Restricted mock NCBI publication search test actions to dev mode

* The three actions (SetupMockNcbiService, RestoreNcbiService, RegisterMockPublication) swap a process-wide service and were reachable on production via a forge-able GET (ReadOnlyApiAction does no CSRF check), despite @RequiresSiteAdmin
* Added requireDevModeForMockNcbiService(): the actions now return 404 in non-dev mode
* Changed actions to MutatingApiAction (correct type for state mutation; also enforces a CSRF token)
* Updated PublicationSearchTest to use SimplePostCommand; verified passing with the mock (POST path) and against real NCBI

Co-Authored-By: Claude <noreply@anthropic.com>

Author: vagisha

panoramapublic/src/org/labkey/panoramapublic/PanoramaPublicController.java

@@ -32,6 +32,7 @@
 import org.labkey.api.action.FormHandlerAction;
 import org.labkey.api.action.FormViewAction;
 import org.labkey.api.action.LabKeyError;
+import org.labkey.api.action.MutatingApiAction;
 import org.labkey.api.action.ReadOnlyApiAction;
 import org.labkey.api.action.ReturnUrlForm;
 import org.labkey.api.action.SimpleErrorView;
@@ -11233,34 +11234,47 @@ public static ActionURL getCatalogImageDownloadUrl(ExperimentAnnotations expAnno
 
     // ======================== Support actions for Selenium tests ========================
 
+    // These actions swap the process-wide NCBI publication search service to a mock so that Selenium tests
+    // run without calling the live NCBI API. They must never be reachable on a production server (non-dev-mode)
+    private static void requireDevModeForMockNcbiService()
+    {
+        if (!AppProps.getInstance().isDevMode())
+        {
+            throw new NotFoundException("Mock NCBI publication search service actions are only available on a server running in dev mode.");
+        }
+    }
+
     @RequiresSiteAdmin
-    public static class SetupMockNcbiServiceAction extends ReadOnlyApiAction<Object>
+    public static class SetupMockNcbiServiceAction extends MutatingApiAction<Object>
     {
         @Override
         public Object execute(Object form, BindException errors)
         {
+            requireDevModeForMockNcbiService();
             NcbiPublicationSearchServiceImpl.setInstance(new MockNcbiPublicationSearchService());
             return new ApiSimpleResponse("mock", true);
         }
     }
 
     @RequiresSiteAdmin
-    public static class RestoreNcbiServiceAction extends ReadOnlyApiAction<Object>
+    public static class RestoreNcbiServiceAction extends MutatingApiAction<Object>
     {
         @Override
         public Object execute(Object form, BindException errors)
         {
+            requireDevModeForMockNcbiService();
             NcbiPublicationSearchServiceImpl.setInstance(new NcbiPublicationSearchServiceImpl());
             return new ApiSimpleResponse("restored", true);
         }
     }
 
     @RequiresSiteAdmin
-    public static class RegisterMockPublicationAction extends ReadOnlyApiAction<RegisterMockPublicationForm>
+    public static class RegisterMockPublicationAction extends MutatingApiAction<RegisterMockPublicationForm>
     {
         @Override
         public Object execute(RegisterMockPublicationForm form, BindException errors)
         {
+            requireDevModeForMockNcbiService();
             NcbiPublicationSearchService service = NcbiPublicationSearchServiceImpl.getInstance();
             if (!(service instanceof MockNcbiPublicationSearchService mock))
             {

panoramapublic/test/src/org/labkey/test/tests/panoramapublic/PublicationSearchTest.java

@@ -5,7 +5,7 @@
 import org.junit.experimental.categories.Category;
 import org.labkey.remoteapi.CommandException;
 import org.labkey.remoteapi.Connection;
-import org.labkey.remoteapi.SimpleGetCommand;
+import org.labkey.remoteapi.SimplePostCommand;
 import org.labkey.remoteapi.query.Filter;
 import org.labkey.remoteapi.query.SelectRowsCommand;
 import org.labkey.remoteapi.query.SelectRowsResponse;
@@ -341,7 +341,7 @@ private void initMockNcbiService()
         try
         {
             Connection connection = createDefaultConnection();
-            SimpleGetCommand command = new SimpleGetCommand("panoramapublic", "setupMockNcbiService");
+            SimplePostCommand command = new SimplePostCommand("panoramapublic", "setupMockNcbiService");
             command.execute(connection, "/");
             _useMockNcbi = true;
             log("Using mock NCBI service");
@@ -417,7 +417,7 @@ private void registerMockPublication(String database, String id, String searchKe
         try
         {
             Connection connection = createDefaultConnection();
-            SimpleGetCommand command = new SimpleGetCommand("panoramapublic", "registerMockPublication");
+            SimplePostCommand command = new SimplePostCommand("panoramapublic", "registerMockPublication");
             Map<String, Object> params = new HashMap<>();
             params.put("database", database);
             params.put("id", id);
@@ -447,7 +447,7 @@ private void restoreNcbiService()
         try
         {
             Connection connection = createDefaultConnection();
-            SimpleGetCommand command = new SimpleGetCommand("panoramapublic", "restoreNcbiService");
+            SimplePostCommand command = new SimplePostCommand("panoramapublic", "restoreNcbiService");
             command.execute(connection, "/");
             log("Restored real NCBI service");
         }