

@@ -1176,13 +1176,60 @@ var AnalyticsService = class {
    * current request's ExecutionContext (ADR-0021 D-C). The strategy then sees a
    * `getReadScope(objectName)` that already knows the active tenant.
    */
-  callCtx(context) {
+  async callCtx(query, context) {
     if (!this.readScopeProvider) return this.baseCtx;
+    const scopes = await this.resolveReadScopes(query, context);
     return {
       ...this.baseCtx,
-      getReadScope: (objectName) => this.readScopeProvider(objectName, context)
+      getReadScope: (objectName) => scopes.get(objectName) ?? null
     };
   }
+  /**
+   * Resolve the read scope (tenant + RLS `FilterCondition`) for the base object
+   * AND every joined object of the query's cube, keyed by object name. This is
+   * the async pre-pass that lets the synchronous strategy enforce scoping even
+   * when the provider (security `getReadFilter`) resolves asynchronously.
+   *
+   * The object set is `cube.sql` (base) plus every `cube.joins[*].name` — a
+   * SUPERSET of what the strategy actually scans (the strategy only joins along
+   * declared relationships), so no scanned object is ever left unscoped.
+   *
+   * Fail-closed: if the provider throws for an object, the whole query is
+   * rejected rather than emitting SQL with that object unscoped.
+   */
+  async resolveReadScopes(query, context) {
+    const map = /* @__PURE__ */ new Map();
+    const provider = this.readScopeProvider;
+    if (!provider || !query.cube) return map;
+    const cube = this.cubeRegistry.get(query.cube);
+    if (!cube) return map;
+    const objects = /* @__PURE__ */ new Set();
+    if (typeof cube.sql === "string" && cube.sql.trim()) {
+      objects.add(cube.sql.trim());
+    }
+    const joins = cube.joins;
+    if (joins) {
+      for (const [alias, j] of Object.entries(joins)) {
+        objects.add(j?.name ?? alias);
+      }
+    }
+    for (const object of objects) {
+      let filter;
+      try {
+        filter = await provider(object, context);
+      } catch (e) {
+        this.logger.error?.(
+          `[Analytics] read-scope resolution failed for object "${object}" \u2014 rejecting query (fail-closed, ADR-0021 D-C)`,
+          e instanceof Error ? e : new Error(String(e))
+        );
+        throw new Error(
+          `[Analytics] read-scope resolution failed for "${object}"; query denied (fail-closed).`
+        );
+      }
+      if (filter != null) map.set(object, filter);
+    }
+    return map;
+  }
   /**
    * Execute an analytical query by delegating to the first capable strategy.
    */
@@ -1191,7 +1238,7 @@ var AnalyticsService = class {
       throw new Error("Cube name is required in analytics query");
     }
     this.ensureCube(query);
-    const ctx = this.callCtx(context);
+    const ctx = await this.callCtx(query, context);
     const strategy = this.resolveStrategy(query, ctx);
     this.logger.debug(`[Analytics] Query on cube "${query.cube}" \u2192 ${strategy.name}`);
     return strategy.execute(query, ctx);
@@ -1246,7 +1293,7 @@ var AnalyticsService = class {
       throw new Error("Cube name is required for SQL generation");
     }
     this.ensureCube(query);
-    const ctx = this.callCtx(context);
+    const ctx = await this.callCtx(query, context);
     const strategy = this.resolveStrategy(query, ctx);
     this.logger.debug(`[Analytics] generateSql on cube "${query.cube}" \u2192 ${strategy.name}`);
     return strategy.generateSql(query, ctx);