fix(security): bind public dashboard queries to their published shapes

POST /api/public/dashboards/{token}/query took the SQL to run as a
caller-supplied body field and never compared it against the dashboard being
shared. The only check was validateReadOnlySql, which asks whether a
statement reads — not whether this dashboard was published to run it.

The endpoint is permitAll via /public/**, so a link created to publish one
chart granted anonymous, unauthenticated read of every table on that
connection, paginable to completion. Share tokens are 192-bit so this was
never brute-forceable; the exposure is to whoever receives or forwards a link,
which is exactly the population a share link is meant to be safe for.

An exact string match could not be the fix. The agent builds interactive
dashboards whose SQL is interpolated at runtime — SKILL.md states there is no
placeholder convention — so exact matching would break public links while the
author's own view kept working, failing only for the audience.

DashboardQueryShapeService instead matches by shape: the statement with its
literals replaced by placeholders, via the QueryNormalizer that already backs
QueryFingerprintService. A date-range change shares a shape; a different table,
column or predicate does not. Shapes are extracted statically from the stored
artifact, so there is no capture step and no partly-captured set, and a test
pins that the extracted shape equals the shape of the SQL issued at runtime.
Unmatched shapes fail closed and the artifact renders its existing per-widget
error, so one widget degrades alone.

Structure smuggled inside a string literal is refused because the normalizer's
'[^']*' rule does not model SQL's '' escape: the payload splits into a
different number of placeholders, so the shape changes. The imprecision fails
in the safe direction. It remains one layer — the read-only guard,
setReadOnly(true), the row cap and the is_public re-check all still apply.

Also re-checks hasActivePolicy per query. Enabling a share is refused while a
policy is active, but nothing re-checked afterwards, so a link created before
a policy was added stayed live and unprotected — "public-share" has no policy
row, so resolveEffectivePolicy returns none() and column protections and
redaction never ran. Re-checked for the same reason is_public is.

Verified: 13 tests fail to compile before the service exists, pass after, and
5 fail when matches() is stubbed to return true. 50 tests green across the
related suites, mvn compile clean.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

Author: notSumit25

CLAUDE.md

@@ -261,6 +261,30 @@ Dashboards are **generated by the embedded DeepSQL Agent acting as a coding agen
 - **Rendering + data access**: `DashboardArtifact.jsx` renders the HTML in a **sandboxed iframe** (`sandbox="allow-scripts"`, opaque origin + a strict CSP — no external network). The artifact fetches data only through an injected `deepsql.query(sql)` bridge that `postMessage`s to the parent; the parent calls **`POST /api/dashboards/query`** (`DashboardQueryController`), which is **read-only twice over** (`McpSqlGuardService.validateReadOnlySql` + `QueryExecutionContext.api` = `READ_ONLY_ONLY`) and access-scoped via `assertCanReadConnectionContent`. So the agent's code has full creative freedom while every query stays guarded and sandboxed. The bridge also auto-sizes the iframe and forwards runtime errors.
 - Generation endpoints unchanged (`POST /api/dashboards/generate` + `/generate/stream`). `DashboardBuilder.js`/`DashboardInputs.js` remain only because `tabs/Core/PreviewTab.js` still uses them — the dashboard *creation* path no longer touches them.
 - **Sharing**: both share types render a standalone read-only `DashboardViewer` (title + `DashboardArtifact` with an injected `queryFn`). Internal link `/dashboard-view/:id` (auth) uses the authed broker; public link `/share/dashboard/:token` (permitAll) uses `PublicDashboardController` (`GET /api/public/dashboards/{token}` + `/query`), which resolves only while `saved_dashboards.is_public` is true (revoke = flip it) and runs read-only + connection-scoped. `share_token`/`is_public` are set only via `POST|DELETE /api/saved-dashboards/{id}/share` (access-checked), never a general update. `ShareMenu.jsx` drives the UI. The public query path has its own nginx `dashq` limiter.
+- **A public share token is not a licence to run any SQL.** `POST /api/public/dashboards/{token}/query`
+  took the SQL as a body field and never compared it against the dashboard being shared — only
+  `validateReadOnlySql`, which asks whether a statement *reads*, not whether this dashboard was
+  published to run it. A link shared to show one chart therefore granted **anonymous read of every
+  table on the connection** (`SELECT * FROM users`), paginable to completion. Tokens are 192-bit so
+  this was never brute-forceable; the exposure is to whoever receives or forwards a link.
+  `DashboardQueryShapeService` now binds each public query to a **shape** extracted from the
+  dashboard's own stored artifact: the statement with literals replaced by placeholders, via the
+  existing `QueryNormalizer`. Shape-matching rather than exact-matching is load-bearing — the agent
+  builds interactive dashboards whose SQL is interpolated at runtime (`SKILL.md`: "There is no
+  placeholder convention"), so an exact match would break public links while the author's own view
+  kept working. Literals vary freely; tables, columns and predicates do not. Extraction is static,
+  from `dashboard_config`, so there is no capture step and no partly-captured set. **Unmatched
+  shapes fail closed** and the artifact renders its existing per-widget error, so one widget
+  degrades alone. Note the normalizer's `'[^']*'` rule does not model SQL's `''` escape, which is
+  *why* structure smuggled inside a literal is refused: it splits into a different number of
+  placeholders, so the shape changes. The imprecision fails safe — but it is one layer, not the
+  only one, and the read-only guard, `setReadOnly(true)` and the row cap all still apply.
+- **Revoking a chat-access policy has to reach an already-issued share link.** Enabling a public
+  share is refused while the connection has an active policy (`SavedDashboardController:81`), but
+  nothing re-checked afterwards — so a link created *before* a policy was added stayed live and
+  unprotected, because `"public-share"` has no policy row and `resolveEffectivePolicy` returns
+  `none()`, meaning column protections and redaction never ran. `PublicDashboardController` now
+  re-checks `hasActivePolicy` per query, for the same reason it re-checks `is_public`.
 - **Organization** (search/folders/favorites): `SavedDashboardController`'s search/folder/favorite endpoints existed for a while with no UI consumer. `DashboardsHome.jsx` now wires all of it — a search box (client-side filter over name/description), folder chips derived from `GET /connection/{id}/folders` with a per-card "move to folder" popover (`PUT /saved-dashboards/{id}` with `folder: ""` to clear — `updateDashboard` treats `null` as "field omitted" so blank is the explicit clear signal, same convention as `setSharePassword`), and a favorite star toggle (`POST /{id}/favorite`) with optimistic UI update.
 - **Clone**: `POST /saved-dashboards/{id}/clone` (`SavedDashboardService.cloneDashboard`) duplicates a dashboard's config/chat/tags/folder into a fresh row — not shared, not favorited. Exposed as a copy icon on each `DashboardsHome.jsx` card.
 - **Version history**: every real overwrite of `dashboardConfig` (agent build via `completeBuildTurn`, manual Source-tab edit via `updateDashboard`, or a restore) snapshots the *previous* config into `dashboard_versions` (`V113__create_dashboard_versions.sql`) before overwriting, tagged with a trigger (`AGENT_BUILD`/`MANUAL_EDIT`/`RESTORE`) — capped at 50 snapshots per dashboard, oldest pruned first. `GET /{id}/versions` lists them newest-first; `POST /{id}/versions/{versionId}/restore` swaps a snapshot back in as current (itself snapshotting whatever was live, so a restore is undoable too) and **dedupes**: after a restore, the restored row plus any other row with byte-identical `dashboard_config` are deleted, since that content is now "Current," not history — otherwise a restore-edit-restore cycle piles up an alternating chain of duplicate snapshots. `DashboardWorkspace.jsx`'s History panel shows a lightweight diff summary per entry (title/widget-count/size delta computed client-side, not a real line diff — the agent rewrites large chunks even for small logical changes) plus a Preview modal that renders that version's HTML live via `DashboardArtifact`.

backend/src/main/java/com/dbaagent/controller/PublicDashboardController.java

@@ -4,6 +4,8 @@
 import com.dbaagent.model.QueryRequest;
 import com.dbaagent.model.QueryResult;
 import com.dbaagent.model.SavedDashboard;
+import com.dbaagent.service.ConnectionChatAccessPolicyService;
+import com.dbaagent.service.DashboardQueryShapeService;
 import com.dbaagent.service.McpSqlGuardService;
 import com.dbaagent.service.QueryExecutionContext;
 import com.dbaagent.service.QueryExecutorService;
@@ -18,6 +20,7 @@
 
 import java.util.List;
 import java.util.Map;
+import java.util.Set;
 import java.util.Optional;
 
 /**
@@ -43,6 +46,8 @@ public class PublicDashboardController {
     private final SavedDashboardService savedDashboardService;
     private final ObjectMapper objectMapper;
     private final McpSqlGuardService sqlGuardService;
+    private final DashboardQueryShapeService queryShapeService;
+    private final ConnectionChatAccessPolicyService policyService;
     private final QueryExecutorService queryExecutorService;
 
     private Optional<SavedDashboard> publicDashboard(String token) {
@@ -101,6 +106,29 @@ public ResponseEntity<?> query(@PathVariable String token, @RequestBody PublicQu
         if (!guard.ok()) {
             return ResponseEntity.badRequest().body(Map.of("success", false, "error", guard.reason()));
         }
+        // Read-only is not enough on an anonymous path: it asks whether the statement reads,
+        // not whether this dashboard was published to run it. Without the shape check below, a
+        // link shared to show one chart accepted "SELECT * FROM users" just as happily.
+        // A policy added AFTER the link was shared must take effect on it. Enabling a share is
+        // refused while a policy is active (SavedDashboardController), but nothing re-checked
+        // afterwards, so a link created before the policy stayed live and unprotected —
+        // "public-share" has no policy row, so resolveEffectivePolicy returns none() and
+        // column protections and redaction never run. Re-checked here for the same reason
+        // is_public is: revocation has to reach an already-issued link.
+        if (policyService.hasActivePolicy(found.get().getConnectionId())) {
+            log.info("Public dashboard query refused for token {}: connection has an active policy", token);
+            return ResponseEntity.status(HttpStatus.FORBIDDEN).body(Map.of(
+                "success", false,
+                "error", "This dashboard is no longer available publicly."));
+        }
+        Set<String> publishedShapes =
+            queryShapeService.extractShapes(found.get().getDashboardConfig());
+        if (!queryShapeService.matches(publishedShapes, request.sql())) {
+            log.info("Public dashboard query refused for token {}: shape not published", token);
+            return ResponseEntity.badRequest().body(Map.of(
+                "success", false,
+                "error", "This query is not part of the shared dashboard."));
+        }
         int limit = request.limit() == null ? DEFAULT_LIMIT : Math.max(1, Math.min(request.limit(), MAX_LIMIT));
         try {
             QueryRequest qr = new QueryRequest();

backend/src/main/java/com/dbaagent/service/DashboardQueryShapeService.java

@@ -0,0 +1,105 @@
+package com.dbaagent.service;
+
+import com.dbaagent.util.QueryNormalizer;
+import org.springframework.stereotype.Service;
+
+import java.util.LinkedHashSet;
+import java.util.Set;
+import java.util.regex.Matcher;
+import java.util.regex.Pattern;
+
+/**
+ * Binds the queries a public dashboard may run to the ones its artifact actually contains.
+ *
+ * <p>{@code POST /api/public/dashboards/{token}/query} takes the SQL as a request body field.
+ * Checking only that the statement reads is not enough: it answers "is this a select" when the
+ * question is "is this a query this dashboard was published to run". Without that second check
+ * a link shared to show one chart grants anonymous read of the whole connection.
+ *
+ * <p>Exact string matching cannot be the answer. Dashboards are interactive by design — a date
+ * picker re-queries with new bounds on every change ({@code dashboard-design/SKILL.md}), so the
+ * exact string is not knowable at publish time. Matching would then fail only on the public
+ * link while the author's own view kept working, which is the worst shape a regression can take.
+ *
+ * <p>So queries are matched by <em>shape</em>: the statement with its literals replaced by
+ * placeholders, via the same {@link QueryNormalizer} that backs
+ * {@link QueryFingerprintService}. Two queries differing only in a date range share a shape;
+ * two naming different tables or columns do not.
+ *
+ * <p>This is one layer, not the only one. {@code validateReadOnlySql},
+ * {@code connection.setReadOnly(true)}, the row cap and the {@code is_public} re-check all still
+ * apply. That matters because {@code QueryNormalizer} was written for analytics grouping, where
+ * a collision is a cosmetic nuisance rather than a vulnerability.
+ */
+@Service
+public class DashboardQueryShapeService {
+
+    /**
+     * The first argument of a {@code deepsql.query(...)} call, in each quoting style the agent
+     * emits — backtick, double and single. Escaped quotes are consumed so a literal containing
+     * the delimiter does not end the match early.
+     */
+    private static final Pattern QUERY_CALL = Pattern.compile(
+        "deepsql\\s*\\.\\s*query\\s*\\(\\s*"
+            + "(`(?:[^`\\\\]|\\\\.)*`"
+            + "|\"(?:[^\"\\\\]|\\\\.)*\""
+            + "|'(?:[^'\\\\]|\\\\.)*')",
+        Pattern.DOTALL);
+
+    /**
+     * A JS template interpolation. Replaced with a quoted placeholder before normalizing, so the
+     * interpolated value is treated as the literal it becomes at runtime: {@code '${from}'}
+     * already sits inside quotes in the artifact, and a bare {@code ${n}} still has to normalize
+     * to the same placeholder the runtime's numeric literal produces.
+     */
+    private static final Pattern INTERPOLATION = Pattern.compile("\\$\\{[^}]*\\}");
+
+    /** Extracts the shape of every query the artifact can issue. */
+    public Set<String> extractShapes(String artifactHtml) {
+        Set<String> shapes = new LinkedHashSet<>();
+        if (artifactHtml == null || artifactHtml.isBlank()) {
+            return shapes;
+        }
+        Matcher calls = QUERY_CALL.matcher(artifactHtml);
+        while (calls.find()) {
+            String shape = shapeOf(unwrapJsLiteral(calls.group(1)));
+            if (!shape.isBlank()) {
+                shapes.add(shape);
+            }
+        }
+        return shapes;
+    }
+
+    /** The shape of one SQL statement: its literals replaced by placeholders. */
+    public String shapeOf(String sql) {
+        if (sql == null || sql.isBlank()) {
+            return "";
+        }
+        return QueryNormalizer.normalize(sql);
+    }
+
+    /**
+     * Whether {@code sql} matches a published shape. Fails closed: an empty shape set, a blank
+     * statement, or any shape that was not extracted is refused.
+     */
+    public boolean matches(Set<String> publishedShapes, String sql) {
+        if (publishedShapes == null || publishedShapes.isEmpty() || sql == null || sql.isBlank()) {
+            return false;
+        }
+        String shape = shapeOf(sql);
+        return !shape.isBlank() && publishedShapes.contains(shape);
+    }
+
+    /**
+     * Strips the surrounding quotes from a JS string literal and collapses interpolations.
+     *
+     * <p>An interpolation becomes {@code '?'} — a quoted placeholder — so that
+     * {@code BETWEEN '${from}' AND '${to}'} yields the same shape as the runtime statement
+     * {@code BETWEEN '2026-01-01' AND '2026-03-01'}. The surrounding quotes already present in
+     * the artifact are left in place and normalized away with it.
+     */
+    private String unwrapJsLiteral(String literal) {
+        String body = literal.substring(1, literal.length() - 1);
+        return INTERPOLATION.matcher(body).replaceAll("?");
+    }
+}