fix(search): admit the search POST at read level through a declared, frozen readOverPost

src/app/api/search/__tests__/route.test.ts

@@ -111,7 +111,10 @@ beforeEach(() => {
 describe("POST /api/search", () => {
   it("admits the whole record only, at read", async () => {
     await handler(request("q=schulter"));
-    expect(mocks.requireRecordAuth).toHaveBeenCalledWith("read", "record");
+    // A POST that only reads, declared as such.
+    expect(mocks.requireRecordAuth).toHaveBeenCalledWith("read", "record", {
+      readOverPost: true,
+    });
   });
 
   it("propagates a refused admission without searching", async () => {

src/app/api/search/route.ts

@@ -56,7 +56,11 @@ function displayLocale(value: string | null | undefined): Locale {
 }
 
 export const POST = apiHandler(async (request: NextRequest) => {
-  const { user, actor, grantId } = await requireRecordAuth("read", "record");
+  // A POST that only reads: the query rides the body to stay out of URLs, and
+  // a read grant on the whole record is what it needs, as it was over GET.
+  const { user, actor, grantId } = await requireRecordAuth("read", "record", {
+    readOverPost: true,
+  });
 
   const rl = await checkRateLimit(
     `search:${actor.id}`,