[snyaggarwal]

Access-control leftovers from OpenConceptLab/ocl_online#488.

Users

• Counts on user detail and summary (orgs, owned_orgs, sources, collections) cover only what the requester can view; the user and staff still see all. bookmarks is shown to the user and staff only.
• A user's own following list keeps follows of objects they can no longer view, with object: null, so they can unfollow them.
• /users/<u>/following/?q= no longer runs a user search.
• extras is hidden from anonymous requesters on verbose user lists and on the single-user detail, matching /users/<u>/extras/, which needs sign-in.
• includeInactive is staff only, for lists and for q= search. The user index gains is_active to support this.

Pins

• /users/<u>/pins/ is readable by that user and staff only, matching includePins. Org pins are unchanged.

Concept hierarchy

• Requests with includeParentConceptURLs, includeChildConceptURLs, includeHierarchyPath or includeSummary skip the shared repo version list cache, as includeParentConcepts and includeChildConcepts already did, since their responses differ per requester.
• parent_concept_urls, child_concept_urls, includeHierarchyPath, the parents and children list URLs, the summary counts and the source hierarchy/ endpoint include only concepts the requester can view.
• Repo version exports list only parent and child concepts from the same source, plus public ones.

Repos and collections

• can_view_all_content refuses instead of raising for a user-owned private repo checked for another user. It also follows has_view_access for a public version of a private HEAD, so a collection expansion no longer takes that version's content for a reference creator who lost access.
• includeResolvedRepoVersions drops resolved repo versions the requester can't view (also the resolve debug view).
• Creating a source no longer links other repos' mappings to it by canonical URL, unless the canonical URL resolves to that source.

Events

• Event lists leave out events whose object or referenced object the requester can no longer view: an org, a repo, a repo version, or content in a repo.
• The check runs in the events query itself, with subqueries for private orgs and repos, so its cost doesn't grow with the feed's history. It reads the repo from each URL by position, so a repo named concepts or mappings is classified correctly.

GraphQL

• Scoped text search filters on owner and source by exact name, and a HEAD search finds latest versions, so results are no longer empty or mixed with other owners' sources.
• Global search lists each concept once.

Other bugs

• /user/map-projects/ is limited to the current user.
• ?csv=true&q= without type no longer returns a 500. On Elasticsearch-searched lists it exports the search's hits, like type (at most 100); lists that apply q in the database keep their export, up to 1,000 rows. A search with no hits gives an empty file instead of a 500.
• The non-verbose map-project list CSV no longer crashes. The verbose CSV keeps every column, as before.

Behaviour changes for clients (TBv3 is prepared by OpenConceptLab/oclweb3#101, which should deploy first)

• User pins return 401/403 to other requesters.
• bookmarks is hidden on other users' profiles.
• extras is hidden from anonymous requesters on user lists and user detail.
• Canonical-URL linking when a source is created needs the URL to resolve to that source (through the URL registry where it's on), so some links are no longer made at create time.
• User summaries count all of a user's sources and collections for that user and staff, like the detail view.
• A user's own following list can contain object: null.

Deploy: rebuild the user_profiles index once. Until then, accounts deactivated earlier still show in user search.

Note for #897: this changes core/graphql/queries.py, so that PR needs a rebase.

🤖 Generated with Claude Code

[snyaggarwal]

Verdict: changes requested. The two inline P2 findings should be addressed before merge. GitHub does not allow a formal “Request changes” review on my own PR.

Verification: the focused users/events/GraphQL run passed 83 of 84 tests. test_fetch_concepts_global_search also failed alone under --keepdb; its shared Elasticsearch index and common search term make that result inconclusive for this PR. The new GraphQL search regression test passed alone.