Permissions inside the query
Access checks are part of the database query itself, not a filter bolted on afterwards.
Wow your usersProduct intelligence
Workspace search
Search everything you're allowed to see, and nothing you're not.
One search contract covers organizations, projects, and notes together or separately. Permission checks run inside the query itself, so results can never include another company's data. Built-in limits keep any search from hammering your database.
3types of things you can search3composable resource groups20max ranked results
3 of 6 in Wow your users
Product example
See it working
This is the same visual component used by the authenticated app, rendered with deterministic sample data.
Scenario
viewport
surface theme
mode
Scoped results
Search results include only accessible organizations, projects, and documents.
Inert sample data · no network access
Preview ready
Highlights
Why it matters
Limits at the door
Queries cap at 100 characters and 20 globally ranked results, so search can't overload your database.
Types, groups, and one registry
Search one registered resource type, a named group, or any composition of both; the registry documents what's searchable, by whom, and with what limits.
The problem this solves
Without a shared foundation, every team rebuilds these edge cases — differently.
The filter someone forgot
Search that fetches everything and filters afterwards will eventually skip the filter. One missed code path, and another company's rows land in your customer's results.
The query that melts the database
Without caps, one long query or one huge result set becomes a self-inflicted outage. Your own search box takes your database down.
Search nobody can explain
When nobody wrote down what's searchable under which permission, every new feature reinvents search and re-audits access from scratch.
How it works
The mechanism end to end, as implemented in the repository.
- 1
Input gets checked first
The query must be 1 to 100 characters, resource types and groups must be registered, results are capped at 20, and wildcard characters are escaped before database work begins.
- 2
The server picks the scope
Your active organization and project come from the login session. The browser never gets a say in whose data is searched.
- 3
Permissions join the query
Membership checks are joined right into the search query, so rows are narrowed down before matching even runs.
- 4
Only selected lanes run
Groups and explicit types resolve to one canonical set. Only selected, authorized query lanes run before results receive one global relevance order.
Engineering guarantees
What this does and does not promise
Safety boundary
Search results help people find things; they don't grant access. Every feature checks permissions again when someone opens or edits what they found.
Implementation evidence
The boundary above is code, not a claim. These files carry the contract:
src/db/postgres-search.tssrc/registries/search-indexes.tssrc/features/search/targets.tssrc/features/search/server.ts
Questions
Frequently asked questions
Related capabilities
These capabilities share contracts and boundaries with this one.
Build on the workspace search foundation
The docs describe the same contracts this page demonstrates.