fix(knowledge): read result metadata under the scope the results were read under

Retrieval reports the scope its content was read under — with the live grants it resolved, when a gated source's candidate was read — and the metadata lookup applies the full read predicate under that scope. A gated source's result keeps its name and URL; a revoked one loses them here as it did at hydration.

Author: waleedlatif1

apps/sim/app/api/v1/knowledge/search/route.test.ts

@@ -54,7 +54,12 @@ vi.mock('@/lib/knowledge/access/availability', () => ({
 }))
 
 vi.mock('@/lib/knowledge/search/queries', () => ({
-  executeKnowledgeSearch: mockExecuteKnowledgeSearch,
+  /** The route reads the retrieval result; the rows come from the same mock the tests drive. */
+  retrieveKnowledgeSearch: async (params: { access: unknown }) => ({
+    rows: await mockExecuteKnowledgeSearch(params),
+    retrieval: { status: 'complete', timedOutLegs: [] },
+    readAccess: params.access,
+  }),
   getDocumentMetadataByIds: mockGetDocumentMetadataByIds,
 }))
 

apps/sim/app/api/v1/knowledge/search/route.ts

@@ -16,8 +16,9 @@ import {
 } from '@/lib/knowledge/embeddings'
 import { resolveKnowledgeSearchDefaults } from '@/lib/knowledge/search/defaults'
 import {
-  executeKnowledgeSearch,
   getDocumentMetadataByIds,
+  type KnowledgeRetrievalResult,
+  retrieveKnowledgeSearch,
   type SearchResult,
 } from '@/lib/knowledge/search/queries'
 import { getDocumentTagDefinitions } from '@/lib/knowledge/tags/service'
@@ -226,7 +227,7 @@ export const POST = withRouteHandler(async (request: NextRequest) => {
         }
       : undefined
 
-    let results: SearchResult[]
+    let retrieved: KnowledgeRetrievalResult
     let queryEmbeddingIsBYOK: boolean | null = null
     const [readAccess, { searchMode, boostRecency }] = await Promise.all([
       resolveV1KnowledgeReadAccess(userId, rateLimit, workspaceId),
@@ -242,7 +243,7 @@ export const POST = withRouteHandler(async (request: NextRequest) => {
     const access = 'get' in readAccess ? await readAccess.get() : readAccess
 
     if (!hasQuery && hasFilters) {
-      results = await executeKnowledgeSearch({
+      retrieved = await retrieveKnowledgeSearch({
         knowledgeBaseIds: accessibleKbIds,
         topK,
         access,
@@ -258,7 +259,7 @@ export const POST = withRouteHandler(async (request: NextRequest) => {
         workspaceId
       )
       queryEmbeddingIsBYOK = queryEmbeddingResult.isBYOK
-      results = await executeKnowledgeSearch({
+      retrieved = await retrieveKnowledgeSearch({
         knowledgeBaseIds: accessibleKbIds,
         topK,
         access,
@@ -311,8 +312,9 @@ export const POST = withRouteHandler(async (request: NextRequest) => {
       tagDefinitionsMap[kbId] = map
     })
 
+    const results = retrieved.rows
     const documentIds = results.map((r) => r.documentId)
-    const documentMetadataMap = await getDocumentMetadataByIds(documentIds, access)
+    const documentMetadataMap = await getDocumentMetadataByIds(documentIds, retrieved.readAccess)
     const readableResults = results.filter((result) => documentMetadataMap[result.documentId])
 
     return NextResponse.json({

apps/sim/lib/knowledge/application/search.test.ts

@@ -96,6 +96,7 @@ vi.mock('@/lib/knowledge/search/queries', () => ({
   retrieveKnowledgeSearch: async (...args: unknown[]) => ({
     rows: await mocks.executeSearch(...args),
     retrieval: mocks.retrieval(),
+    readAccess: (args[0] as { access: unknown }).access,
   }),
   getDocumentMetadataByIds: mocks.getDocumentMetadata,
 }))

apps/sim/lib/knowledge/application/search.ts

@@ -625,7 +625,7 @@ const searchKnowledgeUseCase = defineAuthorizedKnowledgeUseCase({
     const basicDocumentMetadata = await measureSearchStage('metadata', () =>
       getDocumentMetadataByIds(
         rows.map((row) => row.documentId),
-        access
+        retrieved.readAccess
       )
     )
     const results = rows

apps/sim/lib/knowledge/search/queries.test.ts

@@ -647,6 +647,7 @@ describe('workspace-scoped vector retrieval', () => {
       ).toEqual({
         rows: [],
         retrieval: { status: 'partial', timedOutLegs: ['vector'] },
+        readAccess: params.access,
       })
     }
   )
@@ -743,6 +744,7 @@ describe('workspace-scoped vector retrieval', () => {
       expect(result).toEqual({
         rows: [],
         retrieval: { status: 'partial', timedOutLegs: ['vector'] },
+        readAccess: params.access,
       })
     }
     for (const resume of release) resume()

apps/sim/lib/knowledge/search/queries.ts

@@ -174,11 +174,11 @@ export interface DocumentMetadata {
 }
 
 /**
- * Batch-fetch display metadata for documents referenced by search results.
- * Applies the same visibility and access predicates as the search SQL itself,
- * so the lookup never surfaces a filename for a row the caller could not have
- * matched. Returns a map keyed by document id; missing ids indicate the
- * document is no longer visible and should be skipped.
+ * Batch-fetch display metadata for documents referenced by search results, under the full read
+ * predicate and the scope the results were read under — with the live grants that scope resolved,
+ * so a gated source's result keeps its name and URL, and a revoked one loses them here too.
+ * Returns a map keyed by document id; missing ids indicate the document is no longer visible and
+ * should be skipped.
  */
 export async function getDocumentMetadataByIds(
   documentIds: string[],
@@ -206,7 +206,7 @@ export async function getDocumentMetadataByIds(
           eq(document.userExcluded, false),
           isNull(document.archivedAt),
           isNull(document.deletedAt),
-          knowledgeMetadataCandidateAccessCondition(access)
+          knowledgeAccessCondition(access)
         )
       )
   )
@@ -598,6 +598,8 @@ export interface LiveSourceAccess {
   gates: (connectorId: string) => boolean
   /** The caller's scope with its grants, and the gated sources those grants do not cover. */
   resolve: () => Promise<{ access: KnowledgeAccessScope; denied: ReadonlySet<string> }>
+  /** The scope content was read under: with its grants once they were resolved, else as given. */
+  current: () => Promise<KnowledgeAccessScope>
 }
 
 /** Binds a search's gated sources to one memoized resolution of the caller's grants. */
@@ -619,6 +621,7 @@ export function liveSourceAccessFor(
   }
   return {
     gates: (connectorId) => gated.has(connectorId),
+    current: async () => (pending ? (await pending).access : access),
     resolve: () => {
       pending ??= measureSearchStage('live_source_grants', async () => {
         const scopes = await mapWithConcurrency(pages, SOURCE_RANKING_CONCURRENCY, (page) =>
@@ -2055,6 +2058,8 @@ export interface RetrievalStatus {
 export interface KnowledgeRetrievalResult {
   rows: SearchResult[]
   retrieval: RetrievalStatus
+  /** The scope the returned content was read under; what may see these rows may see their metadata. */
+  readAccess: KnowledgeAccessScope
 }
 
 /** Legacy surfaces cannot silently present partial retrieval as complete. */
@@ -2090,14 +2095,16 @@ export async function retrieveKnowledgeSearch(
     keyword: new SearchBudget('keyword', deadline, params.signal),
     tags: new SearchBudget('tags', deadline, params.signal),
   }
-  const finish = (rows: SearchResult[]): KnowledgeRetrievalResult => {
+  const finish = async (rows: SearchResult[]): Promise<KnowledgeRetrievalResult> => {
     params.signal?.throwIfAborted()
+    const readAccess = (await liveSourceAccess?.current()) ?? access
     const timedOutLegs = Object.values(budgets)
       .filter((budget) => budget.timedOut)
       .map((budget) => budget.leg)
     return {
       rows: boostRecency ? applyRecencyBoost(rows) : rows,
       retrieval: { status: timedOutLegs.length ? 'partial' : 'complete', timedOutLegs },
+      readAccess,
     }
   }
   /**