medplum / medplum / 24866494626

92%

push

github

Enforce Project.exportedResourceType on cached reads (#9031)

Repository.canPerformInteraction only checked project-compartment
membership, so a read with a Redis cache hit could return a resource
from a linked project even when its type was not in that project's
exportedResourceType. The SQL path (addProjectFilters) already applies
this filter, so the two paths disagreed.

Mirror the same carve-outs (primary project, current project, Project
resource type, empty/missing export list) in canPerformInteraction and
add a regression test that warms the cache via the linked project's
repo, then asserts the non-exported type is not readable.

Made-with: Cursor

18426 of 20989 branches covered (87.79%)

Branch coverage included in aggregate %.

4 of 4 new or added lines in 1 file covered. (100.0%)

33329 of 35367 relevant lines covered (94.24%)

13508.6 hits per line