Check that the BY clause only has valid references (#4158)

Fixes #4154.

edb/edgeql/compiler/stmt.py

@@ -27,6 +27,7 @@
 import textwrap
 
 from edb import errors
+from edb.common import ast
 from edb.common import context as pctx
 from edb.common.typeutils import not_none
 
@@ -363,6 +364,17 @@ def compile_InternalGroupQuery(
                 stmt.grouping_binding = _make_group_binding(
                     grouping_stype, expr.grouping_alias, ctx=topctx)
 
+        # Check that the by clause is legit
+        by_refs: List[qlast.ObjectRef] = ast.find_children(
+            stmt.by, lambda n: isinstance(n, qlast.ObjectRef))
+        for by_ref in by_refs:
+            if by_ref.name not in stmt.using:
+                raise errors.InvalidReferenceError(
+                    f"variable '{by_ref.name}' referenced in BY but not "
+                    f"declared in USING",
+                    context=by_ref.context,
+                )
+
         # compile the output
         # newscope because we don't want the result to get assigned the
         # same statement scope as the subject and elements, which we

tests/test_edgeql_group.py

@@ -788,7 +788,7 @@ async def test_edgeql_group_by_group_by_03c(self):
             '''
         )
 
-    async def test_edgeql_group_id_errors(self):
+    async def test_edgeql_group_errors_id(self):
         async with self.assertRaisesRegexTx(
             edgedb.UnsupportedFeatureError,
             r"may not name a grouping alias 'id'"
@@ -806,6 +806,15 @@ async def test_edgeql_group_id_errors(self):
                 group cards::Card{name} by .id
             ''')
 
+    async def test_edgeql_group_errors_ref(self):
+        async with self.assertRaisesRegexTx(
+            edgedb.InvalidReferenceError,
+            r"variable 'name' referenced in BY but not declared in USING"
+        ):
+            await self.con.execute('''
+                group User by name
+            ''')
+
     async def test_edgeql_group_tuple_01(self):
         await self.con.execute('''
             create type tup {