dotAI Security Hardening: RAG permissions, output safety, abuse controls

Summary

Align the dotAI layer with the platform guarantees the rest of dotCMS already applies: per-user READ permission on retrieval, escaped output at the template boundary, and rate limiting at the REST boundary.

Fixes go at the boundaries, not the call sites, so current and future consumers inherit them.

Background

com.dotcms.ai was built as a feature layer on top of dotCMS and does not route through core enforcement. Retrieval filters on host / content-type / index / language only, viewtools return model output and error detail verbatim, and the REST resources have no rate control. Embedding a content type is an admin decision to make it available to the AI for permitted users, and the retrieval path should reflect that.

Scope

Out of scope

• AppConfig.debugLogger prompt/response logging. Explicit default-off flag, working as intended.
• Eliminating prompt injection. #37152 is mitigation; the control for untrusted input stays operational.
• Per-user result-set caching. EMBEDDING_CACHE keys on hashed query text to vector, so it is not a per-user leak vector; #37151 adds a comment so that does not regress.
• Agent framework and MCP v2 surfaces. Separate review.
• Provider-side spend caps and rate-limit policy numbers. Customer-owned.

Epic acceptance

• Unauthorized user: 0 hits from /api/v1/ai/search, "no matching content" from /api/v1/ai/completions. Authorized user gets the content.
• No dotAI code path returns a stack trace to a caller or template.
• Default viewtool accessor escapes <script> / onerror= payloads; only the explicit opt-in returns raw.
• Burst above the configured limit returns 429; normal usage unaffected.
• Admin/system indexing, deleteByQuery, and countEmbeddingsByIndex unchanged.
• Release note covers the two visible behavior changes (#37151 recall, #37153 output) ahead of the release, plus the trust-boundary guidance.

Sequencing

#37151, #37153, #37154 are the commit. #37152 and #37155 are stretch and can move to a later track. #37151 carries the design surface: pagination shortfall under a post-SQL filter, anonymous vs null-user semantics, and the cost of the added contentlet fetch on a large index.