Show users only their own data and open projects

[Navid Gholizadeh (ngholiza)]

Why

A signed-in user should see their own projects and data plus open (public) projects, and nothing beyond that. The data-access audit (ledger #90) found places in the web app and the AI assistant that showed more.

What changes

Area	Before	After
Uploads (list, attachments, process)	Everyone in the same organization (nearly all "Purdue University")	Only the uploader and admins; others get 404. The DB3 pilot keeps its shared queue
Data card	Statistics over every project's runs	Only runs the user can see (row-level security)
Dataset snapshots	Any user (platform-wide counts)	Admins only
Upload template	No visibility check	Same visibility as the equipment page; 404 otherwise
Equipment connection host/port/database	Everyone who can see the equipment	Owner, maintainers and admins (registered and legacy configs)
Equipment run counts / last data date	Platform-wide	Only runs the user can see (admins: platform-wide)
ML importance and proposals	Could use the model trained on all projects	That model only for an admin viewing all projects; everyone else gets a fit on their visible runs
ML response cache	Kept results up to 6 h after access was lost	Key includes the user's visible projects and a fingerprint of their visible runs
System/ingestion token check	!=	hmac.compare_digest; empty expected token never matches
resolve_request_user	Unused, trusted an unverified bearer value	Removed
AI assistant	Snapshots offered to everyone	Snapshots admin-only; tool descriptions match what they return

Closed-loop and other system jobs are unchanged.

Second commit: Navid's decisions

Area	Before	After
Unit-experiment templates marked Private	Visible to the owner's whole organization	Owner; readers of a project that uses it; anyone who can read an experiment built on it
Execution queue	Equipment owners saw requests for all of their organization's equipment	Only equipment the user owns or is a trusted maintainer of (admins: all). Maintainers of any role now get the page

Changed in both the API and the row-level security functions (app_experiment_type_readable, app_manages_equipment). New GET /admin/execution-queue/access tells the web menu whether to show the queue.

Kept as is (decided OK): draft publication requests visible to readers of open projects; /ml/status showing the global model's size and metrics.

Tests

• New api/tests/test_data_scoping.py: 26 tests; 15 of the first 18 fail on the old code.
• Full API suite: 547 passed, 101 skipped. One failure, test_rcac_gateway, also fails on dev without these changes. 4 modules can't be collected locally (missing pymatgen/rcac_runner/PG env).
• Web: type check, lint and 21 unit tests pass.
• Codex review: first commit approved on round 2, second commit approved on round 2.
• Postgres-backed tests (row-level security integration and others) run against a disposable local postgres:15: 94 passed, including new tests for private templates, owner/maintainer queue access and the ML cache signature query. The data card, uploads list and scoped equipment counts were also run on it. The template filter was also checked with row-level security bypassed.

Deploy

Run the migration Job first: add_row_level_security.sql changed, and the migration re-applies it (by checksum). Then rebuild dt-api (and the retrain cronjob image) and dt-web.

🤖 Generated with Claude Code