feat:修改nl2sql功能

nl2sql/sql_security.py

@@ -83,7 +83,16 @@ def validate_select_sql(
         if statement.find(exp.Star):
             raise SqlSecurityError("配置字段权限时禁止 SELECT *")
         default_table = next(iter(access_tables), None) if len(access_tables) == 1 else None
+        select_aliases = {
+            expression.alias
+            for expression in statement.expressions
+            if isinstance(expression, exp.Alias) and expression.alias
+        }
         for column in statement.find_all(exp.Column):
+            # ORDER BY may legally reference an alias defined in SELECT. The
+            # alias is already covered by the expressions validated below.
+            if not column.table and column.name in select_aliases and isinstance(column.parent, exp.Ordered):
+                continue
             table_name = aliases.get(column.table, column.table) or default_table
             if table_name is None or column.name not in authorized_columns.get(table_name, set()):
                 raise SqlSecurityError("SQL 访问了未授权字段")