[Scra3]

fixes PRD-1759

Every route that builds its filter from a live query segment checks that the user may run that segment, on the collection whose filter carries it.

What changes

1. The segment checked is the one the filter uses, whether it comes from the query string or the request body.
2. Listing, counting and exporting records, related ones included, check the segment of the collection they list.
3. Deleting records and associating or dissociating related records check the segment of the collection they change.
4. Running an action, loading or changing its form, and approving it check the segment of the selection, for the approver too on an approval. A selection of explicit ids leaves its segment out: it is neither checked nor run, as in forest-express and forest-rails.
5. A chart checks the segment of the collection it charts, and a count leaderboard no longer checks it against the related collection.

Users allowed to run a segment keep every feature on it: each path above has a test for the allowed user next to the one for the refused user.

Decisions

• PRD-1759: 2 functional · 1 unticked

Squash message

fix(agent): check the segment query permission wherever a live query segment is used

Each route that builds its filter from a live query segment checks that the user may run that
segment, on the collection whose filter carries it, whether the segment comes from the query
string or the request body: listing, counting and exporting records, deleting them, associating
and dissociating related records, running an action, its form hooks and its approval, and charts.
Users allowed to run a segment keep every feature on it.

Definition of Done

General

• Write an explicit title for the Pull Request, following Conventional Commits specification
• Test manually the implemented changes
• Validate the code quality (indentation, syntax, style, simplicity, readability)

Security

• Consider the security impact of the changes made

🤖 Generated with Claude Code

Note

Check live-query segment permission on every route that uses one

Adds AuthorizationService.assertCanExecuteLiveQuerySegment, which parses the live-query segment from the request and throws Forbidden when the user may not execute it for the collection. Removes the implicit segment check from assertCanOnCollection, and every read and modification route now calls the explicit assertion before building filters or running queries.

• ActionRoute.getRecordSelection skips the segment check and filter when a non-global action has a positive explicit ID selection.
• Adds tests covering denied and allowed segments for listing, counting, CSV, charts, actions, deletes, associations, and dissociation, including the explicit-selection bypass.

^{Macroscope summarized 409bce0.}

[linear-code]

PRD-1759

[qltysh]

Coverage Impact

This PR will not change total coverage.

Modified Files with Diff Coverage (12)

Rating	File	% Diff	Uncovered Line #s
	packages/agent/src/routes/modification/associate-related.ts	100.0%
	...ges/agent/src/routes/modification/dissociate-delete-related.ts	100.0%
	packages/agent/src/routes/access/count-related.ts	100.0%
	packages/agent/src/services/authorization/authorization.ts	100.0%
	packages/agent/src/routes/access/list-related.ts	100.0%
	packages/agent/src/routes/modification/action/action.ts	100.0%
	packages/agent/src/routes/modification/delete.ts	100.0%
	packages/agent/src/routes/access/csv.ts	100.0%
	packages/agent/src/routes/access/chart.ts	100.0%
	packages/agent/src/routes/access/csv-related.ts	100.0%
	packages/agent/src/routes/access/count.ts	100.0%
	packages/agent/src/routes/access/list.ts	100.0%
	Total	100.0%

🚦 See full report on Qlty Cloud »

🛟 Help

• Diff Coverage: Coverage for added or modified lines of code (excludes deleted files). Learn more.

• Total Coverage: Coverage for the whole repository, calculated as the sum of all File Coverage. Learn more.

• File Coverage: Covered Lines divided by Covered Lines plus Missed Lines. (Excludes non-executable lines including blank lines and comments.)

  • Indirect Changes: Changes to File Coverage for files that were not modified in this PR. Learn more.

[Scra3]

Spec (PRD-1759): conforms to the ticket's fix. 1 unvalidated decision: not final.

[qltysh]

1 new issue

Tool	Category	Rule	Count
qlty	Structure	Function with high complexity (count = 12): getRecordSelection	1