fixed key-based access control for Tantivy backends

src/admin_meta.rs

@@ -432,20 +432,26 @@ pub fn verify_access(
         return Ok(None);
     }
 
-    // Public?
-    if load_public(&admin, id)? {
-        return Ok(Some(Permissions::ReadWrite));
-    }
+    let is_public = load_public(&admin, id)?;
 
-    // Private: require key and verify
+    // If a key is explicitly provided, enforce its validity strictly.
+    // Do NOT fall back to public when an invalid key is supplied.
     if let Some(k) = key_opt {
         let hash = crate::rpc::hash_key(k);
         if let Some(v) = admin.hget(&k_meta_db_keys(id), &hash)? {
             let (perm, _ts) = parse_perm_value(&v);
             return Ok(Some(perm));
         }
+        // Invalid key
+        return Ok(None);
+    }
+
+    // No key provided: allow access if DB is public, otherwise deny
+    if is_public {
+        Ok(Some(Permissions::ReadWrite))
+    } else {
+        Ok(None)
     }
-    Ok(None)
 }
 
 // Enumerate all db ids