Mostly working state

app/controllers/dashboard_controller.rb

@@ -1,5 +1,18 @@
 require 'yaml'
 
+
+## Debugging:
+# If the response should be filtered and it is not being filtered **and** you
+# are geting all the values for that column, check to make sure that you are
+# selecting from the allowed tables and columns.
+
+
+ALLOWED_TABLES = {
+  "JointInfo" => ["Joint", "Osteokinematics"],
+  "Joint"     => ["Common Name", "Joint"]
+}
+
+
 class DashboardController < ApplicationController
   before_action :load_manifest
 
@@ -13,14 +26,28 @@ class DashboardController < ApplicationController
 
   # GET /dashboard/options?table=Joint&filter_col=joint_id&value=1
   def options
-    table = params[:table].constantize
-    if params[:filter_col].present?
-      options = table.where(params[:filter_col] => params[:value]).pluck(params[:pluck_column])
+    # 1. Define what is allowed to be accessed
+
+    table_name = params[:table]
+    col_name = params[:pluck_column]
+
+    # 2. Validate that the table and column exist in your allowlist
+    if ALLOWED_TABLES.key?(table_name) && ALLOWED_TABLES[table_name].include?(col_name)
+      table = table_name.constantize
+      quoted_col = ActiveRecord::Base.connection.quote_column_name(col_name)
+
+      if params[:filter_column].present? && ALLOWED_TABLES[table_name].include?(params[:filter_column])
+        puts "Filtering with 'filter_column'"
+        options = table.select(Arel.sql(quoted_col)).where(params[:filter_column] => params[:value]).pluck(Arel.sql(quoted_col))
+      else
+        puts "***NO FILTERING***"
+        options = table.distinct.pluck(Arel.sql(quoted_col))
+      end
+      
+      render json: options
     else
-      puts table
-      options = table.distinct.pluck(params[:pluck_column])
+      render json: { error: "Invalid table or column requested" }, status: :bad_request
     end
-    render json: options
   end
 
   # GET /dashboard/data?joint=Acromioclavicular&sub_joint=X
@@ -29,10 +56,11 @@ class DashboardController < ApplicationController
     
     # Use the data_sources from YAML to aggregate data
     @manifest['data_sources'].each do |source|
+      debugger
       table = source['table'].constantize
       # Find the filter value from the params that matches the filter_column
       # We assume the filter_column name in DB matches the filter ID in YAML
-      filter_val = params[source['filter_column']] || params['joint'] # Fallback to joint
+      filter_val = params[source['filter_column']]
       
       record = table.find_by(source['filter_column'] => filter_val)
       results[source['key']] = record ? record.attributes : {}