dale053 5a5e766386 fix(api): authorize owner_ids for list chats and search apps (#14775) ...

Closes #14768
### What problem does this PR solve?
The `list_chats` and `list_searches` REST API endpoints did not enforce
authorization on the `owner_ids` query parameter. Any authenticated user
could pass arbitrary tenant IDs to `owner_ids` and retrieve chats or
search apps belonging to other tenants they are not a member of.

This PR resolves the issue by:
1. Looking up the current user's authorized tenants via
`TenantService.get_joined_tenants_by_user_id` and rejecting any
`owner_ids` that fall outside that set.
2. When no `owner_ids` are provided, scoping the query to only the
user's authorized tenants instead of returning an unfiltered result.
3. Adding unit tests that verify unauthorized `owner_ids` are rejected
with `OPERATING_ERROR`.

### Type of change

- [x] Bug Fix (non-breaking change which fixes an issue)

2026-05-13 09:43:44 +08:00

..

test_search_crud.py

fix: support dense_vector from ES fields response (ES 9.x compatibility) (#13972)

2026-04-09 17:44:13 +08:00

test_search_routes_unit.py

fix(api): authorize owner_ids for list chats and search apps (#14775)

2026-05-13 09:43:44 +08:00