fix(analytics): render the read scope in ObjectQLStrategy.generateSql (#3654 residual 2)

generateSql (the representative statement echoed to /analytics/sql and
dataset responses) rendered the query's own filters but NOT the tenant/RLS
read scope that execute() injects via withReadScope — so the previewed
WHERE understated what actually runs. It now renders the base object's
scope too (parameterized, $n placeholders), ANDed with the query filters.

For consistency generateSql also applies the #3654 cross-object guard, so
/analytics/sql no longer previews a dotted-column statement for a query
execute() refuses to run — same clear error instead of misleading SQL.

Display-only (no data leak — the string is documentation, values stay
placeholders); no change when no read-scope provider is configured.

Tests: generateSql now renders "opportunity"."organization_id" = $n and
ANDs it with the query filter; a cross-object preview rejects; the
no-provider case is unchanged. Reverting the change turns the three
load-bearing assertions red.

Co-Authored-By: Claude <noreply@anthropic.com>

Author: os-zhuang

.changeset/objectql-generatesql-scope.md

@@ -0,0 +1,21 @@
+---
+"@objectstack/service-analytics": patch
+---
+
+fix(analytics): show the read scope in ObjectQLStrategy's previewed SQL (#3654 residual 2)
+
+`ObjectQLStrategy.generateSql` (the representative statement echoed to
+`/analytics/sql` and dataset responses) rendered the query's own filters but NOT
+the tenant/RLS read scope that `execute()` injects. The preview therefore
+understated the real WHERE — an author debugging a widget saw fewer constraints
+than the query actually ran with. It now renders the base object's read scope
+too, parameterized, alongside the query filters.
+
+For consistency, `generateSql` also applies the #3654 cross-object guard, so
+`/analytics/sql` no longer previews a dotted-column statement for a cross-object
+query that `execute()` refuses to run (the engine cannot join in an aggregate) —
+it returns the same clear error instead.
+
+Display-only: the previewed string is documentation, never the executed
+statement, and carries no data (filter values stay `$n` placeholders). No change
+when no read-scope provider is configured.

packages/services/service-analytics/src/__tests__/objectql-read-scope.test.ts

@@ -267,3 +267,63 @@ describe('ObjectQLStrategy — cross-object references are fail-closed (#3654, s
     expect(wasExecuted()).toBe(false);
   });
 });
+
+describe('ObjectQLStrategy.generateSql — read scope in the previewed WHERE (#3654 residual 2)', () => {
+  it('renders the tenant/RLS predicate the query actually runs with', async () => {
+    const { sql, params } = await makeService([]).generateSql(
+      { cube: 'sales', dimensions: ['region'], measures: ['revenue'] },
+      ctxA,
+    );
+    // The previewed SQL must carry the scope, not just the SELECT/GROUP BY —
+    // before #3654 residual 2 the WHERE omitted it and understated what runs.
+    expect(sql).toMatch(/WHERE .*"opportunity"\."organization_id" = \$\d+/);
+    expect(params).toContain('org_A');
+  });
+
+  it('ANDs the query filter and the scope together in the preview', async () => {
+    const { sql, params } = await makeService([]).generateSql(
+      {
+        cube: 'sales',
+        dimensions: ['region'],
+        measures: ['revenue'],
+        where: { region: 'West' },
+      },
+      ctxA,
+    );
+    expect(sql).toContain('WHERE');
+    expect(sql).toMatch(/region .*=.* \$\d+/);
+    expect(sql).toMatch(/"opportunity"\."organization_id" = \$\d+/);
+    expect(params).toEqual(expect.arrayContaining(['West', 'org_A']));
+  });
+
+  it('omits the scope predicate when no provider is configured (unchanged)', async () => {
+    const { sql } = await makeService([], { getReadScope: undefined }).generateSql(
+      { cube: 'sales', dimensions: ['region'], measures: ['revenue'] },
+      ctxA,
+    );
+    expect(sql).not.toContain('organization_id');
+  });
+
+  it('rejects a cross-object preview (no dotted-column SQL for a query execute() refuses)', async () => {
+    const compiled = compileDataset(
+      DatasetSchema.parse({
+        name: 'sql_by_account',
+        label: 'x',
+        object: 'opportunity',
+        include: ['account'],
+        dimensions: [{ name: 'region', field: 'account.region', type: 'string' }],
+        measures: [{ name: 'revenue', aggregate: 'sum', field: 'amount' }],
+      }),
+    );
+    const svc = new AnalyticsService({
+      cubes: [compiled.cube],
+      queryCapabilities: objectqlOnly,
+      executeAggregate: async () => [],
+      getReadScope: readScope,
+      getAllowedRelationships: () => compiled.allowedRelationships,
+    });
+    await expect(
+      svc.generateSql({ cube: 'sql_by_account', dimensions: ['region'], measures: ['revenue'] }, ctxA),
+    ).rejects.toThrow(/cannot group or aggregate across a relationship/);
+  });
+});

packages/services/service-analytics/src/strategies/objectql-strategy.ts

@@ -1,9 +1,10 @@
 // Copyright (c) 2025 ObjectStack. Licensed under the Apache-2.0 license.
 
 import type { AnalyticsQuery, AnalyticsResult } from '@objectstack/spec/contracts';
-import type { Cube } from '@objectstack/spec/data';
+import type { Cube, FilterCondition } from '@objectstack/spec/data';
 import type { AnalyticsStrategy, StrategyContext } from './types.js';
 import { normalizeAnalyticsFilters, coerceFilterValueForObjectQL } from './filter-normalizer.js';
+import { compileScopedFilterToSql } from '../read-scope-sql.js';
 
 /**
  * ObjectQLStrategy — Priority 2
@@ -178,6 +179,21 @@ export class ObjectQLStrategy implements AnalyticsStrategy {
       return gran ? `date_trunc('${gran}', ${col})` : col;
     };
 
+    // #3654 — reject a cross-object query HERE too, so `/analytics/sql` never
+    // previews a dotted-column statement that `execute()` refuses to run (the
+    // engine cannot join in an aggregate). Reconstruct the resolved field names
+    // the shared guard inspects.
+    const guardGroupBy = [
+      ...(query.dimensions ?? []).map((d) => this.resolveFieldName(cube, d, 'dimension')),
+      ...[...granByDim.keys()]
+        .filter((d) => !query.dimensions?.includes(d))
+        .map((d) => this.resolveFieldName(cube, d, 'dimension')),
+    ];
+    const guardFilter = Object.fromEntries(
+      normalizeAnalyticsFilters(query).map((f) => [this.resolveFieldName(cube, f.member, 'any'), true]),
+    );
+    this.assertNoCrossObjectReferences(cube, query, guardGroupBy, guardFilter);
+
     if (query.dimensions) {
       for (const dim of query.dimensions) {
         const expr = dimExpr(dim);
@@ -230,6 +246,24 @@ export class ObjectQLStrategy implements AnalyticsStrategy {
         whereParts.push(`${col} ${op} $${params.length}`);
       }
     }
+
+    // #3654 — render the READ SCOPE (tenant + RLS) that `execute()` injects via
+    // `withReadScope`, so the previewed WHERE is an honest account of what runs.
+    // Without this the query's own filters showed but the security predicate
+    // silently didn't — the preview understated the real constraint set. Base
+    // object only: cross-object queries are already rejected above.
+    if (typeof ctx.getReadScope === 'function') {
+      const scope = ctx.getReadScope(tableName);
+      if (scope != null) {
+        const { sql: scopeSql, params: scopeParams } = compileScopedFilterToSql(scope as FilterCondition, tableName);
+        if (scopeSql) {
+          let i = 0;
+          const rendered = scopeSql.replace(/\?/g, () => { params.push(scopeParams[i++]); return `$${params.length}`; });
+          whereParts.push(`(${rendered})`);
+        }
+      }
+    }
+
     if (whereParts.length > 0) sql += ` WHERE ${whereParts.join(' AND ')}`;
 
     if (groupByParts.length > 0) {