test: add joined cube reference in mask SQL test cases

Add sc_joined_mask_test cube with a mask.sql that references orders.id
from a joined cube (orders). The mask replaces the order_id dimension
with the joined orders.id — since the join condition equates them, the
masked and unmasked values should match, verifying the join is correctly
resolved when triggered by mask SQL.

Tests added for SQL API and REST API, both non-Tesseract and Tesseract.

Co-authored-by: Pavel Tiunov <pavel.tiunov@gmail.com>

Author: cursoragent

packages/cubejs-testing/birdbox-fixtures/rbac/model/cubes/security_context_test.js

@@ -144,6 +144,54 @@ cube('sc_cube_mask_test', {
   ],
 });
 
+cube('sc_joined_mask_test', {
+  sql_table: 'public.line_items',
+
+  joins: {
+    orders: {
+      relationship: 'many_to_one',
+      sql: `${orders}.id = ${sc_joined_mask_test}.order_id`,
+    },
+  },
+
+  dimensions: {
+    id: {
+      sql: 'id',
+      type: 'number',
+      primary_key: true,
+    },
+    order_id: {
+      sql: `${CUBE}.order_id`,
+      type: 'number',
+    },
+    masked_order_id: {
+      sql: `${CUBE}.order_id`,
+      type: 'number',
+      mask: {
+        sql: `${orders.id}`,
+      },
+    },
+  },
+
+  measures: {
+    count: {
+      type: 'count',
+    },
+  },
+
+  accessPolicy: [
+    {
+      role: '*',
+      memberLevel: {
+        includes: [],
+      },
+      memberMasking: {
+        includes: '*',
+      },
+    },
+  ],
+});
+
 cube('sc_groups_shorthand_test', {
   sql_table: 'public.line_items',
 

packages/cubejs-testing/test/smoke-rbac.test.ts

@@ -855,6 +855,18 @@ describe('Cube RBAC Engine', () => {
         expect(row.masked_status).toBeGreaterThan(0);
       }
     });
+
+    test('joined cube reference in mask sql', async () => {
+      const res = await connection.query(
+        'SELECT * FROM sc_joined_mask_test LIMIT 5'
+      );
+      expect(res.rows.length).toBeGreaterThan(0);
+      for (const row of res.rows) {
+        // mask.sql is ${orders.id} which joins orders and returns orders.id
+        // Since line_items.order_id = orders.id (join condition), the values should match
+        expect(row.masked_order_id).toBe(row.order_id);
+      }
+    });
   });
 
   describe('SECURITY_CONTEXT.cubeCloud features via REST API', () => {
@@ -958,6 +970,20 @@ describe('Cube RBAC Engine', () => {
         expect(row['yaml_ua_mask_test.masked_status']).toBeGreaterThan(0);
       }
     });
+
+    test('joined cube reference in mask sql via REST', async () => {
+      const result = await scClient.load({
+        measures: ['sc_joined_mask_test.count'],
+        dimensions: ['sc_joined_mask_test.order_id', 'sc_joined_mask_test.masked_order_id'],
+      });
+      const rows = result.rawData();
+      expect(rows.length).toBeGreaterThan(0);
+      for (const row of rows) {
+        expect(row['sc_joined_mask_test.masked_order_id']).toBe(
+          row['sc_joined_mask_test.order_id']
+        );
+      }
+    });
   });
 
   describe('RBAC via REST API', () => {
@@ -1132,6 +1158,16 @@ describe('Cube RBAC Engine [Tesseract]', () => {
         expect(row.masked_status).toBeGreaterThan(0);
       }
     });
+
+    test('joined cube reference in mask sql', async () => {
+      const res = await connection.query(
+        'SELECT * FROM sc_joined_mask_test LIMIT 5'
+      );
+      expect(res.rows.length).toBeGreaterThan(0);
+      for (const row of res.rows) {
+        expect(row.masked_order_id).toBe(row.order_id);
+      }
+    });
   });
 
   describe('Shorthand and mask tests via REST API [Tesseract]', () => {
@@ -1195,6 +1231,20 @@ describe('Cube RBAC Engine [Tesseract]', () => {
         expect(row['yaml_ua_mask_test.masked_status']).toBeGreaterThan(0);
       }
     });
+
+    test('joined cube reference in mask sql via REST', async () => {
+      const result = await scClient.load({
+        measures: ['sc_joined_mask_test.count'],
+        dimensions: ['sc_joined_mask_test.order_id', 'sc_joined_mask_test.masked_order_id'],
+      });
+      const rows = result.rawData();
+      expect(rows.length).toBeGreaterThan(0);
+      for (const row of rows) {
+        expect(row['sc_joined_mask_test.masked_order_id']).toBe(
+          row['sc_joined_mask_test.order_id']
+        );
+      }
+    });
   });
 });