add support for hidden collections parameter for applying auth

[philvarner]

Related Issue(s):

• #863

Proposed Changes:

1. add "hidden" parameter _collections for restricting visible collections, for example, in a proxy

PR Checklist:

• I have added my changes to the CHANGELOG or a CHANGELOG entry is not required.

[tylanderson]

Tested and was able to confirm behavior working as expected. Only question here would be if this should be controlled through a param to allow deployments to enable / disable this behavior as it's non-standard

[Copilot]

Copilot reviewed 17 out of 18 changed files in this pull request and generated 1 comment.

Files not reviewed (1)

• package.json: Language not supported

Comments suppressed due to low confidence (1)

src/lib/api.js:517

• [nitpick] Consider clarifying or removing the 'TODO' comment to explicitly state the intended behavior for encoding the collections parameter in pagination links once finalized.

} else if (p === 'collections') { // TODO

[Copilot]

Using the string 'not true' to disable the collections filtering may be error-prone; consider using a clear boolean string ('true' to enable and 'false' to disable) or resetting the variable after the test to prevent side effects.

Suggested change

	process.env['ENABLE_COLLECTIONS_AUTHX'] = 'not true'
	process.env['ENABLE_COLLECTIONS_AUTHX'] = 'false'