fix(search): search as the user the provider is given

[jospoortvliet]

Both services already take the parameter, so this passes the argument that already exists rather than changing any API.

The problem

SearchTablesProvider receives the account to search as, but calls TableService::search() and ViewService::search() without it. Both accept an optional $userId and fall back to PermissionsService::preCheckUserId(null), which resolves the session user so any caller searching on behalf of someone else silently received its own results instead.

I assume this is not intentional, just 'good enough' for unified search.

Some more details:

• lib/Search/SearchTablesProvider.php:82 and :93 call TableService::search($term, $limit, $offset) and ViewService::search($term, $limit, $offset).
• Both signatures end in ?string $userId = null and, when null, call PermissionsService::preCheckUserId(null) → $this->userId, the session user.
• The provider's own search(IUser $user, ISearchQuery $query) is handed the account to search as, and already uses it for the isEnabledForUser() check on the line above.

Through the unified search UI the session user and $user are always the same, so nothing is visibly broken today. But it breaks when you need to search on behalf of another account, like a background job, or a compliance tool that must search within a defined set of accounts.

this PR

The change in this PR is very simple:

Pass $user->getUID() to both calls. No API change; both services already accept it.

Tests

New tests/unit/Search/SearchTablesProviderTest.php:

• asserts both services are called with the given uid
• asserts neither is called when the app is disabled for that user

Verified the test fails against the unfixed provider and passes with it.

Checks run

• phpunit -c tests/unit/phpunit.xml --filter SearchTablesProviderTest → 2 passed (run inside the dev container; the bootstrap needs a database)
• php -l on both files
• php-cs-fixer --dry-run on both files → no violations

🖼️ Screenshots

🏚️ Before	🏡 After
B	A

🏁 Checklist

• ⛑️ Tests (unit and/or integration) are included or not needed
• 🔙 Backport requests are created or not needed: /backport to stableX.X
• 📅 Milestone is set
• 🌸 PR title is meaningful (if it should be in the changelog: is it meaningful to users?)

🤖 AI (if applicable)

• The content of this PR was partly or fully generated using AI

The change and its test were produced with Claude Code (claude-opus-5).

[Copilot]

🟢 Approval recommended

The change is focused, tested, and has no unresolved review comments.

Pull request overview

This pull request fixes delegated unified search by forwarding the requested user’s UID.

Changes:

• Passes the user ID to table and view searches.
• Adds tests for UID forwarding and disabled-app behavior.

File summaries

File	Description
tests/unit/Search/SearchTablesProviderTest.php	Verifies UID forwarding and disabled-app handling.
lib/Search/SearchTablesProvider.php	Forwards the requested user ID to both services.

Review details

• Files reviewed: 2/2 changed files
• Comments generated: 0
• Review effort level: Lite

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.