fix(search): only search record kinds the caller may read

search:read alone returned apiary names, colony and queen codes, task
titles and batch numbers to roles without the matching read permission.
Each kind of result is now searched only when apiaries:read,
colonies:read, queens:read, tasks:read or honey-batches:read is held.
The search term is validated (string, at most 100 characters).

Co-Authored-By: Claude Opus 5.5 (1M context) <[email protected]>

ApiCore-Backend/src/search/search.service.spec.ts

@@ -1,6 +1,14 @@
 import { SearchService } from './search.service';
 import { PrismaService } from '../prisma/prisma.service';
 
+const ALL_READ: ReadonlySet<string> = new Set([
+  'apiaries:read',
+  'colonies:read',
+  'queens:read',
+  'tasks:read',
+  'honey-batches:read',
+]);
+
 describe('SearchService', () => {
   let service: SearchService;
   let prisma: {
@@ -23,7 +31,7 @@ describe('SearchService', () => {
   });
 
   it('returns an empty array for a blank query', async () => {
-    const results = await service.search('   ');
+    const results = await service.search('   ', ALL_READ);
     expect(results).toEqual([]);
     expect(prisma.apiary.findMany).not.toHaveBeenCalled();
   });
@@ -36,7 +44,7 @@ describe('SearchService', () => {
       { id: 'apiary-1', name: 'Heimstand' },
     ]);
 
-    const results = await service.search('V-001');
+    const results = await service.search('V-001', ALL_READ);
 
     expect(results).toEqual(
       expect.arrayContaining([
@@ -45,4 +53,14 @@ describe('SearchService', () => {
       ]),
     );
   });
+
+  it('searches only the kinds of records the caller may read', async () => {
+    await service.search('V-001', new Set(['colonies:read']));
+
+    expect(prisma.colony.findMany).toHaveBeenCalled();
+    expect(prisma.apiary.findMany).not.toHaveBeenCalled();
+    expect(prisma.queen.findMany).not.toHaveBeenCalled();
+    expect(prisma.task.findMany).not.toHaveBeenCalled();
+    expect(prisma.honeyBatch.findMany).not.toHaveBeenCalled();
+  });
 });