Create GraphQL service permission archtecture

core/common/permissions.py

@@ -42,16 +42,29 @@ def has_object_permission(self, request, view, obj):
         return False
 
 
-class CanViewConceptDictionary(HasPrivateAccess):
+def user_can_view_concept_dictionary(user, obj) -> bool:
+    """Shared visibility rule for concept-dictionary objects, usable without a DRF request."""
+    if obj.public_access in [ACCESS_TYPE_EDIT, ACCESS_TYPE_VIEW]:
+        return True
+    if user.is_staff:
+        return True
+    if user.is_authenticated:
+        if hasattr(obj, 'parent_id') and user == obj.parent:
+            return True
+        if user.organizations.filter(id=obj.id).exists():
+            return True
+        if hasattr(obj, 'parent_id') and user.organizations.filter(id=obj.parent_id).exists():
+            return True
+    return False
+
+
+class CanViewConceptDictionary(BasePermission):
     """
     The user can view this source
     """
 
     def has_object_permission(self, request, view, obj):
-        if obj.public_access in [ACCESS_TYPE_EDIT, ACCESS_TYPE_VIEW]:
-            return True
-
-        return super().has_object_permission(request, view, obj)
+        return user_can_view_concept_dictionary(request.user, obj)
 
 
 class CanEditConceptDictionary(HasPrivateAccess):

core/common/search.py

@@ -11,6 +11,83 @@
 
 from core.common.constants import ES_REQUEST_TIMEOUT
 from core.common.utils import is_url_encoded_string
+from core.orgs.constants import ORG_OBJECT_TYPE
+from core.users.constants import USER_OBJECT_TYPE
+
+
+def get_document_public_visibility_criteria(
+    user,
+    include_creator_private_access=False,
+    include_owner_private_access=False,
+    include_organization_memberships=False,
+):
+    """Return a shared Elasticsearch visibility criterion for owner-scoped documents.
+
+    The base criterion is always ``public_can_view=True``. Anonymous users get only that.
+    Authenticated users may additionally see private documents matched by the OR of the
+    enabled flags below — each flag widens visibility in a specific way:
+
+    - ``include_creator_private_access``: include private docs where ``created_by`` equals
+      the current user's username. Mirrors the historical REST concept/source-child rule
+      (a creator always sees their own private content). Used by REST list endpoints.
+
+    - ``include_owner_private_access``: include private docs owned by the user itself
+      (``owner_type=USER`` and ``owner=username``). Used by GraphQL to mirror how list APIs
+      expose a user's own private repositories.
+
+    - ``include_organization_memberships``: include private docs owned by any organization
+      the user belongs to (``owner_type=ORG`` and ``owner IN user.orgs``). Used by GraphQL
+      so organization members see private repos belonging to their orgs.
+
+    Flags are independent OR-combined extensions. Staff bypass goes through
+    ``apply_document_public_visibility_filter`` (this helper itself does not check staff).
+    """
+    criteria = Q('term', public_can_view=True)
+    if not getattr(user, 'is_authenticated', False):
+        return criteria
+
+    private_criteria = None
+    username = getattr(user, 'username', None)
+    if username and include_creator_private_access:
+        private_criteria = Q('term', created_by=username)
+
+    if username and include_owner_private_access:
+        owner_criteria = Q('term', owner_type=USER_OBJECT_TYPE) & Q('term', owner=username.lower())
+        private_criteria = owner_criteria if private_criteria is None else private_criteria | owner_criteria
+
+    if include_organization_memberships:
+        organization_mnemonics = [
+            mnemonic.lower() for mnemonic in user.organizations.values_list('mnemonic', flat=True)
+        ]
+        if organization_mnemonics:
+            org_criteria = Q('term', owner_type=ORG_OBJECT_TYPE) & Q('terms', owner=organization_mnemonics)
+            private_criteria = org_criteria if private_criteria is None else private_criteria | org_criteria
+
+    if private_criteria is None:
+        return criteria
+
+    return criteria | (Q('term', public_can_view=False) & private_criteria)
+
+
+def apply_document_public_visibility_filter(
+    search,
+    user,
+    include_creator_private_access=False,
+    include_owner_private_access=False,
+    include_organization_memberships=False,
+):
+    """Apply a shared Elasticsearch visibility filter without changing staff searches."""
+    if getattr(user, 'is_staff', False):
+        return search
+
+    return search.filter(
+        get_document_public_visibility_criteria(
+            user,
+            include_creator_private_access=include_creator_private_access,
+            include_owner_private_access=include_owner_private_access,
+            include_organization_memberships=include_organization_memberships,
+        )
+    )
 
 
 class CustomESFacetedSearch(FacetedSearch):

core/common/views.py

@@ -28,12 +28,20 @@
     CANONICAL_URL_REQUEST_PARAM, CHECKSUMS_PARAM, ACCESS_TYPE_NONE
 from core.common.exceptions import Http400
 from core.common.mixins import PathWalkerMixin
-from core.common.search import CustomESSearch
+from core.common.search import CustomESSearch, get_document_public_visibility_criteria
 from core.common.serializers import RootSerializer
 from core.common.swagger_parameters import all_resource_query_param
 from core.common.throttling import ThrottleUtil
 from core.common.utils import compact_dict_by_values, to_snake_case, parse_updated_since_param, \
     to_int, get_falsy_values, get_truthy_values, format_url_for_search
+from core.concepts.search import (
+    get_concept_exact_search_criterion,
+    get_concept_fuzzy_search_criterion,
+    get_concept_mandatory_exclude_words_criteria,
+    get_concept_mandatory_words_criteria,
+    get_concept_search_rescore,
+    get_concept_wildcard_search_criterion,
+)
 from core.concepts.permissions import CanViewParentDictionary, CanEditParentDictionary
 from core.orgs.constants import ORG_OBJECT_TYPE
 from core.users.constants import USER_OBJECT_TYPE
@@ -292,6 +300,12 @@ def get_sort_attributes(self):
         return result
 
     def get_fuzzy_search_criterion(self, boost_divide_by=10, expansions=5):
+        if self.is_concept_document():
+            return get_concept_fuzzy_search_criterion(
+                self.get_raw_search_string(),
+                boost_divide_by=boost_divide_by,
+                expansions=expansions,
+            )
         return CustomESSearch.get_fuzzy_match_criterion(
             search_str=self.get_search_string(decode=False),
             fields=self.get_fuzzy_search_fields(),
@@ -300,13 +314,23 @@ def get_fuzzy_search_criterion(self, boost_divide_by=10, expansions=5):
         )
 
     def get_wildcard_search_criterion(self, search_str=None):
+        if self.is_concept_document():
+            return get_concept_wildcard_search_criterion(
+                search_str or self.get_raw_search_string(),
+                include_map_codes=self.request.query_params.get(SEARCH_MAP_CODES_PARAM) not in get_falsy_values(),
+            )
         fields = self.get_wildcard_search_fields()
         return CustomESSearch.get_wildcard_match_criterion(
             search_str=search_str or self.get_search_string(),
             fields=fields
         ), fields.keys()
 
     def get_exact_search_criterion(self):
+        if self.is_concept_document():
+            return get_concept_exact_search_criterion(
+                self.get_raw_search_string(),
+                include_map_codes=self.request.query_params.get(SEARCH_MAP_CODES_PARAM) not in get_falsy_values(),
+            )
         match_phrase_field_list = self.document_model.get_match_phrase_attrs()
         match_word_fields_map = self.clean_fields(self.document_model.get_exact_match_attrs())
         fields = match_phrase_field_list + list(match_word_fields_map.keys())
@@ -662,16 +686,19 @@ def is_user_scope(self):
         return False
 
     def get_public_criteria(self):
-        criteria = Q('term', public_can_view=True)
         user = self.request.user
+        criteria = Q('term', public_can_view=True)
 
         if user.is_authenticated:
             username = user.username
             from core.orgs.documents import OrganizationDocument
             if self.document_model in [OrganizationDocument]:
                 criteria |= (Q('term', public_can_view=False) & Q('term', user=username))
             if self.is_concept_container_document_model() or self.is_source_child_document_model():
-                criteria |= (Q('term', public_can_view=False) & Q('term', created_by=username))
+                return get_document_public_visibility_criteria(
+                    user,
+                    include_creator_private_access=True,
+                )
 
         return criteria
 
@@ -884,49 +911,30 @@ def __get_search_results(self, ignore_retired_filter=False, sort=True, highlight
 
         sort_attrs = self._get_sort_attribute()
         if self.is_concept_document() and (not sort_attrs or '_score' in get(sort_attrs, '0', {})):
-            search_str = self.get_search_string(lower=False)
-            results = results.extra(
-                rescore={
-                  "window_size": 400,
-                  "query": {
-                    "score_mode": "total",
-                    "query_weight": 1.0,
-                    "rescore_query_weight": 800.0,
-                    "rescore_query": {
-                      "dis_max": {
-                        "tie_breaker": 0.0,
-                        "queries": [
-                          {
-                            "constant_score": {
-                              "filter": { "term": { "_name": { "value": search_str, "case_insensitive": True } } },
-                              "boost": 10.0
-                            }
-                          },
-                          {
-                            "constant_score": {
-                              "filter": { "term": { "_synonyms": { "value": search_str, "case_insensitive": True } } },
-                              "boost": 8.0
-                            }
-                          }
-                        ]
-                      }
-                    }
-                  }
-                }
-            )
+            results = results.extra(rescore=get_concept_search_rescore(self.get_raw_search_string()))
         if fields and highlight and self.request.query_params.get(INCLUDE_SEARCH_META_PARAM) in get_truthy_values():
             results = results.highlight(*self.clean_fields_for_highlight(fields))
         results = results.source(excludes=['_synonyms_embeddings', '_embeddings'])
         return results.sort(*sort_attrs) if sort else results
 
     def get_mandatory_words_criteria(self):
+        if self.is_concept_document():
+            return get_concept_mandatory_words_criteria(
+                self.get_raw_search_string(),
+                include_map_codes=self.request.query_params.get(SEARCH_MAP_CODES_PARAM) not in get_falsy_values(),
+            )
         criterion = None
         for must_have in CustomESSearch.get_must_haves(self.get_raw_search_string()):
             criteria, _ = self.get_wildcard_search_criterion(f"{must_have}*")
             criterion = criteria if criterion is None else criterion & criteria
         return criterion
 
     def get_mandatory_exclude_words_criteria(self):
+        if self.is_concept_document():
+            return get_concept_mandatory_exclude_words_criteria(
+                self.get_raw_search_string(),
+                include_map_codes=self.request.query_params.get(SEARCH_MAP_CODES_PARAM) not in get_falsy_values(),
+            )
         criterion = None
         for must_not_have in CustomESSearch.get_must_not_haves(self.get_raw_search_string()):
             criteria, _ = self.get_wildcard_search_criterion(f"{must_not_have}*")