@open-mercato/search 0.6.8-develop.6917.1.af45bc96e2 → 0.6.8-develop.6924.1.a8d208fcdc

package/src/modules/search/__tests__/entity-access.test.ts

@@ -0,0 +1,165 @@
+import type { SearchEntityConfig } from '@open-mercato/shared/modules/search'
+import {
+  canReadSearchEntity,
+  filterSearchResultsByEntityAccess,
+  resolveReadableEntityTypes,
+  type SearchEntityDenyReason,
+} from '../lib/entity-access'
+
+const CONFIGS: Record<string, SearchEntityConfig> = {
+  'customers:customer_person_profile': {
+    entityId: 'customers:customer_person_profile',
+    aclFeatures: ['customers.people.view'],
+  },
+  'catalog:catalog_product': {
+    entityId: 'catalog:catalog_product',
+    aclFeatures: ['catalog.products.view'],
+  },
+  // Deliberately declares no aclFeatures: models a module that forgot to opt in.
+  'wms:warehouse': {
+    entityId: 'wms:warehouse',
+  },
+}
+
+const lookup = {
+  getEntityConfig: (entityId: string) => CONFIGS[entityId],
+  getAllEntityConfigs: () => Object.values(CONFIGS),
+}
+
+function result(entityId: string, recordId: string) {
+  return { entityId, recordId }
+}
+
+describe('canReadSearchEntity', () => {
+  it('allows a caller holding the entity view feature', () => {
+    expect(
+      canReadSearchEntity('customers:customer_person_profile', lookup, {
+        grantedFeatures: ['search.global', 'customers.people.view'],
+      }),
+    ).toBe(true)
+  })
+
+  it('denies a caller holding only search.global', () => {
+    expect(
+      canReadSearchEntity('customers:customer_person_profile', lookup, {
+        grantedFeatures: ['search.global'],
+      }),
+    ).toBe(false)
+  })
+
+  it('honours wildcard grants', () => {
+    expect(
+      canReadSearchEntity('catalog:catalog_product', lookup, {
+        grantedFeatures: ['catalog.*'],
+      }),
+    ).toBe(true)
+  })
+
+  it('fails closed for an entity that is not configured for search', () => {
+    const reasons: SearchEntityDenyReason[] = []
+    expect(
+      canReadSearchEntity('unknown:entity', lookup, { grantedFeatures: ['*'] }, {
+        onDeny: (_entityId, reason) => reasons.push(reason),
+      }),
+    ).toBe(false)
+    expect(reasons).toEqual(['unconfigured'])
+  })
+
+  it('fails closed for a configured entity that declares no aclFeatures', () => {
+    const reasons: SearchEntityDenyReason[] = []
+    expect(
+      canReadSearchEntity('wms:warehouse', lookup, { grantedFeatures: ['wms.view'] }, {
+        onDeny: (_entityId, reason) => reasons.push(reason),
+      }),
+    ).toBe(false)
+    expect(reasons).toEqual(['no-acl-features'])
+  })
+
+  it('lets a superadmin through regardless of declared features', () => {
+    expect(
+      canReadSearchEntity('wms:warehouse', lookup, { grantedFeatures: [], isSuperAdmin: true }),
+    ).toBe(true)
+  })
+})
+
+describe('resolveReadableEntityTypes', () => {
+  it('narrows the query to the entity types the caller can read', () => {
+    expect(
+      resolveReadableEntityTypes(lookup, { grantedFeatures: ['customers.people.view'] }),
+    ).toEqual(['customers:customer_person_profile'])
+  })
+
+  it('returns an empty list when nothing is readable, so callers can short-circuit', () => {
+    expect(resolveReadableEntityTypes(lookup, { grantedFeatures: ['search.global'] })).toEqual([])
+  })
+
+  it('intersects the readable types with the explicitly requested ones', () => {
+    expect(
+      resolveReadableEntityTypes(lookup, { grantedFeatures: ['*'] }, ['catalog:catalog_product', 'wms:warehouse']),
+    ).toEqual(['catalog:catalog_product'])
+  })
+
+  it('applies no restriction for a superadmin and passes an explicit request through', () => {
+    expect(
+      resolveReadableEntityTypes(lookup, { grantedFeatures: [], isSuperAdmin: true }),
+    ).toBeUndefined()
+    expect(
+      resolveReadableEntityTypes(lookup, { grantedFeatures: [], isSuperAdmin: true }, ['wms:warehouse']),
+    ).toEqual(['wms:warehouse'])
+  })
+
+  it('skips entities explicitly disabled for search', () => {
+    const disabledLookup = {
+      getEntityConfig: (entityId: string) => CONFIGS[entityId],
+      getAllEntityConfigs: () => [
+        { entityId: 'catalog:catalog_product', aclFeatures: ['catalog.products.view'], enabled: false },
+      ],
+    }
+
+    expect(resolveReadableEntityTypes(disabledLookup, { grantedFeatures: ['*'] })).toEqual([])
+  })
+})
+
+describe('filterSearchResultsByEntityAccess', () => {
+  const results = [
+    result('customers:customer_person_profile', 'person-1'),
+    result('catalog:catalog_product', 'product-1'),
+    result('customers:customer_person_profile', 'person-2'),
+    result('wms:warehouse', 'warehouse-1'),
+  ]
+
+  it('drops results for entity types the caller cannot view', () => {
+    const filtered = filterSearchResultsByEntityAccess(results, lookup, {
+      grantedFeatures: ['search.global', 'customers.people.view'],
+    })
+
+    expect(filtered.map((r) => r.recordId)).toEqual(['person-1', 'person-2'])
+  })
+
+  it('returns nothing when the caller holds only search.global', () => {
+    expect(
+      filterSearchResultsByEntityAccess(results, lookup, { grantedFeatures: ['search.global'] }),
+    ).toEqual([])
+  })
+
+  it('returns everything for a superadmin', () => {
+    expect(
+      filterSearchResultsByEntityAccess(results, lookup, {
+        grantedFeatures: [],
+        isSuperAdmin: true,
+      }),
+    ).toHaveLength(results.length)
+  })
+
+  it('reports each denied entity type once, not once per result', () => {
+    const denied: string[] = []
+    filterSearchResultsByEntityAccess(
+      results,
+      lookup,
+      { grantedFeatures: ['catalog.products.view'] },
+      { onDeny: (entityId) => denied.push(entityId) },
+    )
+
+    expect(denied).toEqual(['customers:customer_person_profile', 'wms:warehouse'])
+  })
+})

package/src/modules/search/__tests__/global-search-acl.test.ts

@@ -0,0 +1,112 @@
+import { readFileSync, readdirSync, existsSync } from 'node:fs'
+import { join } from 'node:path'
+import { setup } from '../setup'
+import features from '../acl'
+
+describe('global search ACL contract', () => {
+  it('gates GET /api/search/search/global on the same feature the topbar renders on', () => {
+    // BackendHeaderChrome renders TopbarSearchInline on `search.global`. When the
+    // endpoint enforced the search-administration feature `search.view` instead, a
+    // role holding one but not the other either saw a box that 403'd on every
+    // keystroke or could query the endpoint with no UI (issue #5163).
+    //
+    // The route's metadata is asserted from source rather than by importing it,
+    // because importing the route pulls the whole request container (and its
+    // cross-package runtime deps) into this unit test.
+    const source = readFileSync(join(__dirname, '..', 'api', 'search', 'global', 'route.ts'), 'utf8')
+    const requireFeatures = source.match(/GET: \{ requireAuth: true, requireFeatures: \[([^\]]*)\] \}/)
+
+    expect(requireFeatures).not.toBeNull()
+    expect(requireFeatures?.[1]).toBe("'search.global'")
+  })
+
+  it('keeps both search.view and search.global declared — ACL feature IDs are frozen', () => {
+    const ids = features.map((feature) => feature.id)
+    expect(ids).toContain('search.view')
+    expect(ids).toContain('search.global')
+  })
+
+  it('grants employees the palette but not search administration', () => {
+    const employee = setup.defaultRoleFeatures?.employee ?? []
+    expect(employee).toContain('search.global')
+    expect(employee).not.toContain('search.view')
+    expect(employee).not.toContain('search.manage')
+    expect(employee).not.toContain('search.reindex')
+    expect(employee).not.toContain('search.*')
+  })
+})
+
+// Drift guard for the class of bug fixed in #5163: the single `search.global` gate
+// says a caller may use search, not which records they may read. Every searchable
+// entity therefore has to name the owning module's view feature in `aclFeatures`,
+// or the global-search route fails closed and its results silently disappear.
+describe('searchable entity ACL coverage', () => {
+  const repoRoot = join(__dirname, '..', '..', '..', '..', '..', '..')
+
+  function readEntityBlock(file: string, entityId: string): string {
+    const source = readFileSync(file, 'utf8')
+    const start = source.indexOf(`      entityId: '${entityId}',`)
+    expect(start).toBeGreaterThan(-1)
+    const nextEntity = source.indexOf('\n    {', start + 1)
+    return source.slice(start, nextEntity === -1 ? undefined : nextEntity)
+  }
+
+  function findSearchConfigFiles(): string[] {
+    const roots = [
+      join(repoRoot, 'packages', 'core', 'src', 'modules'),
+      join(repoRoot, 'packages', 'checkout', 'src', 'modules'),
+    ].filter((dir) => existsSync(dir))
+
+    return roots.flatMap((root) =>
+      readdirSync(root, { withFileTypes: true })
+        .filter((entry) => entry.isDirectory())
+        .map((entry) => join(root, entry.name, 'search.ts'))
+        .filter((file) => existsSync(file)),
+    )
+  }
+
+  const files = findSearchConfigFiles()
+
+  it('finds the module search configs to check', () => {
+    expect(files.length).toBeGreaterThan(5)
+  })
+
+  it.each(files)('%s declares aclFeatures for every searchable entity', (file) => {
+    const source = readFileSync(file, 'utf8')
+    // Entity configs are the six-space-indented `entityId:` entries of the config's
+    // top-level `entities` array. Helper functions above it also build objects with
+    // an `entityId` key, so the scan starts at the array and matches on indentation.
+    const entitiesArrayStart = source.search(/^ {2}entities: \[$/m)
+    expect(entitiesArrayStart).toBeGreaterThan(-1)
+    const entitiesArray = source.slice(entitiesArrayStart)
+
+    const declaredEntities = [...entitiesArray.matchAll(/^ {6}entityId: (.+),$/gm)].map((m) => m[1])
+    const declaredAclFeatures = [...entitiesArray.matchAll(/^ {6}aclFeatures: \[/gm)].length
+
+    expect(declaredEntities.length).toBeGreaterThan(0)
+    expect(declaredAclFeatures).toBe(declaredEntities.length)
+  })
+
+  it('uses the offer read-route feature for catalog offer results', () => {
+    const offer = readEntityBlock(
+      join(repoRoot, 'packages', 'core', 'src', 'modules', 'catalog', 'search.ts'),
+      'catalog:catalog_offer',
+    )
+
+    expect(offer).toContain("aclFeatures: ['sales.channels.manage']")
+  })
+
+  it('keeps record-scoped and polymorphic entities disabled until search can enforce their row access', () => {
+    const messages = join(repoRoot, 'packages', 'core', 'src', 'modules', 'messages', 'search.ts')
+    const sales = join(repoRoot, 'packages', 'core', 'src', 'modules', 'sales', 'search.ts')
+    const unsafeEntities = [
+      readEntityBlock(messages, 'messages:message'),
+      readEntityBlock(sales, 'sales:sales_note'),
+      readEntityBlock(sales, 'sales:sales_document_address'),
+    ]
+
+    for (const entity of unsafeEntities) {
+      expect(entity).toContain('enabled: false')
+    }
+  })
+})

package/src/modules/search/ai-tools.ts

@@ -5,6 +5,11 @@ import type {
   SearchStrategyId,
 } from '@open-mercato/shared/modules/search'
 import { authorizeFeatures } from '@open-mercato/shared/security/featurePolicy'
+import {
+  filterSearchResultsByEntityAccess,
+  resolveReadableEntityTypes,
+  type SearchEntityConfigLookup,
+} from './lib/entity-access'
 
 /**
  * AI Tools definitions for the Search module.
@@ -54,12 +59,11 @@ type AiToolDefinition = {
 
 /**
  * Minimal shape of the `searchIndexer` DI service consumed by the per-entity
- * ACL / field-policy resolution below. Kept local to avoid importing the full
- * `SearchIndexer` class into the tool module.
+ * ACL / field-policy resolution below. Aliased rather than redeclared so the
+ * tools and the global-search route cannot drift apart, and still narrow enough
+ * to avoid importing the full `SearchIndexer` class into the tool module.
  */
-type SearchIndexerLike = {
-  getEntityConfig: (entityId: string) => SearchEntityConfig | undefined
-}
+type SearchIndexerLike = SearchEntityConfigLookup
 
 class SearchToolAuthorizationError extends Error {
   constructor(message: string) {
@@ -187,14 +191,27 @@ Searches customers, products, orders, deals, and more in one call.`,
       search: (query: string, options: any) => Promise<SearchResult[]>
     }>('searchService')
 
-    const results = await searchService.search(input.query, {
+    // Same rule the HTTP palette applies: `search.global` authorizes using search,
+    // not reading every indexed entity type. The query is narrowed to the readable
+    // types so `limit` is not spent on records that would be filtered out, and the
+    // results are filtered afterwards as defense in depth.
+    const searchIndexer = ctx.container.resolve<SearchIndexerLike>('searchIndexer')
+    const subject = { grantedFeatures: ctx.userFeatures, isSuperAdmin: ctx.isSuperAdmin }
+    const readableEntityTypes = resolveReadableEntityTypes(searchIndexer, subject, input.entityTypes)
+    if (readableEntityTypes && readableEntityTypes.length === 0) {
+      return { query: input.query, totalResults: 0, results: [] }
+    }
+
+    const rawResults = await searchService.search(input.query, {
       tenantId: ctx.tenantId,
       organizationId: ctx.organizationId,
-      entityTypes: input.entityTypes,
+      entityTypes: readableEntityTypes,
       strategies: input.strategies as SearchStrategyId[],
       limit: input.limit,
     })
 
+    const results = filterSearchResultsByEntityAccess(rawResults, searchIndexer, subject)
+
     return {
       query: input.query,
       totalResults: results.length,

package/src/modules/search/api/__tests__/global-search.routes.test.ts

@@ -70,6 +70,76 @@ function createStrategy(source: SearchStrategyId, recordId: string): SearchStrat
   }
 }
 
+/**
+ * The route resolves `rbacService` and `searchIndexer` to drop results whose entity
+ * type the caller has no view feature for (issue #5163), so the container mock has
+ * to answer for both.
+ */
+function createContainer(
+  searchService: SearchService,
+  configMap: Map<EntityId, SearchEntityConfig>,
+  acl: { features: string[]; isSuperAdmin?: boolean },
+) {
+  const registrations: Record<string, unknown> = {
+    searchService,
+    searchIndexer: {
+      getEntityConfig: (entityId: string) => configMap.get(entityId as EntityId),
+      getAllEntityConfigs: () => [...configMap.values()],
+    },
+    rbacService: {
+      loadAcl: async () => ({
+        isSuperAdmin: acl.isSuperAdmin ?? false,
+        features: acl.features,
+        organizations: null,
+      }),
+    },
+  }
+  return {
+    hasRegistration: (name: string) => name in registrations,
+    resolve: jest.fn((name: string) => registrations[name]),
+    dispose: jest.fn().mockResolvedValue(undefined),
+  }
+}
+
+function buildDemoSearchService() {
+  const rows = ['fulltext-record', 'vector-record', 'tokens-record'].map((recordId) => ({
+    entity_type: DEMO_ENTITY_ID,
+    entity_id: recordId,
+    doc: { id: recordId, title: recordId },
+  }))
+  const config: SearchEntityConfig = {
+    entityId: DEMO_ENTITY_ID,
+    enabled: true,
+    aclFeatures: ['demo.view'],
+    formatResult: async (context) => {
+      const { t } = await resolveTranslations()
+      return {
+        title: String(context.record.title),
+        badge: t('demo.search.badge', 'Person'),
+      }
+    },
+    resolveLinks: async (context) => {
+      const { t } = await resolveTranslations()
+      return [{
+        href: `/backend/demo/${String(context.record.id)}`,
+        label: t('demo.search.link.open', 'Open person'),
+        kind: 'primary',
+      }]
+    },
+  }
+  const configMap = new Map<EntityId, SearchEntityConfig>([[DEMO_ENTITY_ID, config]])
+  const searchService = new SearchService({
+    strategies: [
+      createStrategy('fulltext', 'fulltext-record'),
+      createStrategy('vector', 'vector-record'),
+      createStrategy('tokens', 'tokens-record'),
+    ],
+    defaultStrategies: ['fulltext', 'vector', 'tokens'],
+    presenterEnricher: createPresenterEnricher(createDatabase(rows), configMap),
+  })
+  return { searchService, configMap }
+}
+
 describe('GET /api/search/search/global presenter localization', () => {
   beforeAll(() => {
     registerModules([
@@ -106,46 +176,10 @@ describe('GET /api/search/search/global presenter localization', () => {
   })
 
   it('replaces frozen presenters and links for fulltext, vector, and tokens using Accept-Language', async () => {
-    const rows = ['fulltext-record', 'vector-record', 'tokens-record'].map((recordId) => ({
-      entity_type: DEMO_ENTITY_ID,
-      entity_id: recordId,
-      doc: { id: recordId, title: recordId },
-    }))
-    const config: SearchEntityConfig = {
-      entityId: DEMO_ENTITY_ID,
-      enabled: true,
-      formatResult: async (context) => {
-        const { t } = await resolveTranslations()
-        return {
-          title: String(context.record.title),
-          badge: t('demo.search.badge', 'Person'),
-        }
-      },
-      resolveLinks: async (context) => {
-        const { t } = await resolveTranslations()
-        return [{
-          href: `/backend/demo/${String(context.record.id)}`,
-          label: t('demo.search.link.open', 'Open person'),
-          kind: 'primary',
-        }]
-      },
-    }
-    const configMap = new Map<EntityId, SearchEntityConfig>([[DEMO_ENTITY_ID, config]])
-    const presenterEnricher = createPresenterEnricher(createDatabase(rows), configMap)
-    const searchService = new SearchService({
-      strategies: [
-        createStrategy('fulltext', 'fulltext-record'),
-        createStrategy('vector', 'vector-record'),
-        createStrategy('tokens', 'tokens-record'),
-      ],
-      defaultStrategies: ['fulltext', 'vector', 'tokens'],
-      presenterEnricher,
-    })
-    const container = {
-      resolve: jest.fn((name: string) => (name === 'searchService' ? searchService : undefined)),
-      dispose: jest.fn().mockResolvedValue(undefined),
-    }
-    mockCreateRequestContainer.mockResolvedValue(container)
+    const { searchService, configMap } = buildDemoSearchService()
+    mockCreateRequestContainer.mockResolvedValue(
+      createContainer(searchService, configMap, { features: ['search.global', 'demo.view'] }),
+    )
 
     const request = new Request('http://localhost/api/search/search/global?q=person', {
       headers: { 'accept-language': 'pl-PL' },
@@ -165,3 +199,85 @@ describe('GET /api/search/search/global presenter localization', () => {
     }
   })
 })
+
+describe('GET /api/search/search/global per-entity access control', () => {
+  beforeEach(() => {
+    jest.clearAllMocks()
+    mockGetAuthFromRequest.mockResolvedValue({
+      tenantId: 'tenant-1',
+      orgId: 'org-1',
+      sub: 'user-1',
+      isSuperAdmin: false,
+    })
+    mockResolveOrganizationScopeForRequest.mockResolvedValue({
+      selectedId: 'org-1',
+      filterIds: ['org-1'],
+      allowedIds: ['org-1'],
+      tenantId: 'tenant-1',
+    })
+  })
+
+  async function search(acl: { features: string[]; isSuperAdmin?: boolean }) {
+    const { searchService, configMap } = buildDemoSearchService()
+    mockCreateRequestContainer.mockResolvedValue(createContainer(searchService, configMap, acl))
+    const response = await GET(new Request('http://localhost/api/search/search/global?q=person'))
+    return {
+      status: response.status,
+      body: await response.json() as { results: SearchResult[]; strategiesUsed: SearchStrategyId[] },
+    }
+  }
+
+  it('withholds results for entity types the caller cannot view', async () => {
+    // `search.global` alone opens the palette; it must not expose presenter titles,
+    // subtitles or deep links for records the caller has no view feature for.
+    const { status, body } = await search({ features: ['search.global'] })
+
+    expect(status).toBe(200)
+    expect(body.results).toEqual([])
+    expect(body.strategiesUsed).toEqual([])
+  })
+
+  it('returns results once the caller holds the entity view feature', async () => {
+    const { status, body } = await search({ features: ['search.global', 'demo.view'] })
+
+    expect(status).toBe(200)
+    expect(body.results).toHaveLength(3)
+  })
+
+  it('narrows the query to the readable entity types instead of only filtering afterwards', async () => {
+    // Filtering after the fact would spend `limit` on unreadable records and leave
+    // the palette looking empty, so the restriction has to reach the strategies.
+    const { searchService, configMap } = buildDemoSearchService()
+    const searchSpy = jest.spyOn(searchService, 'search')
+    mockCreateRequestContainer.mockResolvedValue(
+      createContainer(searchService, configMap, { features: ['search.global', 'demo.view'] }),
+    )
+
+    await GET(new Request('http://localhost/api/search/search/global?q=person'))
+
+    expect(searchSpy).toHaveBeenCalledTimes(1)
+    const options = searchSpy.mock.calls[0][1] as { entityTypes?: string[] }
+    expect(options.entityTypes).toEqual([DEMO_ENTITY_ID])
+  })
+
+  it('skips the search entirely when the caller can read nothing', async () => {
+    const { searchService, configMap } = buildDemoSearchService()
+    const searchSpy = jest.spyOn(searchService, 'search')
+    mockCreateRequestContainer.mockResolvedValue(
+      createContainer(searchService, configMap, { features: ['search.global'] }),
+    )
+
+    const response = await GET(new Request('http://localhost/api/search/search/global?q=person'))
+
+    expect(response.status).toBe(200)
+    expect(searchSpy).not.toHaveBeenCalled()
+    expect((await response.json() as { results: SearchResult[] }).results).toEqual([])
+  })
+
+  it('returns results for a superadmin without any explicit grant', async () => {
+    const { status, body } = await search({ features: [], isSuperAdmin: true })
+
+    expect(status).toBe(200)
+    expect(body.results).toHaveLength(3)
+  })
+})

package/src/modules/search/api/__tests__/org-scoping.routes.test.ts

@@ -93,8 +93,18 @@ describe('Search API organizationId scoping', () => {
     const searchService = {
       search: jest.fn().mockResolvedValue([]),
     }
+    // The global route also resolves rbacService + searchIndexer to filter results
+    // by per-entity view features (issue #5163).
+    const registrations: Record<string, unknown> = {
+      searchService,
+      searchIndexer: { getEntityConfig: () => undefined, getAllEntityConfigs: () => [] },
+      rbacService: {
+        loadAcl: jest.fn().mockResolvedValue({ isSuperAdmin: true, features: ['*'], organizations: null }),
+      },
+    }
     const container = {
-      resolve: jest.fn((name: string) => (name === 'searchService' ? searchService : undefined)),
+      hasRegistration: (name: string) => name in registrations,
+      resolve: jest.fn((name: string) => registrations[name]),
       dispose: jest.fn(),
     }
     mockCreateRequestContainer.mockResolvedValue(container)

package/src/modules/search/api/search/global/route.ts

@@ -8,11 +8,31 @@ import type { SearchService } from '@open-mercato/search'
 import type { EmbeddingService } from '../../../../../vector'
 import { resolveEmbeddingConfig } from '../../../lib/embedding-config'
 import { resolveGlobalSearchStrategies } from '../../../lib/global-search-config'
-import { searchError } from '../../../../../lib/debug'
+import {
+  filterSearchResultsByEntityAccess,
+  resolveReadableEntityTypes,
+  type SearchEntityConfigLookup,
+} from '../../../lib/entity-access'
+import { searchDebug, searchError } from '../../../../../lib/debug'
 import { globalSearchOpenApi } from '../../openapi'
 
+/**
+ * `search.global` — the same feature the topbar gates the Cmd+K palette on
+ * (`BackendHeaderChrome`). It used to be `search.view`, which is the
+ * search-administration feature guarding the settings endpoints; the two gates
+ * could disagree in either direction, so a role holding only one of them either
+ * saw a search box that 403'd on every keystroke or could query the endpoint with
+ * no UI. `search.view` stays on `api/settings/**`, where it belongs.
+ */
 export const metadata = {
-  GET: { requireAuth: true, requireFeatures: ['search.view'] },
+  GET: { requireAuth: true, requireFeatures: ['search.global'] },
+}
+
+type RbacLike = {
+  loadAcl: (
+    userId: string,
+    scope: { tenantId: string | null; organizationId: string | null },
+  ) => Promise<{ isSuperAdmin: boolean; features: string[]; organizations: string[] | null }>
 }
 
 function parseLimit(value: string | null): number {
@@ -64,6 +84,21 @@ export async function GET(req: Request) {
       )
     }
 
+    // Fail closed: without the RBAC service or the entity registry there is no way
+    // to tell which entity types this caller may read, so refuse rather than search.
+    if (!container.hasRegistration('rbacService') || !container.hasRegistration('searchIndexer')) {
+      searchError('search.api.global', 'entity-acl-unavailable', {
+        rbacService: container.hasRegistration('rbacService'),
+        searchIndexer: container.hasRegistration('searchIndexer'),
+      })
+      return NextResponse.json(
+        { error: t('search.api.errors.serviceUnavailable', 'Search service unavailable') },
+        { status: 503 }
+      )
+    }
+    const rbac = container.resolve('rbacService') as RbacLike
+    const searchIndexer = container.resolve('searchIndexer') as SearchEntityConfigLookup
+
     // Fetch saved global search strategies (per-tenant; falls back to the instance default)
     const strategies = await resolveGlobalSearchStrategies(container, { scope: { tenantId: auth.tenantId } })
 
@@ -97,16 +132,50 @@ export async function GET(req: Request) {
     const scopeFilter = resolveOrganizationScopeFilter(scope, auth)
     const organizationId =
       typeof scope.selectedId === 'string' && scope.selectedId.trim().length > 0 ? scope.selectedId.trim() : undefined
+
+    // `search.global` authorizes using the palette, not reading every indexed
+    // record. Narrow the query to the entity types this caller may read so the
+    // result budget is not spent on records that would only be filtered out.
+    const acl = await rbac.loadAcl(auth.sub, {
+      tenantId: scope.tenantId ?? auth.tenantId ?? null,
+      organizationId: organizationId ?? null,
+    })
+    const subject = { grantedFeatures: acl.features, isSuperAdmin: acl.isSuperAdmin }
+    const readableEntityTypes = resolveReadableEntityTypes(searchIndexer, subject, entityTypes)
+    if (readableEntityTypes && readableEntityTypes.length === 0) {
+      return NextResponse.json({
+        results: [],
+        strategiesUsed: [],
+        strategiesEnabled: strategies,
+        timing: Date.now() - startTime,
+        query,
+        limit,
+      })
+    }
+
     const searchOptions = {
       tenantId: auth.tenantId,
       organizationId,
       organizationIds: scopeFilter.organizationIds,
       limit,
       strategies,
-      entityTypes,
+      entityTypes: readableEntityTypes,
     }
 
-    const results = await searchService.search(query, searchOptions)
+    const rawResults = await searchService.search(query, searchOptions)
+
+    // Defense in depth: a strategy that ignores `entityTypes` must still not leak
+    // a presenter title, subtitle or deep link past the per-entity gate.
+    const results = filterSearchResultsByEntityAccess(
+      rawResults,
+      searchIndexer,
+      { grantedFeatures: acl.features, isSuperAdmin: acl.isSuperAdmin },
+      {
+        onDeny: (deniedEntityId, reason) => {
+          searchDebug('search.api.global', 'entity-filtered', { entityId: deniedEntityId, reason })
+        },
+      },
+    )
 
     const timing = Date.now() - startTime