fix(access): merge public production access rollout into main by BigSimmo · Pull Request #282 · BigSimmo/Database

BigSimmo · 2026-07-05T15:27:20Z

Summary

Merges the completed content-access review rollout into main, reconciled with setup-status hotfix (#277).

Access & privacy

Anonymous public document browse/search without private field leakage
Document read rate limits, owner read scope, catalog auth-signal hardening
Bearer + cookie auth recovery; signed-url guards; upload local-project guard

RAG retrieval

Anonymous/global retrieval scoped to public documents via owner sentinel
In-document search RPC owner scope tightened

Follow-up fixes on this PR

Added document_upload rate-limit bucket (fixes typecheck)
Updated production retrieval scope tests for sentinel behavior
Repaired broken $ dollar-quote delimiters in 20260705210000 migration + schema.sql

Verification

npm run typecheck — PASS locally on merge branch
Focused access tests — PASS (public-access-deep, private-access-routes, owner-scope)
npm run check:production-readiness — PASS
npm run check:document-label-governance — PASS
npm run verify:cheap — CI pending / local blocked by parallel worktree churn
Live migration 20260705210000 — apply blocked by RPC return-type drift (see Notes)

Clinical Governance Preflight

Source-backed claims still require linked source verification
Supabase target: Clinical KB Database (sjrfecxgysukkwxsowpy)
Service-role keys remain server-only

Notes

Live migration: 20260705210000_retrieval_owner_filter_sentinel.sql still needs apply. supabase db push --include-all fails at match_document_chunks_text with cannot change return type of existing function — live RPC bodies have drifted from the migration snapshot. Needs a targeted reconcile migration (drop + recreate or no-op repair) before anonymous RAG sentinel is active in production.

Gitleaks: CI flags pre-existing data/medications-snapshot.json entries from upstream history; not introduced by this PR.

The golden retrieval set was 100% lexical fast-path (embedding_skipped_rate=1.0), so it could not measure whether a re-index changes vector/embedding retrieval quality. - forceEmbedding option on searchChunksWithTelemetry (SearchChunksArgs): bypasses every lexical text-fast-path so retrieval always exercises the embedding/vector stage. Diagnostic/eval-only; folded into the search cache key; never set on production paths. - eval-retrieval.ts: per-case `forceEmbedding` field + a global `--force-embedding` flag. - 10 `vector-*` cases (psychiatric monographs: PTSD, OCD, panic, anorexia, GAD, Tourette, postnatal, bipolar, ADHD, opioid) with forceEmbedding=true. Each is a clinical query that must be answered by vector retrieval of the right monograph — verified live at document_recall@5=1.0, content_recall@5=1.0, all via strategy=hybrid (embedding used). Rationale: forcing embedding is the correct instrument for re-index measurement — you want to measure the vector index directly, not have a lexical shortcut mask a regression. Wording alone can't reliably force the vector path (the fast-path is driven by emergent lexical-match strength), so the flag makes these probes deterministic. Live golden eval: 34/34 pass (24 existing + 10 new), no regression. verify:cheap green (980). Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

Wire forceEmbedding through eval runners and retrieval cache keys, bypass coverage/lexical shortcuts when forced, and add golden-case failure metrics so vector regressions cannot hide behind text-fast-path or cache hits.

- Degrade invalid bearer tokens to anonymous scope instead of 401 - Allow public document read routes (list, detail, signed-url, search, images) - Align registry routes with medications/differentials auth-signal short-circuit - Let DocumentViewer load public sources without requiring sign-in - Add regression tests and update access-control expectations

Create missing retrieval-support indexes (trgm, composite btree, partial miss log) that were absent or only present under legacy names on live. Update search_schema_health() to accept verified functional equivalents during rollout. Set search_path for pg_trgm gin_trgm_ops in extensions. Verified on linked project: search_schema_health() ok=true, missing=[].

…board Delete post-extraction dead code left in the monolith and trim unused imports. Also fix minor lint issues in favourites-hub, visual-evidence, and services-navigator.

… branch

…tinel

…nymous RAG

…rdening fix(access): complete public retrieval scope and production access hardening

cursor · 2026-07-05T15:27:24Z

Bugbot is not enabled for your account, so this pull request was not reviewed.

Enable Bugbot in the Cursor dashboard to get automatic reviews on future PRs.

chatgpt-codex-connector · 2026-07-05T15:27:27Z

You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard.

supabase · 2026-07-05T15:27:27Z

This pull request has been ignored for the connected project sjrfecxgysukkwxsowpy due to reaching the limit of concurrent preview branches.
Go to Project Integrations Settings ↗︎ if you wish to update this limit.

Preview Branches by Supabase.
Learn more about Supabase Branching ↗︎.

…al scope tests

cursor · 2026-07-05T15:33:49Z

Bugbot is not enabled for your account, so this pull request was not reviewed.

Enable Bugbot in the Cursor dashboard to get automatic reviews on future PRs.

…igration

cursor · 2026-07-05T15:41:37Z

Bugbot is not enabled for your account, so this pull request was not reviewed.

Enable Bugbot in the Cursor dashboard to get automatic reviews on future PRs.

cursor · 2026-07-05T15:42:44Z

Bugbot is not enabled for your account, so this pull request was not reviewed.

Enable Bugbot in the Cursor dashboard to get automatic reviews on future PRs.

cursor · 2026-07-05T15:53:16Z

Bugbot is not enabled for your account, so this pull request was not reviewed.

Enable Bugbot in the Cursor dashboard to get automatic reviews on future PRs.

BigSimmo · 2026-07-05T17:16:10Z

Superseded by #274 (merged to main). The access rollout stack is already on main; rebase any follow-up work directly onto main.

BigSimmo and others added 16 commits July 3, 2026 21:00

test: add deep public access and production scope checks

9400841

refactor(ui): remove duplicate visual-evidence code from ClinicalDash…

a382754

…board Delete post-extraction dead code left in the monolith and trim unused imports. Also fix minor lint issues in favourites-hub, visual-evidence, and services-navigator.

fix: allow anonymous setup-status on production deployments

2748e6e

merge: consolidate force-embedding eval hardening into platform fixes…

8ab57af

… branch

fix: harden public production access across API, UI, and rate limits

a93b5b9

test: fix unused param lint in document search rate-limit mock

90fde2d

fix(rag): scope anonymous retrieval to public documents via owner sen…

650d26c

…tinel

fix(access): complete forms fallback, signed-url hardening, upload guard

c331802

feat(db): promote locally reviewed documents to public corpus for ano…

8981761

…nymous RAG

test: stabilize scope-sources stress flow via answer options menu

85f247a

fix(access): complete public retrieval scope and production access ha…

d9c9084

…rdening fix(access): complete public retrieval scope and production access hardening

merge: reconcile content-access rollout with main hotfix

7217a8e

fix(access): add document_upload rate limit bucket and update retriev…

c69302f

…al scope tests

fix(db): repair dollar-quote delimiters in retrieval owner sentinel m…

eb7573d

…igration

fix(db): align schema.sql retrieval_owner_matches dollar quotes

fbb6247

BigSimmo enabled auto-merge July 5, 2026 15:43

style: format access rollout files for CI

b3cbb48

BigSimmo closed this Jul 5, 2026

auto-merge was automatically disabled July 5, 2026 17:16
Pull request was closed

BigSimmo mentioned this pull request Jul 5, 2026

Improve desktop answer popup UX #286

Merged

BigSimmo deleted the cursor/merge-access-to-main-5c94 branch July 9, 2026 13:01

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

fix(access): merge public production access rollout into main#282

fix(access): merge public production access rollout into main#282
BigSimmo wants to merge 20 commits into
mainfrom
cursor/merge-access-to-main-5c94

BigSimmo commented Jul 5, 2026 •

edited by cursor Bot

Loading

Uh oh!

cursor Bot commented Jul 5, 2026

Uh oh!

chatgpt-codex-connector Bot commented Jul 5, 2026

Uh oh!

supabase Bot commented Jul 5, 2026

Uh oh!

cursor Bot commented Jul 5, 2026

Uh oh!

cursor Bot commented Jul 5, 2026

Uh oh!

cursor Bot commented Jul 5, 2026

Uh oh!

cursor Bot commented Jul 5, 2026

Uh oh!

BigSimmo commented Jul 5, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Conversation

BigSimmo commented Jul 5, 2026 • edited by cursor Bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary

Access & privacy

RAG retrieval

Follow-up fixes on this PR

Verification

Clinical Governance Preflight

Notes

Uh oh!

cursor Bot commented Jul 5, 2026

Uh oh!

chatgpt-codex-connector Bot commented Jul 5, 2026

Uh oh!

supabase Bot commented Jul 5, 2026

Uh oh!

cursor Bot commented Jul 5, 2026

Uh oh!

cursor Bot commented Jul 5, 2026

Uh oh!

cursor Bot commented Jul 5, 2026

Uh oh!

cursor Bot commented Jul 5, 2026

Uh oh!

BigSimmo commented Jul 5, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

BigSimmo commented Jul 5, 2026 •

edited by cursor Bot

Loading