[knstvk]

Fixes: #5727

Summary

DataManager.loadValues now hides exactly the columns that use an attribute the current user may not read. Before, a column that was not a single attribute path (a literal, a parameter, an expression over several attributes, a subquery or a whole entity) moved the masking to another column: an allowed column came back null, and a denied one came back with its value.

What was done

• QueryParser.QueryPath#getSelectedItemIndex gives the position of the main select-clause item (result column) that contains the path, or -1 when the path is not in one. QueryParserAstBased fills it in.
• LoadValuesAccessContext#getSelectedIndexes uses this position instead of counting selected paths. A column is hidden when a denied attribute appears anywhere in it: alone, inside an expression or inside a subquery. The same denied index is no longer added twice.
• LoadValuesConstraint no longer stops checking the remaining columns at a selected path without a property path (a whole-entity column).
• AI Tools: JpqlExecutionService#resolveHiddenSelectedIndexes (@Secret / @ExcludeFromAi columns) and EnumCaptionResultLocalizer use the same column position. A column gets an enum caption only when its only attribute path is an enum attribute.
• Tests: DataManagerLoadValuesAttributeAccessTest (security-data) for literal, parameter, entity, expression and subquery columns; QueryParserAstBasedTest#testGetQueryPathsSelectedItemIndex; new cases in JpqlExecutionServiceExcludeFromAiColumnTest and EnumCaptionResultLocalizerTest.

Behavior changes (release notes)

• QueryParserAstBased#createQueryPath has a new selectedItemIndex parameter.
• A custom QueryParser that creates QueryPath with the old 4-argument constructor reports no column position, so denied columns of its queries are not hidden. Use the new 5-argument constructor.

Out of scope

• A denied attribute in the select list of a subquery in the where or having clause is still neither hidden nor refused; loadValues does not check denied attributes selected by a subquery in the where or having clause #5987 makes such queries refused, together with the paths of custom parsers that report no column position.

Checklist

• Feature docs consolidated
• Tests: ./gradlew :data:test :security-data:test :aitools:test
• SpotBugs: ./gradlew -PspotbugsEnabled :data:spotbugsMain :security-data:spotbugsMain :aitools:spotbugsMain — no findings
• Code review
• Documentation issue: not needed

🤖 Generated with Claude Code