fix(access): resolve outstanding P0/P1 security and UX gaps

.gitleaksignore

@@ -8,3 +8,5 @@
 # generic-api-key rule on historical commit content scanned in PR history.
 27121756b10df6d93841ebf48b0f1991e0144a1f:data/medications-snapshot.json:generic-api-key:22253
 27121756b10df6d93841ebf48b0f1991e0144a1f:data/medications-snapshot.json:generic-api-key:47690
+b65acddaa13e69e0ad2a49783116056b3a1a3639:data/medications-snapshot.json:generic-api-key:21520
+b65acddaa13e69e0ad2a49783116056b3a1a3639:data/medications-snapshot.json:generic-api-key:46330

docs/site-map.md

@@ -5,7 +5,6 @@ This file is generated by `npm run sitemap:update`. Run `npm run sitemap:check`
 ## Main product pages
 
 - `/` - Main Clinical KB shell. Source: `src/app/page.tsx`.
-- `/applications` - Application and tool launcher. Source: `src/app/applications/page.tsx`.
 - `/differentials` - Differentials home and search surface. Source: `src/app/differentials/page.tsx`.
 - `/differentials/diagnoses` - Diagnosis stream. Source: `src/app/differentials/diagnoses/page.tsx`.
 - `/differentials/presentations` - Presentation workflow stream. Source: `src/app/differentials/presentations/page.tsx`.
@@ -40,7 +39,7 @@ This file is generated by `npm run sitemap:update`. Run `npm run sitemap:check`
 | Favourites    | `/favourites`        | `/favourites?q=clozapine+set&focus=1&run=1`                           | Saved set and saved item detail render inside the favourites page surface.                                                                       |
 | Differentials | `/differentials`     | `/differentials?q=acute+confusion&focus=1&run=1`                      | `/differentials/diagnoses`, `/differentials/diagnoses/[slug]`, and `/differentials/presentations`.                                               |
 | Medication    | `/?mode=prescribing` | `/?mode=prescribing&q=acamprosate+renal+dose&focus=1&run=1`           | `/medications/[slug]`; `/medications` redirects to medication mode.                                                                              |
-| Tools         | `/?mode=tools`       | `/?mode=tools&q=medications&focus=1&run=1`                            | `/applications` launcher and tool detail panels inside tools mode.                                                                               |
+| Tools         | `/?mode=tools`       | `/?mode=tools&q=medications&focus=1&run=1`                            | Tool launcher and detail panels inside dashboard tools mode (`/?mode=tools`).                                                                    |
 
 ## Documents flow index
 
@@ -601,5 +600,5 @@ This file is generated by `npm run sitemap:update`. Run `npm run sitemap:check`
 | Differentials                  | `src/app/differentials, src/lib/differentials.ts`                                             |
 | Medications                    | `src/app/medications, src/components/clinical-dashboard/medication-prescribing-workspace.tsx` |
 | Documents                      | `src/app/documents, src/lib/document-flow-routes.ts`                                          |
-| Applications and tools         | `src/app/applications, src/components/applications-launcher-page.tsx`                         |
+| Tools                          | `src/components/applications-launcher-page.tsx`                                               |
 | Mockups                        | `src/app/mockups`                                                                             |

next.config.ts

@@ -64,6 +64,15 @@ const nextConfig: NextConfig = {
       },
     ];
   },
+  async redirects() {
+    return [
+      {
+        source: "/applications",
+        destination: "/?mode=tools",
+        permanent: true,
+      },
+    ];
+  },
 };
 
 export default nextConfig;

scripts/eval-quality.ts

@@ -45,6 +45,7 @@ type EvalQualityArgs = {
   retrievalOnly: boolean;
   ragOnly: boolean;
   skipPreflight: boolean;
+  forceEmbedding: boolean;
 };
 
 export type RagQualityResult = {
@@ -150,6 +151,7 @@ function parseArgs(argv: string[]): EvalQualityArgs {
     retrievalOnly: false,
     ragOnly: false,
     skipPreflight: false,
+    forceEmbedding: false,
   };
 
   for (let index = 0; index < argv.length; index += 1) {
@@ -176,6 +178,10 @@ function parseArgs(argv: string[]): EvalQualityArgs {
       args.skipPreflight = true;
       continue;
     }
+    if (token === "--force-embedding") {
+      args.forceEmbedding = true;
+      continue;
+    }
 
     const value = argv[index + 1];
     if (!value || value.startsWith("--")) throw new Error(`Missing value for ${token}`);
@@ -476,6 +482,11 @@ export function buildEvalQualityReport(args: {
         `retrieval content_recall_at_5 ${retrievalSummary.content_recall_at_5} below ${qualityThresholds.retrievalContentRecallAt5}`,
       );
     }
+    if (retrievalSummary.force_embedding_failure_count > 0) {
+      thresholdFailures.push(
+        `retrieval force_embedding_failure_count ${retrievalSummary.force_embedding_failure_count} above 0`,
+      );
+    }
     if (governance.stale_rate > qualityThresholds.staleTopResultRate) {
       thresholdFailures.push(
         `top-result stale_rate ${governance.stale_rate} above ${qualityThresholds.staleTopResultRate}`,
@@ -664,6 +675,8 @@ ${markdownTable([
 ## Retrieval Decision Metrics
 
 ${markdownTable([
+  ["Force-embedding cases", retrieval.force_embedding_case_count],
+  ["Force-embedding failures", retrieval.force_embedding_failure_count],
   ["Embedding skipped rate", retrieval.embedding_skipped_rate],
   ["Median text candidate budget", retrieval.median_text_candidate_budget],
   ["Second-stage rerank rate", retrieval.second_stage_rerank_rate],
@@ -728,6 +741,7 @@ async function runRetrievalQualityCases(args: {
   ownerId?: string;
   limit?: number;
   query?: string;
+  forceEmbedding?: boolean;
   supabase: Awaited<ReturnType<typeof loadAdminClient>>;
 }) {
   const [{ searchChunksWithTelemetry }, capturedCases] = await Promise.all([
@@ -756,7 +770,7 @@ async function runRetrievalQualityCases(args: {
         topK: retrievalLimitForGoldenCase(testCase),
         minSimilarity: 0.12,
         skipCache: true,
-        forceEmbedding: testCase.forceEmbedding,
+        forceEmbedding: testCase.forceEmbedding || args.forceEmbedding,
       }),
     );
     const latencyMs =

scripts/eval-retrieval.ts

@@ -47,6 +47,7 @@ type EvalArgs = {
 export type GoldenRetrievalResult = {
   id: string;
   query: string;
+  forceEmbedding: boolean;
   expectedQueryClass: string;
   actualQueryClass: string | null;
   expectedDocumentSubstrings: string[];
@@ -516,6 +517,11 @@ export function evaluateGoldenRetrievalCase(args: {
   const tableEvidenceFoundAtK = hasTableEvidence(args.results, topK);
   const actualQueryClass = args.telemetry.query_class ?? null;
   const failures: string[] = [];
+  const vectorLayerCount = Object.entries(args.telemetry.retrieval_layer_counts ?? {}).reduce(
+    (sum, [layer, count]) =>
+      ["embedding_fields", "index_units", "hybrid_vector", "vector_fallback"].includes(layer) ? sum + count : sum,
+    0,
+  );
   const hitAtK =
     documentHitsAtK.missing.length === 0 &&
     contentHitsAtK.missing.length === 0 &&
@@ -533,10 +539,23 @@ export function evaluateGoldenRetrievalCase(args: {
   if (args.testCase.expectTableEvidence && !tableEvidenceFound) {
     failures.push("expected table evidence in top 5");
   }
+  if (args.testCase.forceEmbedding) {
+    if (args.telemetry.embedding_skipped) failures.push("forceEmbedding expected embedding to run");
+    if (args.telemetry.retrieval_strategy === "search_cache") failures.push("forceEmbedding served search cache");
+    if (
+      args.telemetry.retrieval_strategy === "text_fast_path" ||
+      args.telemetry.retrieval_strategy === "document_lookup_fast_path"
+    ) {
+      failures.push(`forceEmbedding returned lexical strategy ${args.telemetry.retrieval_strategy}`);
+    }
+    if (args.telemetry.coverage_gate_decision === "accepted") failures.push("forceEmbedding returned coverage gate");
+    if (vectorLayerCount <= 0) failures.push("forceEmbedding found no vector-layer candidates");
+  }
 
   return {
     id: args.testCase.id,
     query: args.testCase.query,
+    forceEmbedding: args.testCase.forceEmbedding ?? false,
     expectedQueryClass: args.testCase.expectedQueryClass,
     actualQueryClass,
     expectedDocumentSubstrings: args.testCase.expectedDocumentSubstrings,
@@ -612,6 +631,7 @@ export function summarizeGoldenRetrievalResults(results: GoldenRetrievalResult[]
     }
     return counts;
   }, {});
+  const forceEmbeddingResults = results.filter((result) => result.forceEmbedding);
   return {
     case_count: results.length,
     document_recall_at_5: Number(
@@ -647,6 +667,8 @@ export function summarizeGoldenRetrievalResults(results: GoldenRetrievalResult[]
     embedding_skip_reason_counts: embeddingSkipReasonCounts,
     text_fast_path_reason_counts: textFastPathReasonCounts,
     retrieval_layer_counts: layerCounts,
+    force_embedding_case_count: forceEmbeddingResults.length,
+    force_embedding_failure_count: forceEmbeddingResults.filter((result) => result.failures.length > 0).length,
     median_text_candidate_budget: percentile(textCandidateBudgets, 50),
     second_stage_rerank_rate: Number(
       (results.filter((result) => result.secondStageRerankUsed).length / Math.max(results.length, 1)).toFixed(4),
@@ -723,6 +745,8 @@ function printHumanSummary(summary: ReturnType<typeof summarizeGoldenRetrievalRe
   console.log(`  retrieval_strategy_counts=${JSON.stringify(summary.retrieval_strategy_counts)}`);
   console.log(`  retrieval_plan_counts=${JSON.stringify(summary.retrieval_plan_counts)}`);
   console.log(`  retrieval_layer_counts=${JSON.stringify(summary.retrieval_layer_counts)}`);
+  console.log(`  force_embedding_case_count=${summary.force_embedding_case_count}`);
+  console.log(`  force_embedding_failure_count=${summary.force_embedding_failure_count}`);
   console.log(`  embedding_skipped_rate=${summary.embedding_skipped_rate}`);
   console.log(`  embedding_skip_reason_counts=${JSON.stringify(summary.embedding_skip_reason_counts)}`);
   console.log(`  text_fast_path_reason_counts=${JSON.stringify(summary.text_fast_path_reason_counts)}`);

scripts/generate-site-map.ts

@@ -40,7 +40,6 @@ type SiteMapData = {
 
 const routeDescriptions: Record<string, string> = {
   "/": "Main Clinical KB shell.",
-  "/applications": "Application and tool launcher.",
   "/differentials": "Differentials home and search surface.",
   "/differentials/diagnoses": "Diagnosis stream.",
   "/differentials/diagnoses/[slug]": "Differential diagnosis detail.",
@@ -97,7 +96,7 @@ const routeOwnershipRows = [
   ["Differentials", "src/app/differentials, src/lib/differentials.ts"],
   ["Medications", "src/app/medications, src/components/clinical-dashboard/medication-prescribing-workspace.tsx"],
   ["Documents", "src/app/documents, src/lib/document-flow-routes.ts"],
-  ["Applications and tools", "src/app/applications, src/components/applications-launcher-page.tsx"],
+  ["Tools", "src/components/applications-launcher-page.tsx"],
   ["Mockups", "src/app/mockups"],
 ] as const;
 
@@ -279,7 +278,7 @@ function renderModePageIndex() {
       mode: "Tools",
       home: appModeHomeHref("tools"),
       search: appModeHomeHref("tools", { query: "medications", focus: true, run: true }),
-      detail: "`/applications` launcher and tool detail panels inside tools mode.",
+      detail: "Tool launcher and detail panels inside dashboard tools mode (`/?mode=tools`).",
     },
   ]);
 }

src/app/api/differentials/[slug]/route.ts

@@ -90,7 +90,7 @@ export async function GET(request: Request, context: { params: Promise<{ slug: s
     const rateLimit = await consumeSubjectApiRateLimit({
       supabase,
       subject: access.rateLimitSubject,
-      bucket: "registry",
+      bucket: "differentials",
       allowInMemoryFallbackOnUnavailable: isLocalNoAuthMode(),
     });
     if (rateLimit.limited) {

src/app/api/differentials/presentations/[slug]/route.ts

@@ -77,7 +77,7 @@ export async function GET(request: Request, context: { params: Promise<{ slug: s
     const rateLimit = await consumeSubjectApiRateLimit({
       supabase,
       subject: access.rateLimitSubject,
-      bucket: "registry",
+      bucket: "differentials",
       allowInMemoryFallbackOnUnavailable: isLocalNoAuthMode(),
     });
     if (rateLimit.limited) {

src/app/api/differentials/route.ts

@@ -81,7 +81,7 @@ export async function GET(request: Request) {
     const rateLimit = await consumeSubjectApiRateLimit({
       supabase,
       subject: access.rateLimitSubject,
-      bucket: "registry",
+      bucket: "differentials",
       allowInMemoryFallbackOnUnavailable: isLocalNoAuthMode(),
     });
     if (rateLimit.limited) {

src/app/api/documents/[id]/reindex/route.ts

@@ -16,6 +16,7 @@ import {
   isAtomicReindexCandidate,
   isCommittedGenerationMetadata,
 } from "@/lib/reindex-pipeline";
+import { invalidateRagCachesForDocumentMutation } from "@/lib/rag";
 import { createAdminClient } from "@/lib/supabase/admin";
 import { AuthenticationError, requireAuthenticatedUser, unauthorizedResponse } from "@/lib/supabase/auth";
 import { parseJsonBodyOrDefault } from "@/lib/validation/body";
@@ -174,6 +175,7 @@ export async function POST(request: Request, { params }: { params: Promise<{ id:
         images: committedImages,
         summary: enrichment.summary.summary,
       });
+      invalidateRagCachesForDocumentMutation(user.id);
       return NextResponse.json({
         mode,
         enrichment,

src/app/api/documents/[id]/signed-url/route.ts

@@ -34,12 +34,15 @@ export async function GET(_request: Request, { params }: { params: Promise<{ id:
     const supabase = createAdminClient();
     const access = await publicAccessContext(_request, supabase);
     const { data: document, error } = await withOwnerReadScope(
-      supabase.from("documents").select("storage_path,file_type").eq("id", id),
+      supabase.from("documents").select("storage_path,file_type,status").eq("id", id),
       access.ownerId,
     ).maybeSingle();
 
     if (error) throw new Error(error.message);
     if (!document) return NextResponse.json({ error: "Document not found." }, { status: 404 });
+    if (document.status && document.status !== "indexed") {
+      return NextResponse.json({ error: "Document not found." }, { status: 404 });
+    }
 
     const storage = supabase.storage.from(env.SUPABASE_DOCUMENT_BUCKET);
     const signed = shouldDownload

src/app/api/images/[id]/signed-url/route.ts

@@ -51,13 +51,22 @@ export async function GET(_request: Request, { params }: { params: Promise<{ id:
     if (!document) return NextResponse.json({ error: "Image not found." }, { status: 404 });
     if (
       !isCommittedGenerationMetadata({
-        rowMetadata: image.metadata,
+        rowMetadata: imageRef.metadata,
         committedGeneration: committedIndexGeneration(document.metadata),
       })
     ) {
       return NextResponse.json({ error: "Image not found." }, { status: 404 });
     }
 
+    const { data: image, error: imageError } = await supabase
+      .from("document_images")
+      .select("storage_path,mime_type,caption")
+      .eq("id", id)
+      .maybeSingle();
+
+    if (imageError) throw new Error(imageError.message);
+    if (!image) return NextResponse.json({ error: "Image not found." }, { status: 404 });
+
     const signed = await supabase.storage
       .from(env.SUPABASE_IMAGE_BUCKET)
       .createSignedUrl(image.storage_path, signedUrlTtlSeconds);

src/app/api/medications/[slug]/route.ts

@@ -71,7 +71,7 @@ export async function GET(request: Request, context: { params: Promise<{ slug: s
     const rateLimit = await consumeSubjectApiRateLimit({
       supabase,
       subject: access.rateLimitSubject,
-      bucket: "registry",
+      bucket: "medications",
       allowInMemoryFallbackOnUnavailable: isLocalNoAuthMode(),
     });
     if (rateLimit.limited) {

src/app/api/medications/route.ts

@@ -89,7 +89,7 @@ export async function GET(request: Request) {
     const rateLimit = await consumeSubjectApiRateLimit({
       supabase,
       subject: access.rateLimitSubject,
-      bucket: "registry",
+      bucket: "medications",
       allowInMemoryFallbackOnUnavailable: isLocalNoAuthMode(),
     });
     if (rateLimit.limited) {

src/app/api/setup-status/route.ts

@@ -1,8 +1,8 @@
 import { NextResponse } from "next/server";
 import { env, isDemoMode } from "@/lib/env";
+import { jsonError } from "@/lib/http";
 import { localProjectRequestIdentityPayload, unsafeLocalProjectResponse } from "@/lib/local-project-guard";
 import { createAdminClient } from "@/lib/supabase/admin";
-import { AuthenticationError, requireAuthenticatedUser, unauthorizedResponse } from "@/lib/supabase/auth";
 import { formatSupabaseUnavailableError, isSupabaseUnavailableError, probeSupabaseHealth } from "@/lib/supabase/health";
 import { checkSupabaseProjectConfig, formatSupabaseProjectCheck } from "@/lib/supabase/project";
 
@@ -409,27 +409,11 @@ async function readSetupStatusPayload() {
   }
 }
 
-async function requireProductionSetupStatusAuth(request: Request) {
+export async function GET(request: Request) {
   const identity = localProjectRequestIdentityPayload(request);
-  if (process.env.NODE_ENV !== "production" || identity.localServer.currentUrl) {
-    return identity;
+  if (!identity.localServer.safeLocalOrigin) {
+    return unsafeLocalProjectResponse(identity);
   }
-  await requireAuthenticatedUser(request, createAdminClient());
-  return identity;
-}
 
-export async function GET(request: Request) {
-  try {
-    const identity = await requireProductionSetupStatusAuth(request);
-    if (!identity.localServer.safeLocalOrigin) {
-      return unsafeLocalProjectResponse(identity);
-    }
-
-    return setupStatusResponse(await readSetupStatusPayload());
-  } catch (error) {
-    if (error instanceof AuthenticationError) {
-      return unauthorizedResponse(error);
-    }
-    throw error;
-  }
+  return setupStatusResponse(await readSetupStatusPayload());
 }

src/app/api/upload/route.ts

@@ -9,6 +9,7 @@ import { writeAuditLog } from "@/lib/audit";
 import { planDocumentName, type DocumentNameSupabase } from "@/lib/document-naming";
 import { createAdminClient } from "@/lib/supabase/admin";
 import { AuthenticationError, requireAuthenticatedUser, unauthorizedResponse } from "@/lib/supabase/auth";
+import { assertSafeLocalProjectRequest, localProjectOriginErrorResponse, UnsafeLocalProjectOriginError } from "@/lib/local-project-guard";
 import { probeSupabaseHealth } from "@/lib/supabase/health";
 import { optionalFormText, parseFormDataFields } from "@/lib/validation/form-data";
 
@@ -82,6 +83,7 @@ export async function POST(request: Request) {
   let insertedDocumentOwnerId: string | null = null;
 
   try {
+    assertSafeLocalProjectRequest(request);
     supabase = createAdminClient();
     const adminSupabase = supabase;
     const user = await requireAuthenticatedUser(request, adminSupabase);
@@ -298,6 +300,9 @@ export async function POST(request: Request) {
     if (error instanceof AuthenticationError) {
       return unauthorizedResponse();
     }
+    if (error instanceof UnsafeLocalProjectOriginError) {
+      return localProjectOriginErrorResponse(error);
+    }
 
     return jsonError(error);
   }