@@ -0,0 +1,34 @@
+import type { Context } from "hono";
+
+import { PgDialect } from "drizzle-orm/pg-core";
+import { describe, expect, it } from "vitest";
+
+import { searchIndexFilters } from "./search-filters";
+
+const c = { get: () => undefined } as unknown as Context;
+
+const render = (accessScopes?: null | string[]) => {
+  const condition = searchIndexFilters(c, {
+    accessScopes,
+    includePrivate: true,
+  });
+
+  return condition ? new PgDialect().sqlToQuery(condition) : undefined;
+};
+
+describe("searchIndexFilters access scopes", () => {
+  it.each([[["forum.forums:1", "blog.category:3"]], [[]]])(
+    "keeps a row only when every scope it is filed in is in %j",
+    allowed => {
+      expect(render(allowed)).toEqual({
+        params: [allowed],
+        sql: '"core_search_index"."accessScopes" <@ $1::text[]',
+        typings: undefined,
+      });
+    },
+  );
+
+  it.each([undefined, null])("adds no access filter for %s", allowed => {
+    expect(render(allowed)).toBeUndefined();
+  });
+});
@@ -7,6 +7,7 @@ import { describe, expect, it, vi } from "vitest";
 import type { RegisteredContentType } from "@/content/registry";
 
 import { core_search_index } from "@/database/search";
+import { createAccessWorld, TOPIC, USER } from "@/tests/content-access";
 import {
   testBigintEventContentType,
   testLocalizedPageContentType,
@@ -535,3 +536,97 @@ describe("item ids under every strategy", () => {
     expect(searchItemIdFromKey(types, "forum.topic", "abc")).toBe("abc");
   });
 });
+
+describe("SearchModel access rules", () => {
+  const hit = (itemId: number) => ({
+    author: null,
+    authorId: null,
+    authorIds: [],
+    authors: [],
+    containerId: null,
+    containerType: null,
+    content: "",
+    createdAt: new Date("2026-01-01"),
+    id: itemId,
+    image: null,
+    imageId: null,
+    isHidden: false,
+    isPublic: true,
+    itemId: String(itemId),
+    itemType: "test.access-topic",
+    languageCode: "",
+    metadata: {},
+    pluginId: "@vitnode/example",
+    score: null,
+    title: `Topic ${itemId}`,
+    url: null,
+  });
+
+  const searchAs = async (
+    userId: null | number,
+    options: Parameters<typeof createAccessWorld>[0] = {},
+  ) => {
+    const world = await createAccessWorld(options);
+    const provider = createProvider();
+    const values = world.contextValues(userId);
+    const core = {
+      ...(values.core as object),
+      search: { adapter: provider },
+    };
+    const c = {
+      get: (key: string) => (key === "core" ? core : values[key]),
+    } as unknown as Context;
+
+    return { model: new SearchModel(c), provider };
+  };
+
+  it("adds no access filter while nothing is restricted", async () => {
+    const { model, provider } = await searchAs(null, { rules: {} });
+
+    await model.search({ term: "hello" });
+
+    expect(provider.search).toHaveBeenCalledWith(expect.anything(), {
+      term: "hello",
+    });
+  });
+
+  it("limits a restricted viewer to the scopes they may read", async () => {
+    const { model, provider } = await searchAs(null);
+
+    await model.search({ term: "hello" });
+
+    const [, params] = vi.mocked(provider.search).mock.calls[0];
+    expect([...(params.accessScopes ?? [])].sort()).toEqual([
+      "test.access-boards:1",
+      "test.access-boards:5",
+    ]);
+  });
+
+  it("lets a staff route skip the rules, and never trusts a caller's scopes", async () => {
+    const { model, provider } = await searchAs(null);
+
+    await model.search({ accessScopes: ["anything:1"], skipAccess: true });
+
+    expect(provider.search).toHaveBeenCalledWith(expect.anything(), {});
+  });
+
+  it("drops a hit the content tables no longer let the viewer read, and stops counting it", async () => {
+    const { model, provider } = await searchAs(USER.MEMBER);
+    vi.mocked(provider.search).mockResolvedValue({
+      edges: [hit(TOPIC.OPEN), hit(TOPIC.VIP)],
+      pageInfo: {
+        count: 2,
+        endCursor: null,
+        hasNextPage: false,
+        hasPreviousPage: false,
+        startCursor: null,
+        totalCount: 10,
+      },
+    });
+
+    const result = await model.search({ term: "topic" });
+
+    expect(result.edges.map(edge => edge.itemId)).toEqual([String(TOPIC.OPEN)]);
+    expect(result.pageInfo).toMatchObject({ count: 1, totalCount: 9 });
+  });
+});
@@ -0,0 +1,223 @@
+import { describe, expect, it } from "vitest";
+
+import type {
+  ContentAccessActor,
+  ContentAccessAudience,
+  ContentAccessDefaultsInput,
+  ContentAccessScopeLayer,
+} from "./policy";
+
+import {
+  CONTENT_ACCESS_DENY_ALL,
+  contentAccessRequirements,
+  decideContentAccess,
+  readContentAccessOverrides,
+  resolveContentAccessRules,
+  resolveContentAccessScopeInput,
+} from "./policy";
+
+const GUEST: ContentAccessActor = { kind: "guest" };
+const member = (roleIds: number[], root = false): ContentAccessActor => ({
+  kind: "member",
+  roleIds,
+  root,
+  userId: 1,
+});
+
+const MEMBERS: ContentAccessAudience = { mode: "members" };
+const ROLES_4_5: ContentAccessAudience = { mode: "roles", roleIds: [4, 5] };
+
+const allows = (
+  actor: ContentAccessActor,
+  chain: ContentAccessScopeLayer[],
+  action: Parameters<typeof contentAccessRequirements>[0]["action"],
+  defaults: ContentAccessDefaultsInput = {},
+) =>
+  decideContentAccess(
+    actor,
+    contentAccessRequirements({ action, chain, defaults, family: "f" }),
+  ).allowed;
+
+describe("audiences", () => {
+  it.each<[string, ContentAccessAudience, ContentAccessActor, boolean]>([
+    ["everyone lets a guest in", { mode: "everyone" }, GUEST, true],
+    ["members keeps a guest out", MEMBERS, GUEST, false],
+    ["members lets any member in", MEMBERS, member([2]), true],
+    ["roles keeps a guest out", ROLES_4_5, GUEST, false],
+    [
+      "roles keeps a member without the roles out",
+      ROLES_4_5,
+      member([2]),
+      false,
+    ],
+    // Primary and secondary roles are one list: any one of them is enough.
+    [
+      "roles lets in a member with any listed role",
+      ROLES_4_5,
+      member([2, 5]),
+      true,
+    ],
+    [
+      "roles with no role left lets nobody in",
+      CONTENT_ACCESS_DENY_ALL,
+      member([4]),
+      false,
+    ],
+  ])("%s", (_label, audience, actor, expected) => {
+    expect(
+      allows(actor, [{ id: "1", overrides: { view: audience } }], "view"),
+    ).toBe(expected);
+  });
+
+  it("lets a root role past every rule, deny-all included", () => {
+    const chain = [
+      {
+        id: "1",
+        overrides: {
+          downloadAttachments: CONTENT_ACCESS_DENY_ALL,
+          view: CONTENT_ACCESS_DENY_ALL,
+        },
+      },
+    ];
+
+    expect(
+      decideContentAccess(
+        member([], true),
+        contentAccessRequirements({
+          action: "downloadAttachments",
+          chain,
+          defaults: {},
+          family: "f",
+        }),
+      ),
+    ).toEqual({ allowed: true, reason: "root" });
+  });
+});
+
+describe("prerequisites", () => {
+  // Every action open except the one named: the action and everything that
+  // needs it are closed to a guest, the rest stay open.
+  it.each([
+    [
+      "view",
+      { comment: false, downloadAttachments: false, read: false, view: false },
+    ],
+    [
+      "read",
+      { comment: false, downloadAttachments: false, read: false, view: true },
+    ],
+    [
+      "comment",
+      { comment: false, downloadAttachments: true, read: true, view: true },
+    ],
+    [
+      "downloadAttachments",
+      { comment: true, downloadAttachments: false, read: true, view: true },
+    ],
+  ] as const)(
+    "closing %s to guests closes what needs it",
+    (closed, expected) => {
+      const chain = [{ id: "1", overrides: { [closed]: MEMBERS } }];
+
+      expect({
+        comment: allows(GUEST, chain, "comment"),
+        downloadAttachments: allows(GUEST, chain, "downloadAttachments"),
+        read: allows(GUEST, chain, "read"),
+        view: allows(GUEST, chain, "view"),
+      }).toEqual(expected);
+    },
+  );
+
+  it("keeps out a role allowed to comment but not to read", () => {
+    const chain = [
+      {
+        id: "1",
+        overrides: {
+          comment: ROLES_4_5,
+          read: { mode: "roles", roleIds: [9] },
+        },
+      },
+    ] satisfies ContentAccessScopeLayer[];
+
+    expect(allows(member([4]), chain, "comment")).toBe(false);
+  });
+});
+
+describe("readContentAccessOverrides", () => {
+  it("fails closed on a stored rule that no longer parses", () => {
+    expect(
+      readContentAccessOverrides({
+        comment: { mode: "vip" },
+        read: { mode: "roles" },
+        view: { mode: "members" },
+      }),
+    ).toEqual({
+      comment: CONTENT_ACCESS_DENY_ALL,
+      read: CONTENT_ACCESS_DENY_ALL,
+      view: { mode: "members" },
+    });
+  });
+
+  it.each([null, "members", ["view"], 7])(
+    "reads %j as no rules at all",
+    value => {
+      expect(readContentAccessOverrides(value)).toEqual({});
+    },
+  );
+
+  it("leaves an action without a rule to inherit", () => {
+    expect(
+      readContentAccessOverrides({ read: null, view: { mode: "everyone" } }),
+    ).toEqual({ view: { mode: "everyone" } });
+  });
+});
+
+describe("resolveContentAccessRules", () => {
+  it("takes each action from the scope, the nearest ancestor, the defaults, then everyone", () => {
+    const { policy, sources } = resolveContentAccessRules({
+      chain: [
+        { id: "child", overrides: { view: ROLES_4_5 } },
+        { id: "parent", overrides: { read: MEMBERS, view: MEMBERS } },
+        { id: "root", overrides: { read: CONTENT_ACCESS_DENY_ALL } },
+      ],
+      defaults: { comment: { mode: "members" } },
+    });
+
+    expect(policy).toEqual({
+      comment: MEMBERS,
+      downloadAttachments: { mode: "everyone" },
+      read: MEMBERS,
+      view: ROLES_4_5,
+    });
+    expect(sources).toEqual({
+      comment: { kind: "default" },
+      downloadAttachments: { kind: "fallback" },
+      read: { kind: "scope", scopeId: "parent" },
+      view: { kind: "scope", scopeId: "child" },
+    });
+  });
+});
+
+describe("resolveContentAccessScopeInput", () => {
+  it.each([
+    [undefined, { defaults: {}, enabled: false }],
+    [false, { defaults: {}, enabled: false }],
+    [true, { defaults: {}, enabled: true }],
+    [
+      { defaults: { comment: { mode: "members" } } },
+      { defaults: { comment: { mode: "members" } }, enabled: true },
+    ],
+  ] as const)("resolves %j", (input, expected) => {
+    expect(resolveContentAccessScopeInput(input)).toEqual(expected);
+  });
+
+  it("refuses a roles default, which only an installation can name", () => {
+    expect(() =>
+      resolveContentAccessScopeInput({
+        defaults: {
+          read: { mode: "roles", roleIds: [1] },
+        } as unknown as ContentAccessDefaultsInput,
+      }),
+    ).toThrow(/roles are chosen in the AdminCP/);
+  });
+});