medplum / medplum / 24866494626 / 1

92%

main: 92%

push

github

Enforce Project.exportedResourceType on cached reads (#9031)

Repository.canPerformInteraction only checked project-compartment
membership, so a read with a Redis cache hit could return a resource
from a linked project even when its type was not in that project's
exportedResourceType. The SQL path (addProjectFilters) already applies
this filter, so the two paths disagreed.

Mirror the same carve-outs (primary project, current project, Project
resource type, empty/missing export list) in canPerformInteraction and
add a regression test that warms the cache via the linked project's
repo, then asserts the non-exported type is not readable.

Made-with: Cursor

18426 of 20989 branches covered (87.79%)

Branch coverage included in aggregate %.

33329 of 35367 relevant lines covered (94.24%)

13508.6 hits per line