fix(strix): include search authorization context

[seonghobae]

Summary

• add bounded trusted-base authorization context when a PR changes frontend/src/components/SearchLayout.tsx or frontend/src/app/search/page.tsx
• include the same-origin BFF, signed-session auth, owner-scoped search and ontology routes, persistence model, and service files needed to verify the real user and organization boundary
• keep the changed frontend file sourced from the PR head while unchanged context comes from the validated base; exclude unrelated backend source
• add contract cases for both SearchLayout and the search page trigger

Security rationale

The prior Strix scope could inspect a client result identifier without seeing the server-side signed-session and owner-scoped authorization chain, producing ungrounded IDOR and CSRF claims. This change supplies only the bounded cross-layer context required to verify that boundary. It does not broaden PR-head trust or allow unrelated source into the scan.

Validation

• bash scripts/ci/test_strix_quick_gate.sh — PASS, full suite
• focused SearchLayout scope case — PASS
• focused search-page scope case — PASS
• python3 -m pytest -q — 795 passed
• coverage — 795 passed, 100.00% (6407 statements, 0 missed)
• python3 -m ruff check . — PASS
• interrogate — 100%
• bash -n scripts/ci/strix_quick_gate.sh scripts/ci/test_strix_quick_gate.sh — PASS
• shellcheck -x -S warning scripts/ci/strix_quick_gate.sh scripts/ci/test_strix_quick_gate.sh — PASS
• actionlint .github/workflows/strix.yml — PASS
• git diff --check — PASS
• post-edit CodeGraph caller and blast-radius review — PASS

Closes #695

Summary by CodeRabbit

• 테스트
  • 프런트엔드 검색 기능 변경 시 관련 인증·검색 의존성 범위를 함께 검증하도록 CI 테스트를 강화했습니다.
  • 검색과 무관한 파일이 포함되거나 변경 내용이 잘못 노출되는 경우를 감지합니다.

[coderabbitai]

Warning

Review limit reached

@opencode-agent[bot], you've reached your PR review limit, so we couldn't start this review.

Next review available in: 23 minutes

Enable usage-based reviews in Billing to review now. Otherwise, wait until the next included review is available.
You're only billed for reviews past your plan's rate limits ($0.25/file).

How can I continue?

After more reviews become available, a review can be triggered using the @coderabbitai review command as a PR comment. Alternatively, push new commits to this PR.

To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based reviews.

How do review limits work?

CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan review availability.

For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, additional reviews become available more gradually as earlier reviews age out of the rolling window.

Please refer docs for additional details.

Review details

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: 2eff23df-d096-4ff7-8606-7b832d3b5ac0

📥 Commits

Reviewing files that changed from the base of the PR and between b920874 and 6cadd38.

📒 Files selected for processing (2)

• scripts/ci/strix_quick_gate.sh
• scripts/ci/test_strix_quick_gate.sh

📝 Walkthrough

Walkthrough

프런트엔드 검색 UI 변경 감지를 추가했습니다. 검색·인증 관련 파일을 PR 스코프에 포함합니다. PR-head와 base 컨텍스트 사용 및 무관한 파일 제외를 검증하는 테스트를 추가하고 실행 경로에 연결했습니다.

Changes

프런트엔드 검색 컨텍스트

Layer / File(s)	Summary
검색 컨텍스트 선택 및 스코프 구성 scripts/ci/strix_quick_gate.sh	검색 레이아웃과 검색 페이지 변경을 감지합니다. 인증, 검색, 온톨로지, 데이터 모델, BFF, 세션, 쿠키 및 API 클라이언트 파일을 스코프에 추가합니다.
검색 컨텍스트 스코프 회귀 검증 scripts/ci/test_strix_quick_gate.sh	검색 UI 변경에 대한 필터 및 전체 실행 테스트를 추가합니다. PR-head 파일, base 의존성, 무관한 파일 제외를 검증합니다.

Estimated code review effort: 3 (Moderate) | ~20 minutes

Suggested reviewers: claude

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	제목은 검색 인증 컨텍스트를 Strix 스캔에 포함하는 핵심 변경을 정확하고 간결하게 설명합니다.
Linked Issues check	✅ Passed	변경 사항은 SearchLayout 검색 컨텍스트, 인증·검색 의존성, 신뢰된 base와 PR head 처리, 회귀 테스트 요구를 충족합니다.
Out of Scope Changes check	✅ Passed	스크립트 변경과 테스트 추가는 연결된 이슈의 Strix 검색 인증 컨텍스트 및 검증 범위에 포함됩니다.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.

✨ Finishing Touches

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch codex/strix-search-auth-context

---

_{Comment @coderabbitai help to get the list of available commands.}

[seonghobae]

@coderabbitai review

[coderabbitai]

✅ Action performed

Review finished.

Note: CodeRabbit is an incremental review system and does not re-review already reviewed commits. This command is applicable only when automatic reviews are paused.

[coderabbitai]

Actionable comments posted: 1

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@scripts/ci/strix_quick_gate.sh`:
- Around line 1274-1288: Update the needs_frontend_search_api_context file list
in strix_quick_gate.sh to include frontend/src/app/search/page.tsx alongside
SearchLayout.tsx. Also add the same search route file to the context_files list
in test_strix_quick_gate.sh, preserving the existing entries and ordering
conventions.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: 6b47e2f2-a28e-47b1-9011-a51f7dd1e65b

📥 Commits

Reviewing files that changed from the base of the PR and between 2a83043 and b920874.

📒 Files selected for processing (2)

• scripts/ci/strix_quick_gate.sh
• scripts/ci/test_strix_quick_gate.sh

[seonghobae]

@coderabbitai full review

[coderabbitai]

✅ Action performed

Full review finished.

---

Your included review limit is currently reached under our Fair Usage Limits Policy. This review may still proceed through usage-based billing if eligible. Your next included review will be available in 46 minutes.

[seonghobae]

@coderabbitai review

[coderabbitai]

✅ Action performed

Review finished.

Note: CodeRabbit is an incremental review system and does not re-review already reviewed commits. This command is applicable only when automatic reviews are paused.

[seonghobae]

Closing to drain stale central checks. The bounded search-authorization context rule remains in the consolidated post-#731 replay queue and should be replayed unchanged in intent from repaired current main.