#434

backend/app/services/counts_table_query.rb

@@ -49,12 +49,18 @@ class CountsTableQuery
       result = metadata.merge(mode == 'summary' ? summary : details)
       visible = mode == 'summary' ? result[:visible_output_count] : result[:count]
       totals = output_totals(visible)
-      result.merge(visible_output_count: visible,
+      response = result.merge(visible_output_count: visible,
           **totals,
           output_count_scope: 'before_authorisation',
           output_count_unit: 'regular_result_rows',
           page_grand_total_repeated: mode == 'summary' && axes.rows.any? &&
               result[:group_count] > limit)
+      if mode == 'summary'
+        response.except!(:excluded_count, :excluded_count_scope)
+        response[:column_values_editable] = HistoryAccess.admin? ||
+            !result.fetch(:column_values, []).flatten.include?(CountsAxes::MASKED_VALUE)
+      end
+      response
     end
   end
 
@@ -228,17 +234,17 @@ class CountsTableQuery
 
     fields = QueryState.records(@params, 'conditions') + QueryState.records(@params, 'drill')
     private_fields = fields.any? { !CountsAxes::PUBLIC_FIELDS.include?(_1['field']) }
-    private_parameters = ['tags', 'tag_refs', 'tag', 'kind', 'resource_id', 'user_id',
-                          'name_scope'].any? do |key|
+    keys = ['tags', 'tag_refs', 'tag', 'kind', 'resource_id', 'user_id']
+    private_parameters = keys.any? do |key|
       @params.any? { |name, value| (name == key || name.start_with?("#{ key }.")) && value != '' }
     end
     raise CountsAxes::PrivateCondition if private_fields || private_parameters
 
     ['column_order', 'measures'].each do |key|
-      next if QueryState.records(@params, key).empty?
-      columns = QueryState.axes(@params.fetch('cols', ''))
-      raise CountsAxes::PrivateCondition if columns.any? do |axis|
-        !CountsAxes::PUBLIC_FIELDS.include?(axis['field'])
+      # Coordinates are compared only to already masked expressions, never raw
+      # values. Public coordinates remain sortable; a guessed private ID cannot match.
+      raise CountsAxes::PrivateCondition if QueryState.records(@params, key).any? do |record|
+        record['value'] == CountsAxes::MASKED_VALUE
       end
     end
   end
@@ -350,6 +356,11 @@ class CountsTableQuery
   def measure_relation values
     row_expressions = axes.expressions.first(axes.rows.length)
     source = summary_population.scope.except(:select, :order)
+    # Omitted multi-value column axes still determine full-cell membership.
+    membership = summary_population.scope.except(:select, :order)
+    all_joins = axes.joins
+    membership = membership.joins(all_joins) unless all_joins.empty?
+    source = source.where("v.id IN (#{ membership.select('v.id').distinct.to_sql })")
     fields = axes.rows + axes.columns.first(values.length)
     joins = axes.joins(fields.map { _1.fetch('field') })
     source = source.joins(joins) unless joins.empty?
@@ -367,7 +378,15 @@ class CountsTableQuery
   def axis_order_sql key, direction = 'asc', qualifier: nil
     column = qualifier ? "#{ qualifier }.#{ key }" : key
     expression = column
-    if axes.all.fetch(key.delete_prefix('a').to_i).fetch('field') == 'category'
+    field = axes.all.fetch(key.delete_prefix('a').to_i).fetch('field')
+    if !HistoryAccess.admin? && [:integer, :boolean].include?(@definition.fields[field])
+      masked = @connection.quote(CountsAxes::MASKED_VALUE)
+      expression = "CASE WHEN #{ column } <=> #{ masked } THEN NULL " +
+          "ELSE CAST(#{ column } AS SIGNED) END"
+      return "#{ column } IS NULL ASC, (#{ column } <=> #{ masked }) ASC, " +
+          "#{ expression } #{ direction.upcase }"
+    end
+    if field == 'category'
       # Tag's enum preserves the same category order as TagsController.
       cases = Tag.categories.keys.each_with_index.map { |category, index|
         "WHEN #{ @connection.quote(category) } THEN #{ index }"
@@ -418,7 +437,10 @@ class CountsTableQuery
       labels = case field
                when 'tags' then tag_labels(values)
                when 'user'
-                 User.where(id: values).pluck(:id, :name).to_h.transform_keys(&:to_s)
+                 actors = HistoryAccess.visible(population.scope, 'v').except(:select, :order)
+                     .select('v.created_by_user_id')
+                 User.where(id: values).where(id: actors)
+                     .pluck(:id, :name).to_h.transform_keys(&:to_s)
                else {}
                end
       [field, labels]