#434

backend/spec/services/counts_pivot_security_spec.rb

@@ -132,11 +132,14 @@ RSpec.describe 'Counts masked pivot contracts' do
 
   it 'rejects private predicates and supplied measure coordinates before SQL labels escape' do
     probes = [{ 'resource_id' => PostVersion.first.post_id.to_s },
-        { 'tags' => 'A' }, { 'tag_refs.0.name' => 'A', 'tag_refs.0.tag_id' => tags.first.id.to_s },
-        { 'conditions.0.field' => 'title', 'conditions.0.operator' => 'eq',
+        { 'tags' => 'A' },
+        { 'tag_refs' => '', 'tag_refs.0.name' => 'A', 'tag_refs.0.tag_id' => tags.first.id.to_s },
+        { 'conditions' => '', 'conditions.0.field' => 'title', 'conditions.0.operator' => 'eq',
           'conditions.0.value' => 'hidden-title-0' },
-        { 'drill.0.field' => 'tags', 'drill.0.value' => "internal:#{ tags.first.id }" },
-        { 'cols' => 'tags', 'column_order.0.value' => CountsAxes::MASKED_VALUE }]
+        { 'drill' => '', 'drill.0.field' => 'tags', 'drill.0.value_type' => 'string',
+          'drill.0.value' => "internal:#{ tags.first.id }" },
+        { 'cols' => 'tags', 'column_order' => '', 'column_order.0.value_type' => 'string',
+          'column_order.0.value' => CountsAxes::MASKED_VALUE }]
     HistoryAccess.set(user: nil) do
       probes.each do |probe|
         expect { CountsTableQuery.new(params.merge(probe)) }
@@ -148,6 +151,7 @@ RSpec.describe 'Counts masked pivot contracts' do
   it 'keeps public column sorting usable while guessed private coordinates match nothing' do
     first = result(nil, 'rows' => 'event_type', 'cols' => 'tags')
     probe = result(nil, 'rows' => 'event_type', 'cols' => 'tags',
+        'column_order' => '', 'column_order.0.value_type' => 'string',
         'column_order.0.value' => "internal:#{ tags.first.id }")
     expect(probe[:column_values]).to eq(first[:column_values])
     expect(probe[:cells]).to eq(first[:cells])