Universal search MVP

Search SyRF provides one authenticated entry point for project discovery, project-scoped study citations, permitted destinations and curated help topics. It opens studies read-only, without acquiring review sessions or reservations. Existing study filters and project discovery remain available.

Scope and UX

The header button and Ctrl/Cmd+K open a dialog, full-height on compact screens. Where and What are separate controls. The initial scope follows the current study, then the current project, otherwise all accessible work. The interface states the coverage of each scope and never broadens a query implicitly.

Where	Search coverage
All accessible work	Discoverable project names, keywords and exact IDs; Projects/My account navigation; curated help titles and keywords. Studies require selecting a project.
Selected project	Study title, abstract, publication names and keywords through the existing Mongo text index, or exact study UUID; permitted project destinations; help.
Current study	The freshly authorized citation, including abstract and bibliographic identifiers; help. No PDF text, annotation or decision search.

What filters projects, studies, navigation/settings or help independently of Where. Study results show author/year/journal and project context. Selecting a study opens its citation within the dialog; Back preserves the search. Navigation closes the dialog before routing so existing unsaved-work guards retain control. Help opens through the configured user-guide URL. Arrow keys move between result buttons, Enter activates the focused result, and Escape restores trigger focus.

Use existing Roboto typography, navy shell and Material semantic colour roles. No unpublished component package or new design-system dependency is required.

Architecture and permissions

Angular loads the dialog lazily. A dialog-scoped signal store debounces queries, cancels superseded requests and clears results before a replacement request. Closing the dialog destroys its state. Identity changes and disabling the flag close it. No persisted query history or raw-query telemetry is introduced.

The API separates discovery, project study search, citation retrieval and permitted destinations. Responses use minimal bibliographic DTOs, never full study objects. List results omit abstract payloads. Reads carry no-store headers.

Project candidates reuse existing discovery semantics, then pass the authority gateway before names, counts or pagination are returned. Study endpoints require ViewStudies; View is not a content grant. Destinations evaluate their specific activities (ViewStudies, Edit, Design, EditMemberships). Application administrator roles do not bypass enforced project authority. The gateway retains its existing legacy/shadow/enforced rollout behaviour. An unavailable authority check fails closed with 503 rather than an empty or partially authorized success.

Study queries bind both project and study IDs where applicable and exclude reversibly deleted records. Citation opening performs another authorized read. Search never invokes review, reservation, upload or mutation APIs.

Queries are capped at 200 characters, pages at 20 and offsets at 1000. Study Mongo queries have a three-second maximum. Discovery responses have a five-second deadline; the legacy summary repository does not accept cancellation, so its underlying read can outlive a timed-out request. Client group requests have a seven-second timeout and independent failure messages. The discovery deadline test advances an injected clock across the five-second boundary while the repository stays pending, so CI scheduling delays cannot race the deadline assertion.

Acceptance and validation

The minimum usable journey is discover project → search its studies → inspect a citation, with permissions applied at every step. The small navigation and help catalogues support this journey without introducing another index.

Required validation covers denied discovery records before paging, authority unavailability, flag on/off/on, bounded queries, deletion and cross-project exclusion, stable pages, stale-response cancellation, citation permission recheck, keyboard/focus behaviour and compact layout. Serialization goldens cover the new API response roots. The preview uses synthetic data only; it is not evidence of live-backend end-to-end behaviour or production latency.

Component tests exercise the visible search trigger and dialog: keyboard entry, identity/flag withdrawal, scope and paging changes, citation retry/back, focus movement, and closing before navigation. Store tests cover cancellation, timeouts, independent group failures and public/member project destinations.

SYRF__FeatureFlags__UniversalSearch defaults off on both server and client via the generated flag mapping and runtime catalogue. No database migration or production activation is part of this PR. See the reproducible preview instructions in e2e/harness/universal-search/README.md.

Ordered progressive enhancements

1. Measure project discovery cardinality and Mongo explain plans on representative synthetic datasets. Replace whole-catalogue materialization with a bounded projected query if measurements justify it; propagate cancellation into the shared repository separately.
2. Specify and add normalized DOI/custom-ID and author matching for project-wide queries. These fields are displayed now but are not in the existing text index.
3. Add stage/systematic-search destinations and application-admin navigation only with explicit capability and route contracts. Expand help through a generated title index before considering document full text.
4. Add cross-project study search after bounded authorization, pagination, revocation and query-plan measurements demonstrate an acceptable design.
5. Consider PDF or annotation search only after defining content visibility, indexing/deletion lifecycle and review-blinding requirements. Relevance tuning, autocomplete and saved history require separate demand and privacy decisions.

Do not introduce a separate search service before these measurements establish that the existing API and Mongo implementation are insufficient.