fix(api): restrict public sharing to unfiltered overview queries

[maskjelly]

Description

Public sharing exposed query types beyond the documented overview, including custom-event properties and error diagnostics. This limits anonymous access to unfiltered overview queries and keeps the public dashboard usable under that policy.

Slice

• Issue: Closes fix(api): restrict public sharing to the documented aggregate overview #1114
• Security report: GHSA-63mv-3x64-72w2
• Type / area: bug · analytics / API and public dashboard
• Suggested labels: bug, analytics (author cannot apply upstream labels)
• Base: staging
• Dependencies or overlapping PRs: None; fix(db): erase revenue records with deleted analytics owners #1116 and fix(dashboard): enforce image proxy limits while streaming #1118 fix separate audit findings.

Changes

• Publicly allow only the overview query types. Other builders require website permission.
• Require website permission for any filter, including trait, identifier, and dimension filters. Apply the check to full batches and /v1/query/compile before query execution.
• Keep the public dashboard unfiltered and remove row-click filter actions there, so visitors do not trigger rejected queries. Member dashboards keep those actions.
• Correct the trait-filter test fixture to use the production trait: prefix and document the privacy limits of public aggregates.

Compatibility and privacy

Anonymous private or filtered requests now return 401; authenticated outsiders return 403. Public date ranges and fixed overview breakdowns remain available. Public aggregates can still describe small groups or contain application-provided labels; enabling sharing is an owner decision and does not guarantee statistical anonymity.

Validation

• bun run lint: passed.
• bun run check-types: 37/37 tasks passed.
• bunx --bun vitest run src/routes/query-public-access.test.ts: 21 passed.
• The public dashboard fix was type checked; browser interaction was not run in this follow-up.

Merge notes

This is an independent change based on current staging. Maintainer review and CI are still required.

Before merge

• Maintainer applies the suggested labels and reviews the change.
• Run the fork CI workflow (currently action_required with zero jobs).
• Resolve the Vercel authorization check failures shown on the PR.

AI disclosure: implemented and tested with Codex. Source and local test results were reviewed during implementation; maintainer human review is required.

[vercel]

@maskjelly is attempting to deploy a commit to the Databuddy OSS Team on Vercel.

A member of the Team first needs to authorize it.

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on this repository. Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

• Configuration used: Repository UI
• Review profile: ASSERTIVE
• Plan: Advanced
• Run ID: e109565f-da70-4ece-881e-d344981be6c1

---

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

---

_{Comment @coderabbitai help to get the list of available commands.}

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

1 Skipped Deployment

Project	Deployment	Actions	Updated
dashboard	Skipped		Oct 9, 2026 10:50pm UTC

[greptile-apps]

Confidence Score: 4/5

[Critical impact] Restricts public API access to unfiltered overview queries only.

The access changes appear sound, but the new test must satisfy the repository's explicit type and async-function requirements before merging.

Findings

1.  Test helpers lack explicit types ▶
2.  Tests use wrong trait prefix ▶
3.  Async mocks omit required await ▶

Summary

This PR limits public website queries to an unfiltered overview.

• Public website queries now stop at the unfiltered overview.

No runtime tests were run during this review.

Acknowledged limits: maskjelly explicitly describes denial of filtered public dashboard requests as intentional. maskjelly also acknowledges that small-group counts and application-provided labels remain public; this PR does not introduce that limit.

Diagram

%%{init: {'theme': 'neutral'}}%%
flowchart TD
  A[Execute or compile request] --> B[Check all query types and filters]
  B --> C{Public website and unfiltered overview?}
  C -->|Yes| D[Allow public access]
  C -->|No| E{Website permission?}
  E -->|Member or matching API key| F[Allow private access]
  E -->|No| G[Reject with 401 or 403]
  D --> H[Compile or execute]
  F --> H

Loading

_{Reviews (1) · Last reviewed commit: "fix(api): restrict public sharing to unf..." · Reviewed by Greptile}