fix(table): storage-validate read-path predicates on GET rows and find

Bugbot round 4: the native predicate path on GET /rows ran only the shape
check before wire translation, and find ran none before its toLegacyFilter
downgrade — so a typo'd field compiled to a clause matching nothing and read
back as a plausible empty page, where the bulk write paths 400. GET now runs
validateStoragePredicate post-translation (name-keyed JWT callers validate
their translated form, same recipe as resolveBulkFilter); find reuses the
grammar-aware tableFilterError gate.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_011M563cbFy2S74GvSDf2C3R

Author: TheodoreSpeaks

apps/sim/app/api/table/[tableId]/rows/find/route.test.ts

@@ -6,14 +6,16 @@ import { NextRequest } from 'next/server'
 import { beforeEach, describe, expect, it, vi } from 'vitest'
 import type { TableDefinition } from '@/lib/table'
 
-const { mockCheckAccess, mockFindRowMatches } = vi.hoisted(() => ({
+const { mockCheckAccess, mockFindRowMatches, mockTableFilterError } = vi.hoisted(() => ({
   mockCheckAccess: vi.fn(),
   mockFindRowMatches: vi.fn(),
+  mockTableFilterError: vi.fn(),
 }))
 
 vi.mock('@/app/api/table/utils', async () => {
   const { NextResponse } = await import('next/server')
   return {
+    tableFilterError: mockTableFilterError,
     checkAccess: mockCheckAccess,
     accessError: (result: { status: number }) =>
       NextResponse.json(
@@ -67,6 +69,7 @@ describe('GET /api/table/[tableId]/rows/find', () => {
       authType: 'session',
     })
     mockCheckAccess.mockResolvedValue({ ok: true, table: buildTable() })
+    mockTableFilterError.mockReturnValue(null)
     mockFindRowMatches.mockResolvedValue({
       matches: [{ ordinal: 4, rowId: 'row_4', column: 'name' }],
       truncated: false,
@@ -120,6 +123,21 @@ describe('GET /api/table/[tableId]/rows/find', () => {
     )
   })
 
+  it('short-circuits with the filter gate response before searching', async () => {
+    const { NextResponse } = await import('next/server')
+    mockTableFilterError.mockReturnValueOnce(
+      NextResponse.json({ error: 'Unknown filter column "nope"' }, { status: 400 })
+    )
+    const res = await callGet({
+      workspaceId: 'workspace-1',
+      q: 'foo',
+      filter: JSON.stringify({ all: [{ field: 'nope', op: 'eq', value: 1 }] }),
+    })
+    expect(res.status).toBe(400)
+    expect((await res.json()).error).toMatch(/Unknown filter column/)
+    expect(mockFindRowMatches).not.toHaveBeenCalled()
+  })
+
   it('maps a TableQueryValidationError to 400', async () => {
     const { TableQueryValidationError } = await import('@/lib/table/errors')
     mockFindRowMatches.mockRejectedValueOnce(new TableQueryValidationError('Invalid field name'))

apps/sim/app/api/table/[tableId]/rows/find/route.ts

@@ -9,7 +9,7 @@ import type { Filter, Sort, SortSpec, TablePredicate } from '@/lib/table'
 import { TableQueryValidationError } from '@/lib/table/errors'
 import { toLegacyFilter, toLegacySort } from '@/lib/table/query-builder/converters'
 import { findRowMatches } from '@/lib/table/rows/service'
-import { accessError, checkAccess } from '@/app/api/table/utils'
+import { accessError, checkAccess, tableFilterError } from '@/app/api/table/utils'
 
 const logger = createLogger('TableRowsFindAPI')
 
@@ -59,6 +59,15 @@ export const GET = withRouteHandler(
         return NextResponse.json({ error: 'Invalid workspace ID' }, { status: 400 })
       }
 
+      // Same gate as the bulk/async routes: the predicate branch rejects unknown
+      // storage keys (a typo'd field must 400, not return zero matches), the
+      // legacy branch keeps its compile check.
+      const filterError = tableFilterError(
+        validated.filter as Filter | TablePredicate | undefined,
+        table.schema.columns
+      )
+      if (filterError) return filterError
+
       const { matches, truncated } = await findRowMatches(
         table,
         {

apps/sim/app/api/table/[tableId]/rows/route.test.ts

@@ -262,6 +262,25 @@ describe('GET /api/table/[tableId]/rows', () => {
     expect(options.predicate).toEqual({ all: [{ field: 'col_aaa', op: 'eq', value: 'Ada' }] })
     expect(options.sort).toEqual({ col_bbb: 'asc' })
   })
+
+  /**
+   * Storage validation runs post-translation, mirroring bulk PUT/DELETE: a
+   * typo'd field must 400, not compile to a clause that matches nothing and
+   * read back as a plausible empty page.
+   */
+  it('400s a predicate naming an unknown column instead of returning an empty page', async () => {
+    authAs('session')
+
+    const res = await callGet({
+      workspaceId: 'workspace-1',
+      filter: JSON.stringify({ all: [{ field: 'col_nope', op: 'eq', value: 'Ada' }] }),
+    })
+
+    expect(res.status).toBe(400)
+    const body = await res.json()
+    expect(body.error).toMatch(/Unknown filter column "col_nope"/)
+    expect(mockQueryRows).not.toHaveBeenCalled()
+  })
 })
 
 describe('PUT/DELETE /api/table/[tableId]/rows — predicate filters', () => {

apps/sim/app/api/table/[tableId]/rows/route.ts

@@ -308,7 +308,12 @@ export const GET = withRouteHandler(
                   // Shape-check first: nothing upstream validates this branch, and
                   // an unchecked hybrid node would silently widen the result.
                   validatePredicateShape(validated.filter as TablePredicate)
-                  return wire.predicateIn(validated.filter as TablePredicate)
+                  const translated = wire.predicateIn(validated.filter as TablePredicate)
+                  // Post-translation storage check, mirroring the bulk PUT/DELETE
+                  // paths: a typo'd field must 400, not compile to a clause that
+                  // matches nothing and read back as an empty page.
+                  validateStoragePredicate(translated, (table.schema as TableSchema).columns)
+                  return translated
                 })(),
               }
             : { filter: validated.filter ? wire.filterIn(validated.filter as Filter) : undefined }),