#434

backend/spec/requests/counts_table_spec.rb

@@ -50,6 +50,32 @@ RSpec.describe 'Counts table API', type: :request do
 
   def versions(result) = result.fetch('versions').map { _1.fetch('version_no') }
 
+  it 'identifies a totals timeout without exposing SQL in the error response' do
+    allow_any_instance_of(CountsPivotTotals).to receive(:call)
+        .and_raise(CountsPivotTotals::TimedOut, 'private SQL')
+    get '/counts/query', params: base.merge(mode: 'summary', rows: 'created_at:month')
+    expect(response).to have_http_status(:service_unavailable)
+    expect(response.parsed_body).to eq('error' => 'counts_query_timeout',
+        'stage' => 'totals', 'timeout_seconds' => 30)
+    expect(response.body).not_to include('private SQL')
+  end
+
+  it 'applies the same optimizer safeguards to the paginated detail SELECT' do
+    statements = []
+    listener = lambda do |_name, _start, _finish, _id, payload|
+      statements << payload[:sql]
+    end
+    ActiveSupport::Notifications.subscribed(listener, 'sql.active_record') do
+      result = query(tags: 'alpha', limit: 1)
+      expect(result['count']).to eq(2)
+      expect(versions(result)).to eq([1])
+    end
+    details = statements.find { _1.include?('AS counts_latest') }
+    expect(details).not_to be_nil
+    expect(details).to include('MAX_EXECUTION_TIME(30000)',
+        "SET_VAR(optimizer_switch='semijoin=off')")
+  end
+
   it 'separates latest and history and defaults to stable detail ordering and limit 100' do
     history = query
     expect(versions(history)).to eq([1, 2, 3])