Report Query Builder Service

Translates a validated declarative report specification into a parameterized PostgreSQL query. Maintains a server-side whitelist of permitted fields, operators, and join paths. Never interpolates raw user input into SQL strings; all values are passed as bound parameters. Supports multi-dimensional grouping and aggregation.

Feature: Custom Reports

report-query-builder-service

• Map field identifiers to their database column and join paths
• Construct parameterized SELECT, JOIN, WHERE, GROUP BY, ORDER BY, and LIMIT clauses
• Enforce the allowed-fields whitelist to prevent injection and schema leakage
• Return a query object with SQL string and bound parameter array