#434

backend/app/services/counts_population.rb

@@ -57,7 +57,8 @@ class CountsPopulation
     "(previous.id IS NOT NULL AND NOT (v.#{ column } <=> previous.#{ column }))"
   end
 
-  # Unrestricted predicates are used only for numerical totals, never record output.
+  # Aggregate sources are unrestricted; CountsAxes masks their output coordinates.
+  # Never serialise raw records from an unrestricted population.
   def access_sql(model, row)
     @authorisation_flg ? HistoryAccess.sql(model, row) : 'TRUE'
   end
@@ -67,6 +68,16 @@ class CountsPopulation
 
     key = entry.fetch('field')
     raise ArgumentError unless definition.axes(history).include?(key)
+    value = entry['value']
+    unless value.nil?
+      valid = case definition.fields[key]
+              when :integer
+                value.is_a?(Integer) || (value.is_a?(String) && value.match?(/\A-?[0-9]+\z/))
+              when :boolean then [true, false].include?(value)
+              else value.is_a?(String)
+              end
+      raise ArgumentError unless valid
+    end
     if entry.key?('grain')
       unless definition.fields[key] == :datetime && CountsAxes::GRAINS.include?(entry['grain'])
         raise ArgumentError