[kriszyp]

⊙ Problem

SQL attribute permissions missed some column references, so a role denied read on a column could still filter or join on it:

• JOIN … USING (col), including self-joins
• an unqualified column inside JOIN … ON
• a qualifier naming no table, or one table's alias and another's name
• a column nested 100+ levels deep
• an UPDATE or DELETE WHERE, or a column an UPDATE SET reads
• on legacy SQL, a string, name or number that reads back as more columns when legacy writes the checked statement out as SQL text and parses it again

Whole-row expressions (_, SELECT VALUE, JavaScript, ?/$n parameters) name no column; legacy SQL rows always carry the primary key. A restricted role's SELECT ? returned the read-denied primary key.

🤔 Should non-super users lose whole-row expressions?

Yes, as the task specified. Legacy joins merge rows by primary key; not loading an unreadable one would break them. Non-super users lose _, a bare SELECT VALUE/ROW, JavaScript expressions (even calculation-only ones) and parameters; the sql operation binds none. The _ part could later be relaxed for roles without attribute permissions.

💡 Solution

• Each column is checked on the table the engine reads (rules shared with the v2 binder); a denied one gets a 403.
• Non-super users get a 403 for a qualifier naming no single table, and for whole-row expressions.
• UPDATE and DELETE also need read on the columns they filter on or read.
• Legacy SQL writes string, JSON and number literals so they read back unchanged. It refuses with a 400 a statement whose text would read anything the checked statement does not; an INSERT is checked only on the values it writes as text.
• Super users are unchanged; on v2, permitted USING returns the same rows as ON.

⚖️ Alternatives

Approaches not taken

• Stop loading unreadable primary keys in legacy SQL: legacy joins merge rows by primary key, and this does nothing for the v2 engine or USING.
• Authorize the v2 engine's bound plan: legacy never binds; two authorizers could disagree.
• Refuse every USING and unqualified join column: blocks permitted queries.

🤔 Refuse a qualifier the two engines read differently, rather than resolve it?

v2 picks an alias over a table name; legacy matches either. So … FROM data.t x JOIN data.u t … with t.id now fails for non-super users. Resolving it v2's way would let legacy read a table other than the one checked.

🤔 Exempt the primary key from the UPDATE/DELETE read check?

Yes: the statement returns the keys it touched, like NoSQL update and delete, so a write-only role keeps UPDATE … WHERE id = …. Table read isn't required, so a table-read: false role without an attribute list may filter writes on any column; one with a list may not.

🤔 Refuse what legacy SQL cannot write back, rather than find a spelling for it?

Yes, on legacy only: a name holding `, [, ] or ', a string ending in an odd run of backslashes, a number too large for a double, or an unaliased function column whose text holds ] gets a 400. v2 accepts them. Each could be relaxed later. The check costs one extra AlaSQL parse per legacy SELECT, UPDATE or DELETE (about 1 ms for a join on a loaded box).

🔧 Changes

• sqlTranslator/sql_statement_bucket.ts: builds a per-statement table scope and matches each column to it; a qualifier must have exactly one claimant; an ON column falls back to later joins; USING records both operands. ⚠️ Look hardest: this attribution is the only thing the attribute checks see. Every walk is iterative and unbounded, and skips JSON literal data and COUNT(*)'s *. Unresolved qualifiers and whole-row expressions are reported, including __proto__ literals. UPDATE/DELETE reads are listed apart from SET targets, with foreign qualifiers refused. A joined SELECT * is qualified with the FROM alias.
• sqlEngine/binder/columnScope.ts: the shared rules, used by bind.ts and logical/build.ts.
• utility/operation_authorization.ts: the new refusals and the UPDATE/DELETE read check, non-super users only; their messages in commonErrors.ts.
• sqlTranslator/legacySqlText.ts: string and number writers, installed in place of AlaSQL's by alasqlFunctionImporter.ts; assertLegacySqlText runs before legacy SQL and re-parses the text legacy will run, counting each table-qualified column against the checked statement.
• dataLayer/SQLSearch.ts writes a join's primary-key result name through generatedName(), so a table alias holding " cannot end it early.
• sqlTranslator/DESIGN.md records the invariant; DESIGN.md indexes it.

✅ Verification

• New sql-attribute-perms.test.ts (fixture, schema): 42/42 on all three engines; every refusal case fails on origin/main, and each legacy-text case fails on the commit before its fix.
• CI on 5cf6b07 (rebased onto main 664185c): runLinter fails only on main's own two resources/MAP.md index errors, which main fails too; the other 68 checks pass (a record-lock unit test on Node 24 and a Bun log-order test failed once, unrelated to this diff, and passed on rerun). Root DESIGN.md was pruned to its ceiling (three index descriptions shortened).
• PR QA: passed on e9eae90 (qa-pr-harper-3804-e9eae90-r2), before the legacy-text commits.

Test detail

• Local on 5cf6b07: build and SQL unit suites pass (285, SQLSearch 91); SQL integration suites pass (northwind 564, 13 skipped; sql-attribute-perms 42 on three engines, with parameter cases that returned the denied key before); a legacy-engine server joins tables with and without aliases and with a ] in the primary-key name; new legacySqlText.test.js covers every short string of letters, quotes and backslashes, JSON keys, numbers, names and the re-parse check.
• A live legacy-engine server returns the literal for SELECT 'x'', ssn, ''y' AS v, stores 1e25 and 1e-7 exactly, and answers 400 to the -> and unaliased-function cases.
• 12 cases × 3 engines; the controls (permitted USING, permitted UPDATE/DELETE, super user) pass on base and head. sql-count-star-attribute-roles, sql-unqualified-table-authz and sql-not-predicate still pass.
• Unit: new column-attribution.test.js (attribution rules, write reads, row accessors) and columnScope.test.js, a verifyPermsAST case, and an updated unknown-qualifier case; SQL and authorization suites 386 passing.

Authorization cost A/B (base vs head, bench-run, turbo off, median of 7)

Statement	base	head	alasql.parse
single-table SELECT	7.6 µs	7.3 µs	107 µs
two-table join	6.3 µs	5.7 µs	228 µs
IN list ×5000	6176 µs	1078 µs	40 ms
INSERT ×1000 rows	3.3 µs	436 µs	29 ms

INSERT walks its VALUES for whole-row expressions: +433 µs per 1000 rows, 1.5% of its parse time.

— Claude Opus 5.5

_{🤖 Generated by Anthropic Claude (Opus 5.5); posted via @kriszyp.}

🤖 Generated with Claude Code

https://claude.ai/code/session_01RGfHqd6v2q9t9jJ26No4Jc

Release target: main — changes SQL authorization on main; backporting to release lines is the owner's call
Related PRs: #3286 overlaps (merged; this branch is rebased onto it and carries its COUNT(*) rule into the shared column walk)
Complexity: complicated

Deferred findings

• f621bcf93a29ff12 minor security — sqlTranslator/sql_statement_bucket.ts — Unqualified SELECT * on a join expanded only from the FROM table — NOT FILED
• 11fa1236c1abc837 nit maintainability — sqlTranslator/sql_statement_bucket.ts — columnNodes duck-types columns by truthy columnid instead of instanceof yy.Column — NOT FILED
• fadd55a1652ea2f9 nit security — sqlTranslator/sql_statement_bucket.ts — Nested-subquery columns attributed with outer scope; safe only because nested queries are refused first — NOT FILED
• 16c7f63b919b7955 nit maintainability — sqlTranslator/sql_statement_bucket.ts — Derived-JOIN placeholder in attribution scope records nothing; safe only while getTableTargets refuses derived joins — NOT FILED
• f7d60cec4ab79814 nit test-coverage — integrationTests/security/sql-attribute-perms.test.ts — End-to-end permission matrix skipped on win32 and bun — NOT FILED
• 8efbf8eab2ff0fdb nit performance — sqlTranslator/sql_statement_bucket.ts — getRowAccessors/getWriteStatementReads/reportForeignQualifiers re-walk the AST per non-super statement — NOT FILED
• 5f81fd793b7edd87 nit correctness — sqlTranslator/sql_statement_bucket.ts — Constant JSON literal with proto refused for non-super users (over-reject) — NOT FILED
• b508750926c4c392 nit security — sqlTranslator/sql_statement_bucket.ts — Literal * attribute in FIRST(*)/COUNT(DISTINCT *) recorded on FROM only and stripped by wildcard expansion — NOT FILED
• 57cf07febc93b634 nit maintainability — sqlTranslator/sql_statement_bucket.ts — Added comments narrate adjacent code or duplicate sqlTranslator/DESIGN.md — NOT FILED

Late Grok findings

9 surviving (highest nit) — Grok reviewed 532b94a, ruled against 0bc12d0

• nit — sqlTranslator/sql_statement_bucket.ts:312 — A constant JSON literal with __proto__ is still refused for non-super users. The refusal now comes first from the unresolved-column check (utility/operation_authorization.ts:623-626), so the user gets an unresolved-column error instead of the row-accessor error. Scope: in-scope — Convergence-Cla
• nit — sqlTranslator/sql_statement_bucket.ts:318 — columnNodes treats any node with a truthy columnid as a column. It does not check instanceof yy.Column. Scope: in-scope — Convergence-Class: previously-adjudicated
• nit — sqlTranslator/sql_statement_bucket.ts:641 — Column nodes inside nested subqueries are attributed to the outer scope. This is safe only because getTableTargets refuses nested queries first (:382-385). Scope: in-scope — Convergence-Class: previously-adjudicated
• nit — integrationTests/security/sql-attribute-perms.test.ts:18 — The end-to-end permission matrix is skipped on win32 and Bun. Scope: in-scope — Convergence-Class: previously-adjudicated
• nit — sqlTranslator/sql_statement_bucket.ts:145 — Each non-super statement walks the AST up to three more times (row accessors, write reads, columns). Scope: in-scope — Convergence-Class: previously-adjudicated
• nit — sqlTranslator/sql_statement_bucket.ts:536 — A derived JOIN keeps an attribution slot that records nothing. This is safe only while getTableTargets refuses derived joins (:397-401). Scope: in-scope — Convergence-Class: previously-adjudicated
• nit — sqlTranslator/sql_statement_bucket.ts:590 — Some added comments narrate history ("rather than dying here … as a 500") or repeat sqlTranslator/DESIGN.md. Same applies at :230-231 and :150-151. Scope: in-scope — Convergence-Class: previously-adjudicated
• nit — sqlTranslator/sql_statement_bucket.ts:632 — Partially resolved. The fallback to tables joined later only fires when the ON prefix has zero owners. If a prefix table has attributesKnown: false, every prefix table counts as an owner, the fallback never runs, and a later table that declares the column is not recorded. Scope: in-scope — Converg
• nit — unitTests/sqlTranslator/column-attribution.test.js:197 — No test covers getWriteStatementReads with a JSON literal in UPDATE SET. The existing SET label = {columnid:'ssn'} assertion cannot fail any more, because getUpdateAttributes no longer walks SET expressions. Scope: in-scope — Convergence-Class: previously-adjudicated

Not standing: 4 resolved. Grok ran 16m (16m from launch to report); the fold adjudication (cursor-grok@532b94aae8c4-d8290b18, claude) took 2m.

Origin — the dispatch brief this PR was written from

Make the SQL attribute-permission check cover every way a statement can reference a column. (1) sqlTranslator/sql_statement_bucket.ts (~603-631) walks join.on but never join.using, so columns named in JOIN ... USING (col) are not checked against either side's attribute_permissions (an ON a.col = b.col with the same column is refused). Walk join.using, qualifying each column against every joined table that declares it, on both sql engines. (2) Legacy SQL always loads the table's primary key into the row container given to AlaSQL (dataLayer/SQLSearch.ts ~637-642), so column-free accessors such as VALUE / -> reach it even when the role cannot read the primary key. Do not load an attribute the role cannot read, or refuse non-super statements that use column-free row accessors.

Acceptance

Integration tests on legacy, auto and new engines: a role with read:false on a column gets 403 for JOIN ... USING on that column (two tables and self-join) and for a column-free accessor reaching a read-denied primary key; USING on a permitted column returns the same rows as the equivalent ON; super user unchanged. Shown failing on origin/main.

_{Dispatch: task harper-sql-permission-walk-using-and-container · queued by finding-triage/wave-36 · ran by claude/opus/high · worker kzyp-xps-1}

_{Review-Coverage: authored=claude; ran=cursor-composer,gemini,codex,cursor-grok; late=cursor-grok:adjudicated; adjudicated=domain; declined=muse; rounds=27; full=9 @ bab75e3}

_{Review-Attention: study ~9m (decisions: do-less-alternative, row-accessor-refusal-breadth, write-reads-pk-exempt, legacy-refuses-unwritable-names) @ bab75e3}

[gemini-code-assist]

Code Review

This pull request refactors and strengthens SQL attribute-level read permission checks across all SQL engines (legacy, auto, and new). It introduces a shared column resolution scope helper (columnScope.ts) used by both the query binder and the authorization bucket (sqlStatementBucket) to ensure columns are authorized against the exact tables they are read from. The AST walking mechanism is updated from RecursiveIterator to custom iterative generators (astNodes and columnNodes) to prevent depth-limit bypasses and handle shared subquery nodes. Additionally, the PR adds strict checks to refuse statements with unresolved column qualifiers, whole-row accessors (like _ or JavaScript expressions), and unauthorized reads in UPDATE/DELETE statements. Comprehensive unit and integration tests are added to verify these security boundaries. There are no review comments to evaluate, and I have no feedback to provide.

[kriszyp]

Comment for harper#3804 (RBAC through @relationship): tests 1-5 of SP-33 are fixed by #3316 (merged 2026-10-30). Test 6, the JOIN ... USING leak, remains: sqlTranslator/sql_statement_bucket.ts only walks join.on (~611), so USING columns skip the attribute gate. #3804 is open and no longer a draft but reports CONFLICTING; needs a rebase. P1, effort Low.