Pull Request resolves #47839.

• I read the Generative AI policy and my contribution is compatible with the policy and GNU/GPL 2 or later.

Summary of Changes

Joomla access-level IDs are identifiers, not an ordering of restrictiveness. Smart Search therefore cannot combine an item's access level with its category access level by choosing the larger ID.

This change stores the item and category access levels independently in #__finder_links and requires the current user to be authorized for both when loading search results or suggestions. It also:

• keeps normal indexing, debug indexing, and incremental item/category access updates aligned;
• defaults category-less content to the Public access level;
• adds the new column and supporting indexes to MySQL and PostgreSQL install/update schemas; and
• adds unit coverage proving that category access is preserved whether its ID is numerically higher or lower than the item access ID.

The PR targets 6.2-dev because the separate cat_access schema is a feature-level database change. Existing Smart Search data must be cleared and reindexed after applying the database update so that cat_access is populated from each source item.

Testing Instructions

Automated checks run locally against 6.2-dev:

• Focused category-access unit tests: 4 tests, 8 assertions, passed.
• Full unit suite: 1,131 tests, 1,638 assertions, passed with one existing skip.
• PHPStan on all changed PHP files: no errors.
• Repository PHP CS Fixer dry run: no changes required.
• PHP syntax, whitespace, and Git diff checks: passed.

Manual reproduction:

1. Apply the database update.
2. Clear the existing Smart Search index.
3. Create a category with access set to Registered.
4. Create a published article in that category with access set to Public.
5. Run the Smart Search indexer.
6. As a guest, search for the article title.
7. As a registered user, repeat the search.

Actual result BEFORE applying this Pull Request

The guest search shows the article even though opening it is denied. The indexed row keeps only the article access level and discards the category access level.

Expected result AFTER applying this Pull Request

The article is excluded from guest search results and remains available to users authorized for both the article and its category. Custom access-level IDs work the same way regardless of their numeric order.

Link to documentations

Please select:

• Documentation link for guide.joomla.org:

• No documentation changes for guide.joomla.org needed

• Pull Request link for manual.joomla.org:

• No documentation changes for manual.joomla.org needed