fix: allow public access to search API for frontend LiveSearch by mvanhorn · Pull Request #107 · emdash-cms/emdash

mvanhorn · 2026-04-02T14:51:34Z

What does this PR do?

The /_emdash/api/search and /_emdash/api/search/suggest endpoints require search:read permission, returning 401 for unauthenticated requests. The LiveSearch component hardcodes these endpoints, so frontend search is broken for public visitors.

Removed the requirePerm(user, "search:read") check and its import from both search/index.ts and search/suggest.ts. Also removed the unused user destructuring from locals.

This is safe because searchWithDb and getSuggestions both default to status: "published" (search/query.ts:71), so unauthenticated visitors only see published content. Admin search routes (rebuild, enable, stats) still require search:manage.

Matches the pattern of other public-facing routes like comments/[collection]/[contentId] and widget-components that work without auth.

Closes #104

Type of change

Checklist

I have read CONTRIBUTING.md
pnpm typecheck passes
pnpm --silent lint:json | jq '.diagnostics | length' returns 0
pnpm test passes (or targeted tests for my change)
pnpm format has been run
I have added/updated tests for my changes (if applicable)
I have added a changeset (if this PR changes a published package)
New features link to an approved Discussion: https://github.com/emdash-cms/emdash/discussions/...

AI-generated code disclosure

This PR includes AI-generated code

Screenshots / test output

pnpm typecheck passes
pnpm test:unit passes (2095 tests)

The search and suggest endpoints required search:read permission, blocking unauthenticated visitors from using the LiveSearch component. This is safe because the search query layer defaults to status=published, so public users only see published content. Fixes emdash-cms#104

changeset-bot · 2026-04-02T14:51:39Z

🦋 Changeset detected

Latest commit: 3e9dd3b

The changes in this PR will be included in the next version bump.

This PR includes changesets to release 9 packages

Name	Type
emdash	Patch
@emdash-cms/cloudflare	Patch
@emdash-cms/plugin-ai-moderation	Patch
@emdash-cms/plugin-atproto	Patch
@emdash-cms/plugin-audit-log	Patch
@emdash-cms/plugin-color	Patch
@emdash-cms/plugin-embeds	Patch
@emdash-cms/plugin-forms	Patch
@emdash-cms/plugin-webhook-notifier	Patch

Not sure what this means? Click here to learn what changesets are.

Click here if you're a maintainer who wants to add another changeset to this PR

ascorbic

Thanks!

pkg-pr-new · 2026-04-05T07:56:39Z

Open in StackBlitz

@emdash-cms/admin

npm i https://pkg.pr.new/@emdash-cms/admin@107

@emdash-cms/auth

npm i https://pkg.pr.new/@emdash-cms/auth@107

@emdash-cms/blocks

npm i https://pkg.pr.new/@emdash-cms/blocks@107

@emdash-cms/cloudflare

npm i https://pkg.pr.new/@emdash-cms/cloudflare@107

emdash

npm i https://pkg.pr.new/emdash@107

create-emdash

npm i https://pkg.pr.new/create-emdash@107

@emdash-cms/gutenberg-to-portable-text

npm i https://pkg.pr.new/@emdash-cms/gutenberg-to-portable-text@107

@emdash-cms/x402

npm i https://pkg.pr.new/@emdash-cms/x402@107

@emdash-cms/plugin-ai-moderation

npm i https://pkg.pr.new/@emdash-cms/plugin-ai-moderation@107

@emdash-cms/plugin-atproto

npm i https://pkg.pr.new/@emdash-cms/plugin-atproto@107

@emdash-cms/plugin-audit-log

npm i https://pkg.pr.new/@emdash-cms/plugin-audit-log@107

@emdash-cms/plugin-color

npm i https://pkg.pr.new/@emdash-cms/plugin-color@107

@emdash-cms/plugin-embeds

npm i https://pkg.pr.new/@emdash-cms/plugin-embeds@107

@emdash-cms/plugin-forms

npm i https://pkg.pr.new/@emdash-cms/plugin-forms@107

@emdash-cms/plugin-webhook-notifier

npm i https://pkg.pr.new/@emdash-cms/plugin-webhook-notifier@107

commit: 3e9dd3b

mvanhorn · 2026-04-05T17:17:33Z

Updated the PR description to use the required template - "Validate PR" check should pass now. Let me know if a changeset is needed for this.

ascorbic · 2026-04-06T06:42:26Z

Thanks. Yes, a changeset is needed for anything that affects published packages. This fixes a bug, so would be a patch change

JULJERYT · 2026-04-06T12:54:21Z

is this changeset ok?

---
"emdash": patch
---

Allow public access to search API

Patch bump for emdash - allows public access to search API endpoints. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

mvanhorn · 2026-04-06T14:34:54Z

Added changeset (patch bump for emdash) in fa8e5bd.

mvanhorn · 2026-04-07T04:17:11Z

Appreciate the merge, @ascorbic. Happy to contribute more to emdash.

PR emdash-cms#107 removed the handler-level `requirePerm()` check from the search endpoints, but the auth middleware still returned 401 before the handlers ran because `/_emdash/api/search` was not in `PUBLIC_API_EXACT`. The handler-level changes therefore never executed for anonymous callers, and the shipped `LiveSearch` component (which fetches without credentials) silently showed "No results found" on every query. This change adds `/_emdash/api/search` to `PUBLIC_API_EXACT` so the middleware lets anonymous GET requests reach the handler. The query layer already hardcodes `status='published'`, so anonymous callers still only see published content. Admin endpoints (`/enable`, `/rebuild`, `/stats`, and `/suggest`) remain authenticated because they are not in the set. The existing E2E test `"search endpoint requires authentication"` asserted the buggy behavior and is replaced with two new tests: one verifying public access to `/_emdash/api/search`, and one verifying that `/stats` and `/enable` remain gated. Closes emdash-cms#104. Follows up on emdash-cms#107. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

#424) PR #107 removed the handler-level `requirePerm()` check from the search endpoints, but the auth middleware still returned 401 before the handlers ran because `/_emdash/api/search` was not in `PUBLIC_API_EXACT`. The handler-level changes therefore never executed for anonymous callers, and the shipped `LiveSearch` component (which fetches without credentials) silently showed "No results found" on every query. This change adds `/_emdash/api/search` to `PUBLIC_API_EXACT` so the middleware lets anonymous GET requests reach the handler. The query layer already hardcodes `status='published'`, so anonymous callers still only see published content. Admin endpoints (`/enable`, `/rebuild`, `/stats`, and `/suggest`) remain authenticated because they are not in the set. The existing E2E test `"search endpoint requires authentication"` asserted the buggy behavior and is replaced with two new tests: one verifying public access to `/_emdash/api/search`, and one verifying that `/stats` and `/enable` remain gated. Closes #104. Follows up on #107. Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com> Co-authored-by: Matt Kane <mkane@cloudflare.com>

emdash-cms#424) PR emdash-cms#107 removed the handler-level `requirePerm()` check from the search endpoints, but the auth middleware still returned 401 before the handlers ran because `/_emdash/api/search` was not in `PUBLIC_API_EXACT`. The handler-level changes therefore never executed for anonymous callers, and the shipped `LiveSearch` component (which fetches without credentials) silently showed "No results found" on every query. This change adds `/_emdash/api/search` to `PUBLIC_API_EXACT` so the middleware lets anonymous GET requests reach the handler. The query layer already hardcodes `status='published'`, so anonymous callers still only see published content. Admin endpoints (`/enable`, `/rebuild`, `/stats`, and `/suggest`) remain authenticated because they are not in the set. The existing E2E test `"search endpoint requires authentication"` asserted the buggy behavior and is replaced with two new tests: one verifying public access to `/_emdash/api/search`, and one verifying that `/stats` and `/enable` remain gated. Closes emdash-cms#104. Follows up on emdash-cms#107. Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com> Co-authored-by: Matt Kane <mkane@cloudflare.com>

mvanhorn mentioned this pull request Apr 2, 2026

Search API requires authentication, preventing frontend search #104

Closed

github-actions Bot added the needs-approval label Apr 5, 2026

Merge branch 'main' into osc/104-public-search-api

d7704e3

ascorbic approved these changes Apr 5, 2026

View reviewed changes

github-actions Bot added area/core size/S labels Apr 5, 2026

github-actions Bot removed the needs-approval label Apr 5, 2026

github-actions Bot added the cla: signed label Apr 6, 2026

JULJERYT approved these changes Apr 6, 2026

View reviewed changes

fix: add changeset for public search API access

fa8e5bd

Patch bump for emdash - allows public access to search API endpoints. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

Merge branch 'main' into osc/104-public-search-api

3e9dd3b

ascorbic approved these changes Apr 6, 2026

View reviewed changes

ascorbic enabled auto-merge (squash) April 6, 2026 19:56

ascorbic merged commit b297fdd into emdash-cms:main Apr 6, 2026
25 checks passed

emdashbot Bot mentioned this pull request Apr 6, 2026

ci: release #124

Merged

emdashbot Bot mentioned this pull request Apr 8, 2026

ci: release #396

Closed

csfalcao mentioned this pull request Apr 10, 2026

fix(middleware): allow public access to search API (#104) #424

Merged

16 tasks

emdashbot Bot mentioned this pull request Apr 12, 2026

ci: release #486

Merged

Navigation Menu

Uh oh!

fix: allow public access to search API for frontend LiveSearch - #107

fix: allow public access to search API for frontend LiveSearch#107
ascorbic merged 4 commits into
emdash-cms:mainfrom
mvanhorn:osc/104-public-search-api

mvanhorn commented Apr 2, 2026 •

edited

Loading

changeset-bot Bot commented Apr 2, 2026 •

edited

Loading

ascorbic left a comment

pkg-pr-new Bot commented Apr 5, 2026 •

edited

Loading

mvanhorn commented Apr 5, 2026

ascorbic commented Apr 6, 2026

JULJERYT commented Apr 6, 2026

mvanhorn commented Apr 6, 2026

Uh oh!

mvanhorn commented Apr 7, 2026

Labels

3 participants

Uh oh!

Conversation

mvanhorn commented Apr 2, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

What does this PR do?

Type of change

Checklist

AI-generated code disclosure

Screenshots / test output

changeset-bot Bot commented Apr 2, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

🦋 Changeset detected

ascorbic left a comment

Choose a reason for hiding this comment

pkg-pr-new Bot commented Apr 5, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

mvanhorn commented Apr 5, 2026

ascorbic commented Apr 6, 2026

JULJERYT commented Apr 6, 2026

mvanhorn commented Apr 6, 2026

Uh oh!

mvanhorn commented Apr 7, 2026

Labels

3 participants

mvanhorn commented Apr 2, 2026 •

edited

Loading

changeset-bot Bot commented Apr 2, 2026 •

edited

Loading

pkg-pr-new Bot commented Apr 5, 2026 •

edited

Loading