fix(service-analytics): the queryable fallback reads no caller property, so it refuses masked-rule fields for every caller

The fallback for a security service that cannot answer getQueryableFields
exempted a system context by reading its system bit, a new elevation read
site. It cannot say for whom a masking rule is lifted, so it now refuses
every caller alike; the contract text and both changesets say so.

Claude-Session: https://claude.ai/code/session_01Sfe5YjBLwB9J3y8fvm2xq1
Co-authored-by: Claude <noreply@anthropic.com>

Author: claude

.changeset/20935-analytics-masked-field-not-queryable.md

@@ -28,7 +28,7 @@ unaffected. A query that names no masked field answers as before.
 supplies the answer. `AnalyticsServicePlugin` wires it to the `security`
 service's `getQueryableFields`. When that service predates the method, or
 answers "no answer", the plugin treats every field that declares a
-`maskingRule` as not queryable, for every caller but a system one. A host that
+`maskingRule` as not queryable, for every caller. A host that
 constructs `AnalyticsService` itself with `getReadableFields` and without
 `getQueryableFields` is warned once at construction.
 

.changeset/20935-security-service-queryable-fields.md

@@ -8,4 +8,4 @@ Clause-②: yes (widening)
 
 - It is the exact complement of the fields the engine's field guards refuse when a query names them as a filter, a sort key, a group key or an aggregate input. It is a subset of `getReadableFields`, and the two differ by exactly the fields the caller is served masked: a field whose `maskingRule` applies to the caller is readable (served, its value replaced) and not queryable.
 - It fails soft like `getReadableFields`: `undefined` means no answer, `[]` means no field is queryable. A system context gets every field.
-- It is optional. A consumer checks `typeof svc.getQueryableFields === 'function'`. When the method is missing, or answers `undefined`, the consumer must treat every field that declares a `maskingRule` as not queryable (a system context excepted). Falling back to `getReadableFields` alone would admit exactly the masked fields.
+- It is optional. A consumer checks `typeof svc.getQueryableFields === 'function'`. When the method is missing, or answers `undefined`, the consumer must treat every field that declares a `maskingRule` as not queryable, whoever the caller is. Falling back to `getReadableFields` alone would admit exactly the masked fields.

packages/services/service-analytics/src/__tests__/field-query-admission-gate.test.ts

@@ -281,9 +281,10 @@ describe('[#20935] analytics plugin — the query-side half of the "security" br
     // A field that declares no rule is judged by the read projection alone, as before.
     await service.query(groupedPlain as never, CALLER);
     expect(reads).toHaveLength(1);
-    // The contract's system bypass holds on the fallback too.
-    await service.query(groupedMasked as never, SYSTEM);
-    expect(reads).toHaveLength(2);
+    // The fallback reads no caller property — it cannot say for whom a rule is
+    // lifted — so it refuses every caller, a system one included.
+    await expect(service.query(groupedMasked as never, SYSTEM)).rejects.toMatchObject({ code: 'PERMISSION_DENIED', status: 403, fields: ['masked_code'] });
+    expect(reads).toHaveLength(1);
   });
 
   it('fails CLOSED the same way when getQueryableFields answers "no answer" (undefined)', async () => {

packages/services/service-analytics/src/analytics-service.ts

@@ -731,7 +731,8 @@ export interface AnalyticsServiceConfig {
    * The plugin auto-bridges this to the `security` service's
    * `getQueryableFields`, and when that service predates the method, or
    * answers `undefined`, it fails CLOSED: every field that declares a
-   * `maskingRule` is treated as not queryable. MAY be async; a THROW refuses
+   * `maskingRule` is treated as not queryable, whoever the caller is. MAY be
+   * async; a THROW refuses
    * the query. A host that wires {@link getReadableFields} and not this judges
    * masked fields by the read projection alone, which admits them — the
    * service says so once, at construction.

packages/services/service-analytics/src/plugin.ts

@@ -814,11 +814,12 @@ export class AnalyticsServicePlugin implements Plugin {
     // `undefined`. The fallback is NOT the read projection alone, which counts a
     // masked field readable and would admit exactly the queries this half
     // exists to refuse. It fails CLOSED: the read projection less every field
-    // whose declaration carries a `maskingRule`, for every caller but a system
-    // one (the contract's own bypass). That over-refuses a caller the rule is
-    // lifted for, which is the safe direction and the only one available: an
-    // older reader cannot say for whom a rule is lifted, and deciding that here
-    // would be a second copy of the masking rule.
+    // whose declaration carries a `maskingRule`, whoever the caller is. That
+    // over-refuses a caller the rule is lifted for — a system one included —
+    // which is the safe direction and the only one available: an older reader
+    // cannot say for whom a rule is lifted, and deciding that here (reading the
+    // caller's capabilities, or its system bit) would be a second copy of the
+    // masking rule.
     interface SecurityQueryableFields extends SecurityReadableFields {
       getQueryableFields?(object: string, context?: ExecutionContext): Promise<string[] | undefined>;
     }
@@ -858,7 +859,6 @@ export class AnalyticsServicePlugin implements Plugin {
       }
       const readable = await svc.getReadableFields(object, context);
       if (readable === undefined) return undefined;
-      if ((context as { isSystem?: unknown } | undefined)?.isSystem === true) return readable;
       const masked = maskingRuleFields(object);
       return readable.filter((f) => !masked.has(f));
     };

packages/spec/src/contracts/security-service.ts

@@ -379,9 +379,8 @@ export interface ISecurityService {
    * (`typeof svc.getQueryableFields === 'function'`). ⛔ A consumer that cannot
    * get this answer — the method is absent, or it answered `undefined` — must
    * treat every field that declares a `maskingRule` as NOT queryable, whoever
-   * the caller is (only a system context is exempt): the older reader cannot
-   * say for whom a rule is lifted, and the read projection reports a masked
-   * field as readable. Falling back to the read projection alone fails OPEN on
+   * the caller is: the older reader cannot say for whom a rule is lifted, and
+   * the read projection reports a masked field as readable. Falling back to the read projection alone fails OPEN on
    * precisely the fields this method exists for. Declaring it optional keeps
    * that degradation a property of the type: the unguarded call does not
    * compile, so a consumer cannot skip its fallback by accident.