#434

backend/app/controllers/counts_exports_controller.rb

@@ -99,6 +99,11 @@ class CountsExportsController < ApplicationController
             first = false
           end
         end
+      rescue IOError, SystemCallError => error
+        Rails.logger.warn("counts_download_stream_failure: #{ error.class }")
+        HistoryAccess.set(user: authority) do
+          CountsExportJobs.download_attempt(job, owner, **arguments, status: 'failed')
+        end
       ensure
         stream.close
       end

backend/app/controllers/counts_tables_controller.rb

@@ -18,6 +18,10 @@ class CountsTablesController < ApplicationController
   def index
     resolve_locale!
     render json: CountsTableQuery.new(request.query_parameters).call
+  rescue CountsAxes::TooManyAxes
+    render json: { error: 'too_many_axes', max_axes: CountsAxes::MAX_AXES }, status: :bad_request
+  rescue CountsAxes::PrivateCondition
+    render json: { error: 'private_condition' }, status: :forbidden
   rescue CountsTableQuery::TooManyColumns
     render json: { error: 'too_many_columns', max_columns: CountsTableQuery::MAX_COLUMNS },
            status: :unprocessable_entity

backend/app/services/counts_axes.rb

@@ -68,6 +68,14 @@ class CountsAxes
     end
   end
 
+  def count_expression
+    return 'COUNT(DISTINCT v.id)' unless rows.any? { _1['field'] == 'tags' }
+
+    # Keep tag occurrences even when several private tags share one masked label.
+    "COUNT(DISTINCT v.id, COALESCE(CONCAT('internal:', tag_entry.tag_id), " +
+        "CONCAT('external:', tag_entry.external_tag_id)))"
+  end
+
   def joins(fields = all.map { _1['field'] })
     result = ''
     if fields.include?('tags')
@@ -85,9 +93,6 @@ class CountsAxes
       condition = @definition.changes.map do |field|
         "(changed.field_key = '#{ field }' AND #{ @population.changed_sql(field) })"
       end.join(' OR ')
-      unless HistoryAccess.admin?
-        condition = "(#{ condition }) OR NOT (#{ HistoryAccess.sql(@definition.model, 'v') })"
-      end
       result += " JOIN (#{ fields }) changed ON (#{ condition })"
     end
     result

backend/app/services/counts_export_jobs.rb

@@ -198,7 +198,7 @@ class CountsExportJobs
           state['expires_at'] > Time.current.to_f && HistoryAccess.authorised_artifact?(state))
       if attempt
         return unless state['download_attempt'] == attempt && state['token'] == file_token
-        return unless state['download_status'] == 'pending'
+        return unless ['pending', 'started'].include?(state['download_status'])
 
         state['download_status'] = status if status
       else

backend/app/services/counts_pivot_totals.rb

@@ -49,7 +49,7 @@ class CountsPivotTotals
           leaf = retained.map { @axes.expressions[_1] }
           selected = leaf.each_with_index.map { |expression, index| "#{ expression } AS k#{ index }" }
           inner = scope.group(*leaf.map { Arel.sql(_1) })
-              .select(Arel.sql((selected + ['COUNT(DISTINCT v.id) AS count']).join(', '))).to_sql
+              .select(Arel.sql((selected + ["#{ @axes.count_expression } AS count"]).join(', '))).to_sql
           coordinates = indexes.map { "k#{ retained.index(_1) }" }
           projected = coordinates.each_with_index.map { |key, index| "#{ key } AS v#{ index }" }
           output = ["#{ row_depth } AS row_depth", "#{ column_depth } AS column_depth"] +

backend/app/services/counts_population.rb

@@ -63,6 +63,8 @@ class CountsPopulation
   end
 
   def axis_condition(scope, entry)
+    raise CountsAxes::PrivateCondition if entry['value'] == CountsAxes::MASKED_VALUE
+
     key = entry.fetch('field')
     raise ArgumentError unless definition.axes(history).include?(key)
     if entry.key?('grain')

backend/app/services/counts_table_query.rb

@@ -88,7 +88,7 @@ class CountsTableQuery
             source.except(:select).select('COUNT(DISTINCT v.id) AS count').to_sql
           else
             source.except(:select).group(*expressions.map { Arel.sql(_1) })
-                .select(Arel.sql((selected + ['COUNT(DISTINCT v.id) AS count']).join(', ')))
+                .select(Arel.sql((selected + ["#{ axes.count_expression } AS count"]).join(', ')))
                 .to_sql
           end
     prefix = "WITH cells AS (#{ sql })"
@@ -359,7 +359,7 @@ class CountsTableQuery
     end
     selected = row_expressions.each_with_index.map { |expression, index|
       "#{ expression } AS a#{ index }"
-    } + ['COUNT(DISTINCT v.id) AS count']
+    } + ["#{ axes.count_expression } AS count"]
     source = source.group(*row_expressions.map { Arel.sql(_1) }) if row_expressions.any?
     source.select(Arel.sql(selected.join(', '))).to_sql
   end