fix(search): enforce blockedProviders setting on search endpoint (#11100) (#11125)

Cherry-picked the three value commits onto the current tip, dropping the stale base-red sync commits. Focused tests: search-blocked-providers-11100 + search-registry/searxng-loopback/chat-guard/x-search suites 65/65. Fixes #11100 (endpoint half) — GET /v1/search now honors blockedProviders via getAllSearchProviders. Thank you @rqzbeh!

open-sse/config/searchRegistry.ts

@@ -10,6 +10,8 @@
  * perplexity-search reuses credentials from the "perplexity" chat provider.
  */
 
+import { isProviderBlockedByIdOrAlias } from "@/shared/utils/noAuthProviders";
+
 export interface SearchProviderConfig {
   id: string;
   name: string;
@@ -394,16 +396,18 @@ export function supportsSearchType(
 /**
  * Get all search providers as a flat list
  */
-export function getAllSearchProviders(): Array<{
+export function getAllSearchProviders(blockedProviders: string[] = []): Array<{
   id: string;
   name: string;
   searchTypes: string[];
 }> {
-  return Object.values(SEARCH_PROVIDERS).map((p) => ({
-    id: p.id,
-    name: p.name,
-    searchTypes: p.searchTypes,
-  }));
+  return Object.values(SEARCH_PROVIDERS)
+    .filter((p) => !p.disabled && !isProviderBlockedByIdOrAlias(p.id, blockedProviders))
+    .map((p) => ({
+      id: p.id,
+      name: p.name,
+      searchTypes: p.searchTypes,
+    }));
 }
 
 /**

src/app/api/v1/search/route.ts

@@ -58,9 +58,7 @@ export async function OPTIONS() {
 export async function GET() {
   const settings = await getSettings().catch(() => ({} as any));
   const blockedProviders = settings?.blockedProviders || [];
-  const providers = getAllSearchProviders().filter(
-    (p) => !isProviderBlockedByIdOrAlias(p.id, blockedProviders)
-  );
+  const providers = getAllSearchProviders(blockedProviders);
   const timestamp = Math.floor(Date.now() / 1000);
 
   const data = providers.map((p) => ({

tests/unit/search-blocked-providers-11100.test.ts

@@ -0,0 +1,11 @@
+import test from "node:test";
+import assert from "node:assert/strict";
+import { getAllSearchProviders } from "../../open-sse/config/searchRegistry.ts";
+
+test("getAllSearchProviders filters out blocked providers", () => {
+  const all = getAllSearchProviders();
+  assert.ok(all.some((p) => p.id === "serper-search"));
+
+  const filtered = getAllSearchProviders(["serper-search"]);
+  assert.equal(filtered.some((p) => p.id === "serper-search"), false);
+});