[Tonours]

fixes PRD-1820

Shares one live query segment assertion across the permission middlewares and the has-many related routes, so every route that applies a segment goes through the same permission helper as list and count.

What

File	Change
src/services/authorization/authorization.ts	New assertCanExecuteSegmentQuery(user, collectionName, segmentQuery): no-op without a segment, otherwise throws ForbiddenError (403). assertCanBrowse and the new method share one private permission call; the browse error message is unchanged.
src/services/exposed/records-getter.js	New static isExplicitIdSelection / getSelectionSegmentQuery: one rule for whether a bulk selection uses its segment, shared by getIdsFromRequest and the permission middleware.
src/middlewares/permissions.js	export(), delete() and smartAction() use the shared segment assertion; new public segmentQuery() middleware for routes that need it.
src/routes/associations.js	Has-many related routes (list, count, csv, dissociate) chain segmentQuery() built for the related collection.
jest.config.js, test/helpers/block-network.js	The test suite refuses outbound network calls (loopback excepted), so init() no longer waits on a live API during tests.

list() and count() keep their existing check, unchanged. Charts and smart action form hooks do not read segments and are untouched.

Why

• Consistency: one helper and one selection rule for every segment-using route, at the middleware layer.
• Explicit id selections keep their current behaviour.
• Has-many fields without a reference (embedded documents) fall back to the parent collection name.
• forest-express-sequelize needs no code change; it picks this up once its pinned forest-express version is bumped (follow-up proposed). Equivalent alignment in the other agents is tracked separately.

How to test

• yarn install --frozen-lockfile
• yarn jest test/services/authorization test/middlewares/permissions.unit.test.js test/routes/associations.test.js
• yarn test
• yarn lint; yarn tsc --noEmit

Definition of Done

General

• Write an explicit title for the Pull Request, following Conventional Commits specification
• Test manually the implemented changes
• Validate the code quality (indentation, syntax, style, simplicity, readability)

Security

• Consider the security impact of the changes made

[Scra3]

Spec (PRD-1820): conforms.

Applies to: the PR description
Claude Opus 5.5 (claude-opus-5-5): Should fix: forest-express-sequelize users keep running without these checks until someone bumps its pinned forest-express, and no ticket asks for it.

Code

forest-express-sequelize/package.json pins "forest-express": "10.9.3" exactly, so it never picks up a new release on its own.

A way out: open a ticket that bumps forest-express in forest-express-sequelize/package.json, like PRD-1813 for mongoose.

Reproduction

1. Release forest-express with this PR.
2. Install the latest forest-express-sequelize in a project.
3. It still resolves forest-express 10.9.3.