[bencap]

Summary

Fixes several places where the Python permission layer let callers learn about private records through search results, status codes or error details. The RLS inventory in #832 turned these up. RLS (#808) keeps the Python checks as a second line of defense, so they need fixing either way.

• Experiment search: the publicationIdentifiers filter used an uncorrelated ScoreSet.publication_identifiers.any(...), which cross-joined scoresets. As a result, every experiment matched whenever any score set, private ones included, cited the publication. The filter now matches through the experiment's own score sets, counting only those the caller can see: published ones, plus the caller's own in /me/experiments/search.
• Collection member routes: adding or removing a score set or experiment now checks READ on the collection, then READ on the member, then the edit permission, and only then whether the association exists. Before, a caller with no access could tell a missing collection from a private one (different 404 details), and could tell whether a private record was linked (409 vs 403/404).
• Score set creation: READ on the experiment, then ADD_SCORE_SET, are now checked before the meta-analysis 409, so another user's private experiment gives the same 404 as a missing one. The supersede 409 names the superseding score set only when the caller can read it, because it may be another contributor's private draft.
• Publication search by database: /publication-identifiers/search/{db_name}/{identifier} used a Python and between two clauses, which silently dropped the db_name filter.

The #832 inventory also lists the identifier list and autocomplete routes, which return identifiers linked only to private records. Those are left to the identifier-table RLS policies that #949 and #960 prepare for, not filtered here.

Behavior changes a reviewer may notice:

• A missing experiment on POST /score-sets/ now returns experiment with URN '<urn>' not found, matching the private case, in place of "The requested experiment does not exist".
• A collection editor can no longer remove a member they can't read. The collection view already hides those members, so the editor never sees them.
• Removing an unlinked member as a non-editor now returns 403, not 409.

Part of #832

Tests

Added regression tests in tests/routers/ for each fix. Each one fails on the old code and passes on this branch:

• test_experiments.py: publication filter, public search and /me search.
• test_collections.py: collection and member probes, add and remove, score sets and experiments.
• test_score_set.py: private meta-analysis experiment; supersede conflict.
• test_publication_identifiers.py: db_name filter.

Ran bin/check and the PR CI set: bin/t tests/ -n 6 -m "not network and not slow" gave 5450 passed, 22 skipped.

Checklist

• Targets the open patch branch if this is a small, non-breaking change, or the cycle's release-<year>.<n>.0
  branch otherwise; never main
• API schema change? A matching mavedb-ui PR regenerates src/schema/openapi.d.ts: no schema change
• Docs and instruction files touched by this change are updated: none affected

[coveralls]

Coverage Report for CI Build 40747011804

Coverage increased (+0.04%) to 90.441%

Details

• Coverage increased (+0.04%) from the base build.
• Patch coverage: 23 of 23 lines across 3 files are fully covered (100%).
• 12 coverage regressions across 3 files.

Uncovered Changes

No uncovered changes found.

Coverage Regressions

12 previously-covered lines in 3 files lost coverage.

File	Lines Losing Coverage	Coverage
src/mavedb/lib/clinvar/utils.py	6	90.91%
src/mavedb/worker/jobs/external_services/clinvar.py	4	96.97%
src/mavedb/lib/mondo_ols.py	2	96.92%

---

Coverage Stats

Relevant Lines:	19227
Covered Lines:	17389
Line Coverage:	90.44%
Coverage Strength:	0.9 hits per line

---

💛 - Coveralls