fix(service-analytics): the field reader is always the security service's; changeset (#20917)

The plugin no longer offers its own option for the field-level reader: it
always bridges AnalyticsServiceConfig.getReadableFields to the security
service, and a host composing its own reader constructs AnalyticsService with
it. The changeset records the narrowing, the new optional service hook, and
the ADR-0087 disposition.

Claude-Session: https://claude.ai/code/session_01XY5uCwTjZj7884yYtyur4H
Co-authored-by: Claude <noreply@anthropic.com>

Author: claude

.changeset/20917-analytics-field-permission-gate.md

@@ -0,0 +1,38 @@
+---
+'@objectstack/service-analytics': minor
+---
+
+fix(service-analytics)!: every analytics face answers the engine's field-level read refusal, whichever strategy serves the cube: a field the caller may not read is judged before either strategy runs (#20917)
+
+Clause-②: yes (narrowing)
+
+<!-- adr-0087: not-required (no-migration-prescription) No authorable key, export or stored shape is removed or renamed. The change refuses analytics queries that read a field the caller's field-level permissions hide, which the engine already refuses on the data API and on the ObjectQL strategy, so there is nothing for `objectstack migrate meta` to rewrite. The one public-surface addition is a new optional service hook. -->
+
+**BREAKING for analytics queries on a SQL deployment that read a field the caller may not read.**
+
+**What changed.** `POST /api/v1/analytics/query`, `POST /api/v1/analytics/sql`
+and `POST /api/v1/analytics/dataset/query` now judge every field a query reads
+against the caller's field-level read permissions before a strategy is chosen:
+dimensions, measures, time dimensions, filter members, order keys, members
+joined through a relationship, and a dataset's own and its requested measures'
+filters. A member of an authored cube is judged by the field it resolves to,
+not by its name in the cube. A field the caller may not read answers
+`403 PERMISSION_DENIED`, in the words the engine uses for the same field. The
+native-SQL strategy, the one a SQL driver serves first, answered such queries;
+the ObjectQL strategy and the data API already refused them.
+
+**What is not affected.** A query that reads only fields the caller may read
+answers as before. A system context, and a caller with no permission sets, are
+unaffected, as on the data API. A host read scope (row-level policy) may still
+name fields the caller cannot read. A deployment with no security service applies
+no field-level check, as on the data API. A member of an authored cube whose `sql`
+is an expression is not attributed to a field.
+
+**New hook.** `AnalyticsServiceConfig.getReadableFields(object, context)` supplies
+the reader. `AnalyticsServicePlugin` wires it to the `security` service's
+`getReadableFields`; a host that constructs `AnalyticsService` itself passes its
+own, and without one no field-level check applies.
+
+**If a widget stopped answering for some users,** it reads a field those users
+may not read. Grant that field's read permission to the users who need it, or
+build the widget on fields they can read.

packages/services/service-analytics/src/plugin.ts

@@ -217,15 +217,6 @@ export interface AnalyticsServicePluginOptions {
     objectName: string,
     context?: ExecutionContext,
   ) => boolean | Promise<boolean>;
-  /**
-   * [#20917] The FIELD-LEVEL read admission — which fields of an object the
-   * caller may read. The service judges every member a query names against it
-   * before a strategy is selected (`AnalyticsServiceConfig.getReadableFields`).
-   * When omitted, the plugin auto-bridges to a registered `'security'`
-   * service's `getReadableFields(object, context)` — the reader computed from
-   * the same resolution the engine middleware enforces field permissions with.
-   */
-  getReadableFields?: AnalyticsServiceConfig['getReadableFields'];
   /**
    * ADR-0021 D-C — join allowlist per cube (the dataset's declared `include`).
    * Typically wired from the dataset registry's compiled `allowedRelationships`.
@@ -769,9 +760,12 @@ export class AnalyticsServicePlugin implements Plugin {
       autoBridgedReadAdmission = true;
     }
 
-    // [#20917] The FIELD-LEVEL half of the same read, bridged the same way and
+    // [#20917] The FIELD-LEVEL half of the same read
+    // (`AnalyticsServiceConfig.getReadableFields`), bridged the same way and
     // for the same reasons as the two halves above: resolution at CALL time,
-    // and the three resolutions kept apart.
+    // and the three resolutions kept apart. There is no plugin option for it:
+    // the reader is the security service's, and a host that composes its own
+    // reader constructs `AnalyticsService` with it.
     //
     //   ABSENT   — no security service: no field-level security anywhere on
     //              this deployment, `/data` included. The provider answers
@@ -786,27 +780,24 @@ export class AnalyticsServicePlugin implements Plugin {
     interface SecurityReadableFields {
       getReadableFields?(object: string, context?: ExecutionContext): Promise<string[] | undefined>;
     }
-    let getReadableFields = this.options.getReadableFields;
-    if (!getReadableFields) {
-      getReadableFields = async (object, context) => {
-        let svc: SecurityReadableFields | undefined;
-        try {
-          svc = ctx.getService<SecurityReadableFields>('security');
-        } catch (e) {
-          throw new Error(
-            `resolving the "security" service threw (${String((e as Error)?.message ?? e)})`,
-          );
-        }
-        if (!svc) return undefined;
-        if (typeof svc.getReadableFields !== 'function') {
-          throw new Error(
-            'the registered "security" service exposes no getReadableFields(), so it cannot answer ' +
-            'which fields the caller may read',
-          );
-        }
-        return svc.getReadableFields(object, context);
-      };
-    }
+    const getReadableFields: AnalyticsServiceConfig['getReadableFields'] = async (object, context) => {
+      let svc: SecurityReadableFields | undefined;
+      try {
+        svc = ctx.getService<SecurityReadableFields>('security');
+      } catch (e) {
+        throw new Error(
+          `resolving the "security" service threw (${String((e as Error)?.message ?? e)})`,
+        );
+      }
+      if (!svc) return undefined;
+      if (typeof svc.getReadableFields !== 'function') {
+        throw new Error(
+          'the registered "security" service exposes no getReadableFields(), so it cannot answer ' +
+          'which fields the caller may read',
+        );
+      }
+      return svc.getReadableFields(object, context);
+    };
 
     // ADR-0021 — relationship → target-object resolver. A dataset's `include`
     // names lookup/master_detail FIELDS on the base object; the joined TABLE is