fix(search): harden authorized results and ordering

backend/internal/logic/search/service_test.go

@@ -2,7 +2,9 @@ package search
 
 import (
 	"fmt"
+	"strings"
 	"testing"
+	"time"
 
 	"github.com/glebarez/sqlite"
 	"github.com/stretchr/testify/require"
@@ -26,6 +28,91 @@ func TestSearchFindsNoteBody(t *testing.T) {
 	require.Equal(t, "note", results[0].Type)
 }
 
+func TestSearchAppliesStableFairGlobalLimitAcrossResultTypes(t *testing.T) {
+	database, err := gorm.Open(sqlite.Open(fmt.Sprintf("file:%s?mode=memory&cache=shared", t.Name())), &gorm.Config{})
+	require.NoError(t, err)
+	require.NoError(t, models.AutoMigrate(database))
+	models.DBService = database
+
+	baseTime := time.Date(2026, time.July, 21, 12, 0, 0, 0, time.UTC)
+	for index := 0; index < 60; index++ {
+		project := models.SenlinAgentProject{
+			Identity:   fmt.Sprintf("00000000-0000-7001-8000-%012d", index),
+			OwnerID:    7,
+			Name:       fmt.Sprintf("稳定排序项目 %02d", index),
+			Identifier: fmt.Sprintf("SORT-%02d", index),
+			UpdatedAt:  baseTime.Add(time.Duration(index) * time.Minute),
+		}
+		require.NoError(t, database.Create(&project).Error)
+		require.NoError(t, database.Create(&models.SenlinAgentTask{
+			Identity:  fmt.Sprintf("00000000-0000-7002-8000-%012d", index),
+			ProjectID: project.ID,
+			CreatedBy: 7,
+			Title:     fmt.Sprintf("稳定排序任务 %02d", index),
+			Status:    "open",
+			UpdatedAt: baseTime.Add(time.Duration(index) * time.Minute),
+		}).Error)
+		require.NoError(t, database.Create(&models.SenlinAgentNote{
+			Identity:  fmt.Sprintf("00000000-0000-7003-8000-%012d", index),
+			ProjectID: project.ID,
+			CreatedBy: 7,
+			Title:     fmt.Sprintf("稳定排序笔记 %02d", index),
+			UpdatedAt: baseTime.Add(time.Duration(index) * time.Minute),
+		}).Error)
+	}
+
+	service := NewService(database)
+	results, err := service.Search(7, "稳定排序")
+	require.NoError(t, err)
+	require.Len(t, results, maxSearchResults)
+
+	counts := map[string]int{}
+	for _, result := range results {
+		counts[result.Type]++
+	}
+	require.Equal(t, map[string]int{"project": 17, "task": 17, "note": 16}, counts)
+	require.Equal(t,
+		[]string{"project", "task", "note", "project", "task", "note", "project", "task", "note"},
+		resultTypes(results[:9]),
+	)
+	require.Equal(t, "00000000-0000-7001-8000-000000000059", results[0].ID)
+	require.Equal(t, "00000000-0000-7002-8000-000000000059", results[1].ID)
+	require.Equal(t, "00000000-0000-7003-8000-000000000059", results[2].ID)
+
+	again, err := service.Search(7, "稳定排序")
+	require.NoError(t, err)
+	require.Equal(t, results, again)
+}
+
+func TestSearchBoundsChineseSnippetsByRune(t *testing.T) {
+	database, err := gorm.Open(sqlite.Open(fmt.Sprintf("file:%s?mode=memory&cache=shared", t.Name())), &gorm.Config{})
+	require.NoError(t, err)
+	require.NoError(t, models.AutoMigrate(database))
+	models.DBService = database
+	project := models.SenlinAgentProject{OwnerID: 7, Name: "摘要项目", Identifier: "SNIPPET"}
+	require.NoError(t, database.Create(&project).Error)
+	require.NoError(t, database.Create(&models.SenlinAgentNote{
+		ProjectID: project.ID,
+		CreatedBy: 7,
+		Title:     "中文摘要",
+		Markdown:  strings.Repeat("森", 300) + "尾",
+	}).Error)
+
+	results, err := NewService(database).Search(7, "森")
+	require.NoError(t, err)
+	require.Len(t, results, 1)
+	require.Len(t, []rune(results[0].Snippet), 240)
+	require.NotContains(t, results[0].Snippet, "尾")
+}
+
+func resultTypes(results []SearchResultDTO) []string {
+	types := make([]string, 0, len(results))
+	for _, result := range results {
+		types = append(types, result.Type)
+	}
+	return types
+}
+
 func TestSearchOnlyReturnsNavigableProjectTaskAndNoteResults(t *testing.T) {
 	database, err := gorm.Open(sqlite.Open(fmt.Sprintf("file:%s?mode=memory&cache=shared", t.Name())), &gorm.Config{})
 	require.NoError(t, err)