fix(tsql): reject placeholder table expressions

Reject placeholder expressions in table positions so queries use
validated table schemas and receive their enforced filters.

Mono-RevId: a41f4ec6cac574404da5bc2eb319185b6bdf571d

Author: carderne

internal-packages/tsql/src/query/printer.ts

@@ -1813,8 +1813,7 @@ export class ClickHousePrinter {
         // Subquery
         joinStrings.push(this.visit(tableExpr));
       } else if ((tableExpr as Placeholder).expression_type === "placeholder") {
-        // Placeholder - visit inner expression
-        joinStrings.push(this.visit(tableExpr));
+        throw new QueryError("Placeholder table expressions are not supported");
       } else {
         throw new QueryError(
           `Unsupported table expression type: ${(tableExpr as Expression).expression_type}`

internal-packages/tsql/src/query/security.test.ts

@@ -233,6 +233,18 @@ describe("Cross-Tenant Security", () => {
         compile("SELECT * FROM other_database.task_runs");
       }).toThrow();
     });
+
+    it.each([
+      ["direct table", "SELECT * FROM {trigger_dev.task_runs_v2}"],
+      ["joined table", "SELECT * FROM task_runs JOIN {trigger_dev.task_events_v2} ON 1 = 1"],
+      [
+        "subquery",
+        "SELECT id FROM task_runs WHERE id IN (SELECT id FROM {trigger_dev.task_runs_v2})",
+      ],
+      ["CTE", "WITH raw_runs AS (SELECT * FROM {trigger_dev.task_runs_v2}) SELECT * FROM raw_runs"],
+    ])("should reject placeholder table expressions in a %s", (_, query) => {
+      expect(() => compile(query)).toThrowError("Placeholder table expressions are not supported");
+    });
   });
 });