AIKIDO-2026-803668

TL;DR

The different_queries?/2 helper in lib/aggregate.ex decides whether two same-named aggregates are distinct before deduplication. It combines the filter and sort comparisons with && instead of ||, so two aggregates that differ only by their filter are treated as identical. The subsequent Enum.uniq_by/2 on name then discards the more restrictive aggregate and returns the value computed by the broader one, leaking rows that a tenancy or authorization filter should have excluded. The fix compares filters and sorts so aggregates that differ by either are kept distinct.