fix(security): fail closed when a protected table sits where inspection cannot see

The first commit fixed schema scoping completely but left column protection a
partial walk, and the PR text claimed otherwise. collectPlainSelects descends
into CTE bodies, set-operation branches and parenthesised selects, but never
into a select nested inside a PlainSelect's own FROM/JOIN/WHERE/HAVING. Two
payloads still reached a protected column:

    SELECT t.email FROM (SELECT email FROM customer_profiles) t
    SELECT id FROM orders WHERE id IN (SELECT email FROM customer_profiles)

Both were allowed. Same category error the first commit set out to remove: an
allowlist enforced by a walk is only as complete as the walk.

Rather than attempt an exhaustive traversal of arbitrary expression trees --
getting that wrong is what caused this in the first place -- the two views are
compared. TablesNamesFinder enumerates every table in the statement and is
exhaustive by construction; collectDirectTables reports what the column
inspection actually examined. When a protected table appears in the first set
and not the second, the query is refused.

That inverts the failure direction. A syntax form nobody enumerated now costs a
conservative block instead of a silent permit, and any future parser feature
inherits the safe default without anyone remembering to handle it.

The tradeoff is deliberate: some safe nested aggregates over a protected table
are now blocked. Refusing costs a rejected query; allowing costs the data.

Verified: 15/15 in UserDataAccessPolicyServiceTest (2 new, both watched failing
first). Regression baseline on the same suite selection is unchanged --
8 failures / 16 errors before and after, all pre-existing, with the 2 added
tests passing.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

Author: geekypunk

backend/src/main/java/com/dbaagent/service/UserDataAccessPolicyService.java

@@ -127,6 +127,7 @@ public QueryGuardDecision enforcePreExecution(
                 // how a subquery, UNION branch, or CTE body reached a schema
                 // outside the caller's scope.
                 enforceAllowedSchemas(parsed, policy.allowedSchemas());
+                assertProtectedTablesAreInspectable(parsed, collectPlainSelects(select), protectedObjects);
                 // Likewise inspect every branch. Gating this on getPlainSelect()
                 // != null skipped protection entirely for a SetOperationList,
                 // because a UNION's body is not a PlainSelect.
@@ -337,6 +338,78 @@ private boolean mentionsProtectedTables(String normalized, ConnectionChatAccessP
         return policy.impactedTables().stream().anyMatch(table -> normalized.contains(table.toLowerCase(Locale.ROOT)));
     }
 
+    /**
+     * Fails closed on statement shapes inspection cannot reach.
+     *
+     * TablesNamesFinder sees every table in the statement; collectPlainSelects
+     * deliberately does not descend into a select nested inside FROM/JOIN/WHERE/
+     * HAVING, because enumerating arbitrary expression trees correctly is the very
+     * thing that went wrong here the first time. So instead of trying harder to
+     * walk, compare the two: when a protected table is referenced somewhere the
+     * column inspection could not examine, refuse the query.
+     *
+     * A syntax form we failed to enumerate must never become an implicit permit --
+     * that is exactly how a subquery, a UNION branch and a CTE body each evaded
+     * the schema allowlist. Refusing costs a conservative block on some safe
+     * nested aggregates; allowing costs the data.
+     */
+    private void assertProtectedTablesAreInspectable(
+        Statement statement,
+        List<PlainSelect> inspectedBranches,
+        Map<String, ConnectionChatAccessPolicyService.ProtectionDescriptor> protectedObjects
+    ) {
+        if (protectedObjects == null || protectedObjects.isEmpty()) {
+            return;
+        }
+        Set<String> referenced = new LinkedHashSet<>();
+        for (String name : new TablesNamesFinder<>().getTables(statement)) {
+            addNameForms(name, referenced);
+        }
+        Set<String> inspected = new LinkedHashSet<>();
+        for (PlainSelect branch : inspectedBranches) {
+            collectDirectTables(branch, inspected);
+        }
+        for (ConnectionChatAccessPolicyService.ProtectionDescriptor descriptor : protectedObjects.values()) {
+            Set<String> forms = new LinkedHashSet<>();
+            addNameForms(descriptor.qualifiedTableName(), forms);
+            boolean isReferenced = forms.stream().anyMatch(referenced::contains);
+            boolean wasInspected = forms.stream().anyMatch(inspected::contains);
+            if (isReferenced && !wasInspected) {
+                throw new UserDataAccessPolicyException(
+                    "This query reaches restricted data through a nested query DeepSQL cannot fully verify, so it was blocked before execution.",
+                    "POLICY_SQL_BLOCKED"
+                );
+            }
+        }
+    }
+
+    /** Adds both the qualified name and its bare table part, so schema.t matches t. */
+    private void addNameForms(String name, Set<String> out) {
+        if (name == null || name.isBlank()) {
+            return;
+        }
+        String normalized = normalizeName(name);
+        out.add(normalized);
+        int dot = normalized.lastIndexOf('.');
+        if (dot > 0 && dot < normalized.length() - 1) {
+            out.add(normalized.substring(dot + 1));
+        }
+    }
+
+    /** Tables named directly in this branch's FROM/JOIN -- what inspection actually saw. */
+    private void collectDirectTables(PlainSelect select, Set<String> out) {
+        if (select.getFromItem() instanceof Table table) {
+            addNameForms(table.getFullyQualifiedName(), out);
+        }
+        if (select.getJoins() != null) {
+            for (Join join : select.getJoins()) {
+                if (join.getRightItem() instanceof Table table) {
+                    addNameForms(table.getFullyQualifiedName(), out);
+                }
+            }
+        }
+    }
+
     /**
      * Collects every PlainSelect in a statement: the top level, each branch of a
      * set operation (UNION/INTERSECT/EXCEPT), parenthesised selects, and every

backend/src/test/java/com/dbaagent/service/UserDataAccessPolicyServiceTest.java

@@ -166,6 +166,41 @@ private UserDataAccessPolicyException assertSchemaScopeBlocks(String sql) {
     // reached through any other syntax position was never enumerated and the
     // allowlist silently permitted it.
 
+    // Column inspection cannot reach a select nested inside FROM/JOIN/WHERE, so a
+    // protected table referenced there must be refused rather than implicitly allowed.
+
+    @Test
+    void enforcePreExecution_blocksProtectedTableInsideDerivedTable() {
+        when(policyService.resolveEffectivePolicy("conn-1", "analyst", false)).thenReturn(policy());
+
+        UserDataAccessPolicyException exception = assertThrows(
+            UserDataAccessPolicyException.class,
+            () -> service.enforcePreExecution(
+                "conn-1",
+                new QueryRequest("SELECT t.email FROM (SELECT email FROM customer_profiles) t", null, null),
+                new QueryExecutionContext(QueryExecutionOrigin.CHAT, QueryExecutionContext.MutationMode.READ_ONLY_ONLY, "analyst", false, false)
+            )
+        );
+
+        assertThat(exception.getErrorCode()).isEqualTo("POLICY_SQL_BLOCKED");
+    }
+
+    @Test
+    void enforcePreExecution_blocksProtectedTableInsideWhereSubquery() {
+        when(policyService.resolveEffectivePolicy("conn-1", "analyst", false)).thenReturn(policy());
+
+        UserDataAccessPolicyException exception = assertThrows(
+            UserDataAccessPolicyException.class,
+            () -> service.enforcePreExecution(
+                "conn-1",
+                new QueryRequest("SELECT id FROM orders WHERE id IN (SELECT email FROM customer_profiles)", null, null),
+                new QueryExecutionContext(QueryExecutionOrigin.CHAT, QueryExecutionContext.MutationMode.READ_ONLY_ONLY, "analyst", false, false)
+            )
+        );
+
+        assertThat(exception.getErrorCode()).isEqualTo("POLICY_SQL_BLOCKED");
+    }
+
     @Test
     void enforcePreExecution_blocksForbiddenSchemaInsideWhereSubquery() {
         assertThat(assertSchemaScopeBlocks(