feat: improved permissions and CVE-2025-64712 fix

[MODSetter]

Description

Motivation and Context

FIX #

Screenshots

API Changes

• This PR includes API changes

Change Type

• Bug fix
• New feature
• Performance improvement
• Refactoring
• Documentation
• Dependency/Build system
• Breaking change
• Other (specify):

Testing Performed

• Tested locally
• Manual/QA verification

Checklist

• Follows project coding standards and conventions
• Documentation updated as needed
• Dependencies updated as needed
• No lint/build errors or new warnings
• All relevant tests are passing

High-level PR Summary

This PR implements a role-based access control (RBAC) system for public chat sharing with new public_sharing:view, public_sharing:create, and public_sharing:delete permissions. The changes include a database migration to add these permissions to existing Editor and Viewer roles, refactoring of the public chat snapshot service to enforce permission checks using RBAC instead of ownership-only checks, a new settings page for managing public chat snapshots at the search space level, and a comprehensive frontend implementation with permission-aware UI components. Additionally, the PR updates unstructured and unstructured-client dependencies and renames API schemas from Snapshot* to PublicChatSnapshot* for improved clarity.

⏱️ Estimated Review Time: 30-90 minutes

💡 Review Order Suggestion

Order	File Path
1	surfsense_backend/alembic/versions/90_add_public_sharing_permissions_to_roles.py
2	surfsense_backend/app/db.py
3	surfsense_backend/app/services/public_chat_service.py
4	surfsense_backend/app/routes/new_chat_routes.py
5	surfsense_backend/app/routes/search_spaces_routes.py
6	surfsense_backend/app/schemas/new_chat.py
7	surfsense_backend/pyproject.toml
8	surfsense_web/lib/query-client/cache-keys.ts
9	surfsense_web/contracts/types/chat-threads.types.ts
10	surfsense_web/lib/apis/chat-threads-api.service.ts
11	surfsense_web/atoms/public-chat-snapshots/public-chat-snapshots-query.atoms.ts
12	surfsense_web/atoms/public-chat-snapshots/public-chat-snapshots-mutation.atoms.ts
13	surfsense_web/atoms/chat/chat-thread-mutation.atoms.ts
14	surfsense_web/components/public-chat-snapshots/public-chat-snapshots-empty-state.tsx
15	surfsense_web/components/public-chat-snapshots/public-chat-snapshot-row.tsx
16	surfsense_web/components/public-chat-snapshots/public-chat-snapshots-list.tsx
17	surfsense_web/components/public-chat-snapshots/public-chat-snapshots-manager.tsx
18	surfsense_web/components/public-chat/public-chat-not-found.tsx
19	surfsense_web/components/public-chat/public-chat-view.tsx
20	surfsense_web/components/new-chat/chat-share-button.tsx
21	surfsense_web/app/dashboard/[search_space_id]/settings/page.tsx
22	surfsense_web/app/dashboard/[search_space_id]/team/page.tsx
23	surfsense_web/messages/en.json
24	surfsense_web/messages/zh.json

⚠️ Inconsistent Changes Detected

File Path	Warning
surfsense_backend/pyproject.toml	Dependency version updates for unstructured packages seem unrelated to the permissions and security fix described in the PR title

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
surf-sense-frontend	Ready	Preview, Comment	Feb 3, 2026 9:33pm

[recurseml]

Review by RecurseML

🔍 Review performed on e172983..2b1d33d

✨ No bugs found, your code is sparkling clean

✅ Files analyzed, no issues (24)

• surfsense_backend/alembic/versions/90_add_public_sharing_permissions_to_roles.py
• surfsense_backend/app/db.py
• surfsense_backend/app/routes/new_chat_routes.py
• surfsense_backend/app/routes/search_spaces_routes.py
• surfsense_backend/app/schemas/new_chat.py
• surfsense_backend/app/services/public_chat_service.py
• surfsense_backend/pyproject.toml
• surfsense_web/app/dashboard/[search_space_id]/settings/page.tsx
• surfsense_web/app/dashboard/[search_space_id]/team/page.tsx
• surfsense_web/atoms/chat/chat-thread-mutation.atoms.ts
• surfsense_web/atoms/public-chat-snapshots/public-chat-snapshots-mutation.atoms.ts
• surfsense_web/atoms/public-chat-snapshots/public-chat-snapshots-query.atoms.ts
• surfsense_web/components/new-chat/chat-share-button.tsx
• surfsense_web/components/public-chat-snapshots/public-chat-snapshot-row.tsx
• surfsense_web/components/public-chat-snapshots/public-chat-snapshots-empty-state.tsx
• surfsense_web/components/public-chat-snapshots/public-chat-snapshots-list.tsx
• surfsense_web/components/public-chat-snapshots/public-chat-snapshots-manager.tsx
• surfsense_web/components/public-chat/public-chat-not-found.tsx
• surfsense_web/components/public-chat/public-chat-view.tsx
• surfsense_web/contracts/types/chat-threads.types.ts
• surfsense_web/lib/apis/chat-threads-api.service.ts
• surfsense_web/lib/query-client/cache-keys.ts
• surfsense_web/messages/en.json
• surfsense_web/messages/zh.json

⏭️ Files skipped (1)

Locations
surfsense_backend/uv.lock