fix(api): owner-scope caller-supplied FKs in eval-cases + interaction…

[BigSimmo]

… (L4, L5)

Audit findings L4/L5: both routes stored caller-supplied document/chunk ids (and free-text labels) without verifying ownership, letting a client inject arbitrary or cross-owner references into the miss-promotion / eval pipeline.

• search/interaction: gate clicked_document_id, top_files, top_chunk_ids and candidate_labels on a documents.owner_id check; the query telemetry is still recorded.
• eval-cases: verify expectedDocumentId (and expectedChunkId via its document) belong to the caller; null them otherwise. Added a test proving an unowned expectedDocumentId is dropped.

Summary

Verification

• npm run verify:cheap
• npm run verify:ui when UI, routing, styling, browser behavior, reduced-motion, or forced-colors behavior changed
• npm run verify:release before release or handoff confidence claims
• npm run format:check
• npm run check:production-readiness when clinical workflow, privacy, environment, Supabase, source governance, or deployment behavior changed

Clinical Governance Preflight

Complete this section when the change touches ingestion, answer generation, search/ranking, source rendering, document access, privacy, production env, or clinical output.

• Source-backed claims still require linked source verification before clinical use
• No patient-identifiable document workflow was introduced or expanded without explicit governance approval
• Supabase target remains Clinical KB Database (sjrfecxgysukkwxsowpy)
• Service-role keys and private document access remain server-only
• Demo/synthetic content remains clearly separated from real clinical sources
• Source metadata, review status, and outdated/unknown-source behavior remain conservative
• Deployment classification/TGA SaMD impact was checked when clinical decision-support behavior changed

Notes

[Copilot]

Pull request overview

This PR hardens two API routes against tenant-crossing reference injection by ensuring caller-supplied document/chunk references are only persisted when they belong to the authenticated owner, reducing the risk of polluting the eval/miss-promotion pipeline with cross-owner pointers.

Changes:

• /api/search/interaction: gate persisted clicked_document_id-related telemetry (and derived labels/top_* fields) behind a documents.owner_id = user.id check.
• /api/eval-cases: verify expectedDocumentId is owned by the caller (and expectedChunkId via its parent document) and null them otherwise before inserting into rag_query_misses.
• Add a test asserting an unowned expectedDocumentId is dropped.

Reviewed changes

Copilot reviewed 3 out of 3 changed files in this pull request and generated 2 comments.

File	Description
tests/eval-cases-route.test.ts	Adds coverage ensuring unowned expectedDocumentId is not persisted.
src/app/api/search/interaction/route.ts	Adds ownership gating before attributing clicked doc + label/top_* telemetry to rag_query_misses.
src/app/api/eval-cases/route.ts	Adds ownership verification for caller-supplied expected_* foreign keys before insert.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.