#434

backend/app/services/counts_table_query.rb

@@ -16,7 +16,9 @@ class CountsTableQuery
 
     params = CountsDefaults.for(params).slice(*KEYS).merge(params)
     @params = params
-    @population = CountsPopulation.new(params)
+    @mode = params.fetch('mode', 'summary')
+    validate_summary_conditions!
+    @population = CountsPopulation.new(params, authorisation_flg: mode != 'summary')
     @definition = population.definition
     @connection = @definition.model.connection
     @axes = CountsAxes.new(population)
@@ -64,6 +66,7 @@ class CountsTableQuery
         definition: population.history ? 'history' : 'latest',
         timezone: population.timezone.identifier, rows: axes.rows, cols: axes.columns,
         fields: @definition.metadata,
+        masked_value: HistoryAccess.admin? ? nil : CountsAxes::MASKED_VALUE,
         count: record_counts[:visible] }
   end
 
@@ -218,19 +221,41 @@ class CountsTableQuery
 
   private
 
+  # Public timeline predicates may include hidden records. Private predicates must
+  # never become a count oracle, even when the selected axes themselves are public.
+  def validate_summary_conditions!
+    return if mode != 'summary' || HistoryAccess.admin?
+
+    fields = QueryState.records(@params, 'conditions') + QueryState.records(@params, 'drill')
+    private_fields = fields.any? { !CountsAxes::PUBLIC_FIELDS.include?(_1['field']) }
+    private_parameters = ['tags', 'tag_refs', 'tag', 'kind', 'resource_id', 'user_id',
+                          'name_scope'].any? do |key|
+      @params.any? { |name, value| (name == key || name.start_with?("#{ key }.")) && value != '' }
+    end
+    raise CountsAxes::PrivateCondition if private_fields || private_parameters
+
+    ['column_order', 'measures'].each do |key|
+      next if QueryState.records(@params, key).empty?
+      columns = QueryState.axes(@params.fetch('cols', ''))
+      raise CountsAxes::PrivateCondition if columns.any? do |axis|
+        !CountsAxes::PUBLIC_FIELDS.include?(axis['field'])
+      end
+    end
+  end
+
   def unrestricted_population
     @unrestricted_population ||= CountsPopulation.new(
         @params.merge('execution_at' => population.at.iso8601(6)), authorisation_flg: false)
   end
 
   def summary_population
-    unrestricted_population
+    population
   end
 
   def record_counts
     return @record_counts if @record_counts
 
-    if HistoryAccess.admin?
+    if HistoryAccess.admin? || mode == 'summary'
       total = population.scope.except(:select)
           .optimizer_hints('MAX_EXECUTION_TIME(10000)').count
       return @record_counts = { total:, visible: total, denied: 0 }
@@ -254,6 +279,9 @@ class CountsTableQuery
   def output_totals visible_rows
     return @output_totals if @output_totals
 
+    if mode == 'summary'
+      return @output_totals = { output_count: visible_rows, excluded_count: nil }
+    end
     if HistoryAccess.admin?
       return @output_totals = { output_count: visible_rows, excluded_count: 0 }
     end
@@ -405,7 +433,7 @@ class CountsTableQuery
       if index >= axes.rows.length
         values += column_values.map { _1[index - axes.rows.length] }
       end
-      values = values.compact.uniq
+      values = values.compact.uniq - [CountsAxes::MASKED_VALUE]
       labels = case axis['field']
                when 'user'
                  User.where(id: values).pluck(:id, :name).to_h.transform_keys(&:to_s)