refactor: JSON_VALUE in clickhouse query

[chrisgacsal]

Overview

Bind meter value-property and group-by JSONPaths as ClickHouse query parameters instead of interpolating them into SQL. This prevents crafted meter configuration from altering generated queries while preserving aggregation, grouping, and filtering behavior. Tests now verify injection-shaped JSONPaths remain bound values.

Summary by CodeRabbit

• Bug Fixes

  • Improved ClickHouse meter queries by safely binding JSON paths as parameters.
  • Added support for nested group-by filters and all filter string operators.
  • Prevented potentially malicious JSON paths from being embedded directly in generated SQL.
  • Omitted empty logical filter expressions from generated queries.

• Tests

  • Expanded coverage for filtering, grouping, aggregation, time windows, customer queries, and query settings.

Greptile Summary

The PR hardens ClickHouse meter queries by binding value-property and group-by JSONPaths rather than interpolating them into SQL.

• Moves JSONPath values into ClickHouse query arguments across aggregation, grouping, and group-by filtering.
• Adds a nested string-filter expression builder that preserves bound parameters and omits empty logical expressions.
• Expands SQL-generation and connector tests for parameter ordering, nested filters, and injection-shaped JSONPaths.

Confidence Score: 5/5

The PR appears safe to merge.

No blocking failure remains.

Important Files Changed

Filename	Overview
openmeter/streaming/clickhouse/meter_query.go	Replaces interpolated JSONPath literals with bound parameters and introduces parameter-preserving string-filter expression builders.
openmeter/streaming/clickhouse/meter_query_test.go	Updates expected SQL and arguments and adds coverage for empty logical filters and injection-shaped JSONPaths.
openmeter/streaming/clickhouse/connector_test.go	Updates the connector mock expectation to include the newly bound value-property JSONPath.

Flowchart

%%{init: {'theme': 'neutral'}}%%
flowchart LR
  M[Meter configuration] --> Q[queryMeter.toSQL]
  Q --> S[SELECT aggregation and grouping]
  Q --> F[Group-by filter expressions]
  S --> P[Bound JSONPath parameters]
  F --> P
  P --> CH[ClickHouse query execution]

Loading

_{Reviews (2): Last reviewed commit: "fix: empty filters" | Re-trigger Greptile}

Context used:

• Knowledge Base — Ingest, Dedupe, and Metering Flow

[coderabbitai]

📝 Walkthrough

Walkthrough

This PR changes ClickHouse meter queries to bind JSON value and group-by paths as query parameters. It adds recursive FilterString expression handling, updates argument expectations, and tests empty filters and injection-style JSON paths.

Changes

JSON path parameterization

Layer / File(s)	Summary
Query builder and JSON path binding openmeter/streaming/clickhouse/meter_query.go	The query builder initializes before expression construction. Value and group-by JSON paths use bound parameters. The old escaping helper is removed.
Recursive group-by filter construction openmeter/streaming/clickhouse/meter_query.go	Group-by filters build parameterized JSON_VALUE expressions. Recursive helpers support FilterString comparisons, existence checks, membership, pattern matching, numeric comparisons, and nested And/Or filters.
Query expectations and validation openmeter/streaming/clickhouse/meter_query_test.go, openmeter/streaming/clickhouse/connector_test.go	Tests update argument ordering across query cases. New tests cover empty logical filters and injection-style JSON paths. The connector mock expects "$.value".

Estimated code review effort: 4 (Complex) | ~45 minutes

Sequence Diagram(s)

sequenceDiagram
  participant toSQL
  participant QueryBuilder
  participant FilterStringHelpers
  toSQL->>QueryBuilder: Initialize builder
  toSQL->>QueryBuilder: Bind JSON paths
  toSQL->>FilterStringHelpers: Build filter expression
  FilterStringHelpers->>QueryBuilder: Bind filter paths and values
  QueryBuilder-->>toSQL: Return SQL and arguments

Loading

Possibly related PRs

• openmeterio/openmeter#3430: Both PRs modify meter_query.go query construction.
• openmeterio/openmeter#3431: This PR extends related parameterization to JSON paths, nested filters, and more query cases.

Suggested reviewers: tothandras, turip, borbelyr-kong

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title accurately identifies a ClickHouse query refactor involving JSON values, which matches the main changes.

✨ Finishing Touches

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch fix/ch-sqli

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[coderabbitai]

Actionable comments posted: 1

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@openmeter/streaming/clickhouse/meter_query.go`:
- Around line 406-417: Update joinStringFilterWhereExprs and its callers to
recursively remove no-op filter children before building logical expressions, so
empty groups and mixed empty children produce no placeholders or malformed
predicates. Ensure the string-filter query path skips query.Where when filtering
yields no predicate, and add regression coverage for empty FilterGroupBy logical
lists and mixed no-op children.

🪄 Autofix

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro Plus

Run ID: 2a2c7bd9-9310-4d0d-8a69-384dfd1dae24

📥 Commits

Reviewing files that changed from the base of the PR and between 887e0ca and 022f184.

📒 Files selected for processing (3)

• openmeter/streaming/clickhouse/connector_test.go
• openmeter/streaming/clickhouse/meter_query.go
• openmeter/streaming/clickhouse/meter_query_test.go