{"record":{"id":"abc5f794a885bdc5","repo":"cube-js/cube","slug":"invalid-param-for-security-context","errorCode":null,"errorMessage":"Invalid param for security context","messagePattern":"Invalid param for security context","errorType":"validation","errorClass":"Error","httpStatus":null,"severity":"error","filePath":"packages/cubejs-schema-compiler/src/adapter/MemberSqlTemplateCompiler.js","lineNumber":252,"sourceCode":"    const filterParams = args.map(arg => {\n      if (!arg || typeof arg.__member === 'undefined') {\n        throw new Error('FILTER_GROUP expects FILTER_PARAMS args to be passed.');\n      }\n      return arg.__member;\n    });\n    const index = state.target.filterGroups.length;\n    state.target.filterGroups.push({ filterParams });\n    return placeholder(FILTER_GROUP_PREFIX, index);\n  };\n}\n\n// ---- SECURITY_CONTEXT ------------------------------------------------------\n\nfunction coerceScalarToString(value) {\n  if (typeof value === 'string') return value;\n  if (typeof value === 'number') return `${value}`;\n  if (typeof value === 'boolean') return `${value}`;\n  throw new Error('Invalid param for security context');\n}\n\n// Coercion used by `.filter()` — falsy scalars collapse to \"no value\".\nfunction coerceFilterValue(value) {\n  if (value === undefined || value === null) return { kind: 'none' };\n  if (Array.isArray(value)) {\n    return { kind: 'vec', values: value.map(coerceScalarToString) };\n  }\n  if (typeof value === 'string') {\n    return value === '' ? { kind: 'none' } : { kind: 'string', value };\n  }\n  if (typeof value === 'number') {\n    return value === 0 || Number.isNaN(value) ? { kind: 'none' } : { kind: 'string', value: `${value}` };\n  }\n  if (typeof value === 'boolean') {\n    return value ? { kind: 'string', value: 'true' } : { kind: 'none' };\n  }\n  throw new Error('Invalid param for security context');","sourceCodeStart":234,"sourceCodeEnd":270,"githubUrl":"https://github.com/cube-js/cube/blob/7d981676b36392fec34088b9afab6bdcad40207c/packages/cubejs-schema-compiler/src/adapter/MemberSqlTemplateCompiler.js#L234-L270","documentation":"coerceScalarToString converts security context values (from securityContext claims used in member sql via security_context()) to strings; it only accepts string, number, and boolean. Any other type (null, undefined, object, array) triggers this Error.","triggerScenarios":"A JWT security context claim used in a data model (security_context(key)) resolves to null/undefined because the claim is absent, or is an object/array rather than a scalar.","commonSituations":"Tokens issued without the expected claim; claims encoded as nested objects (e.g. `{ id: 1 }` instead of a scalar user id); multi-tenant setups where some tenants lack the claim.","solutions":["Ensure the JWT includes the claim referenced in security_context() as a scalar string/number/boolean.","Update token issuance to serialize the claim value (e.g. use user_id string instead of nested object).","Provide a fallback default in the schema (e.g. `${FILTER_PARAMS...}` or COALESCE-style default) or validate context in checkAuth/dataSource."],"exampleFix":"// before (token payload)\n{ securityContext: { tenant: { id: 42 } } } // object claim\n// after\n{ securityContext: { tenantId: '42' } }","handlingStrategy":"validation","validationCode":"function ensureScalar(v) {\n  if (!['string', 'number', 'boolean'].includes(typeof v) || v === null) {\n    throw new Error('securityContext claims must be string|number|boolean');\n  }\n}","typeGuard":"function isScalarClaim(v) {\n  return typeof v === 'string' || typeof v === 'number' || typeof v === 'boolean';\n}","tryCatchPattern":"try { await cube.load(q) } catch (e) { if (/Invalid param for security context/.test(e.message)) { /* fix JWT claims or supply default context */ } else throw e; }","preventionTips":["Validate securityContext claims at token issuance","Keep claims scalar; encode nested objects as separate scalar claims","Handle missing claims with defaults before query execution","Log/normalize the securityContext in checkAuth middleware"],"tags":["security-context","jwt","type-mismatch"],"backgroundTag":"invalid-security-context-type","analyzedSha":"7d981676b36392fec34088b9afab6bdcad40207c","analyzedAt":"2026-09-02T03:45:10.400Z","contentChangedAt":null,"schemaVersion":2},"datasetVersion":"2026-09-08T15:18:49.778Z"}