fix(auth): gate the search surface on read:search instead of basic (#13739) to release v4.5 (#13740)

Co-authored-by: Justin Tahara <105671973+justin-tahara@users.noreply.github.com>

Author: onyx-cherry-pick[bot]

backend/ee/onyx/server/query_and_chat/search_backend.py

@@ -52,7 +52,7 @@
 @router.post("/search-flow-classification")
 def search_flow_classification(
     request: SearchFlowClassificationRequest,
-    _: User = Depends(require_permission(Permission.BASIC_ACCESS)),
+    _: User = Depends(require_permission(Permission.READ_SEARCH)),
     db_session: Session = Depends(get_session),
 ) -> SearchFlowClassificationResponse:
     query = request.user_query
@@ -92,7 +92,7 @@ def search_flow_classification(
 )
 def handle_send_search_message(
     request: SendSearchQueryRequest,
-    user: User = Depends(require_permission(Permission.BASIC_ACCESS)),
+    user: User = Depends(require_permission(Permission.READ_SEARCH)),
     db_session: Session = Depends(get_session),
 ) -> StreamingResponse | SearchFullResponse:
     """
@@ -142,7 +142,7 @@ def stream_generator() -> Generator[str, None, None]:
 def get_search_history(
     limit: int = 100,
     filter_days: int | None = None,
-    user: User = Depends(require_permission(Permission.BASIC_ACCESS)),
+    user: User = Depends(require_permission(Permission.READ_SEARCH)),
     db_session: Session = Depends(get_session),
 ) -> SearchHistoryResponse:
     """

backend/onyx/server/features/web_search/api.py

@@ -231,7 +231,7 @@ def _open_urls(
 @router.post("/search", response_model=WebSearchWithContentResponse)
 def execute_web_search(
     request: WebSearchToolRequest,
-    _: User = Depends(require_permission(Permission.BASIC_ACCESS)),
+    _: User = Depends(require_permission(Permission.READ_SEARCH)),
     db_session: Session = Depends(get_session),
 ) -> WebSearchWithContentResponse:
     """
@@ -274,7 +274,7 @@ def execute_web_search(
 @router.post("/search-lite", response_model=WebSearchToolResponse)
 def execute_web_search_lite(
     request: WebSearchToolRequest,
-    _: User = Depends(require_permission(Permission.BASIC_ACCESS)),
+    _: User = Depends(require_permission(Permission.READ_SEARCH)),
     db_session: Session = Depends(get_session),
 ) -> WebSearchToolResponse:
     """
@@ -290,7 +290,7 @@ def execute_web_search_lite(
 @router.post("/open-urls", response_model=OpenUrlsToolResponse)
 def execute_open_urls(
     request: OpenUrlsToolRequest,
-    _: User = Depends(require_permission(Permission.BASIC_ACCESS)),
+    _: User = Depends(require_permission(Permission.READ_SEARCH)),
     db_session: Session = Depends(get_session),
 ) -> OpenUrlsToolResponse:
     """

backend/onyx/server/query_and_chat/query_backend.py

@@ -87,7 +87,7 @@ def get_tags(
     sources: list[DocumentSource] | None = None,
     allow_prefix: bool = True,  # This is currently the only option
     limit: int = 50,
-    _: User = Depends(require_permission(Permission.BASIC_ACCESS)),
+    _: User = Depends(require_permission(Permission.READ_SEARCH)),
     db_session: Session = Depends(get_session),
 ) -> TagResponse:
     if not allow_prefix:

backend/tests/unit/onyx/server/test_search_surface_scopes.py

@@ -0,0 +1,55 @@
+"""
+Pins the search surface's route gates to READ_SEARCH so a read:search-scoped
+PAT can reach every endpoint the scope's description promises ("Use search and
+query endpoints"). Scoped PATs can never satisfy BASIC_ACCESS (implication
+only flows basic -> read:search), so a route in this surface regressing to
+BASIC_ACCESS silently locks out scoped tokens while unscoped ones still work.
+"""
+
+import inspect
+from collections.abc import Callable
+from typing import Any
+
+import pytest
+
+from ee.onyx.server.query_and_chat.search_backend import (
+    get_search_history,
+    handle_send_search_message,
+    search_flow_classification,
+)
+from onyx.db.enums import Permission
+from onyx.server.features.web_search.api import (
+    execute_open_urls,
+    execute_web_search,
+    execute_web_search_lite,
+)
+from onyx.server.query_and_chat.query_backend import get_tags
+
+_SEARCH_SURFACE_HANDLERS: list[Callable[..., Any]] = [
+    handle_send_search_message,
+    get_search_history,
+    search_flow_classification,
+    get_tags,
+    execute_web_search,
+    execute_web_search_lite,
+    execute_open_urls,
+]
+
+
+def _permission_gates(handler: Callable[..., Any]) -> list[Permission | None]:
+    gates: list[Permission | None] = []
+    for param in inspect.signature(handler).parameters.values():
+        dependency = getattr(param.default, "dependency", None)
+        if dependency is not None and getattr(
+            dependency, "_is_require_permission", False
+        ):
+            gates.append(getattr(dependency, "_required_permission", None))
+    return gates
+
+
+@pytest.mark.parametrize("handler", _SEARCH_SURFACE_HANDLERS, ids=lambda h: h.__name__)
+def test_search_surface_route_admits_read_search_scope(
+    handler: Callable[..., Any],
+) -> None:
+    gates = _permission_gates(handler)
+    assert gates == [Permission.READ_SEARCH]