Epic: User profiles with persistent standards filter

[northdpole]

What

Finish the #586 view: a logged-in user picks which standards they care about, and that selection is the default view across OpenCRE until they show all.

This is not a new catalog, not a private tenant, and not MyOpenCRE CSV-upload. Auth + persistence already exist. The saved list does not yet change CRE/search/explorer/GA pages.

Already shipped (#586)

• Google OIDC (/rest/v1/login, /callback, /user, /logout)
• users + user_resource_selection tables
• GET/PUT /rest/v1/user/resources
• MyOpenCRE ResourceSelector picker
• Server filter on GET /rest/v1/standards only (?all=true bypass)
• Empty selection = show everything; OpenCRE always kept
• Two flags, both off by default: CRE_ENABLE_LOGIN and CRE_ENABLE_MYOPENCRE

Chat login is separate: /rest/v1/completion is always @login_required. Production chat can already force Google login while these flags stay off.

The gap

apply_user_resource_filter runs only on /rest/v1/standards. The UI almost never consumes that list (the picker uses ?all=true). CRE pages load /id/{id} unfiltered. The old URL view (?applyFilters=true&filters=ASVS) is not hydrated from /user/resources. include_only= on the CRE API already exists and is unused by the frontend.

Child tickets

Added in follow-up comments / this project: https://github.com/orgs/OWASP/projects/60

Success

• Logged-in user with a non-empty selection sees only those standards (plus OpenCRE) on CRE/standard pages by default, with a visible “your view / Show all” control.
• Search and explorer respect the same view.
• Map Analysis dropdowns can be narrowed without losing a “all eligible” bypass (?all=true).
• Anonymous and shareable /cre/… URLs still show the full graph.
• Empty selection still means “show everything”.

Out of scope

• Private LLM / hosted MyOpenCRE tenant
• CSV import auth (Auth-wrap POST /rest/v1/cre_csv_import (deprecate anonymous MyOpenCRE import) #966)
• OAuth path rename (Auth: migrate OAuth routes from /rest/v1/login to /rest/v1/auth/* #963)
• Nest Agent (Epic: Bidirectional OWASP Agent with Nest (REST first, MCP second) #1072)
• Rebuilding the picker or the User model

Context

• Closed parent: Add support for users #586
• Deferred prune/GA: Deferred from #586: graph-link pruning + ga_standards filtering for per-user resource selection #1043
• RFC (broader MyOpenCRE, not this view): docs/rfc/user-auth-myopencre.md
• Filter helper: application/web/web_main.py apply_user_resource_filter
• Client URL filters: application/frontend/src/hooks/applyFilters.tsx

[northdpole]

Child tickets

Project: https://github.com/orgs/OWASP/projects/60

1. Prod: enable CRE_ENABLE_LOGIN and CRE_ENABLE_MYOPENCRE for profiles #1080 — Prod: enable CRE_ENABLE_LOGIN + CRE_ENABLE_MYOPENCRE
2. Apply saved standards selection on CRE and standard pages #1081 — Apply saved selection on CRE/standard pages (+ view chrome)
3. Apply saved standards selection on search and explorer #1082 — Apply saved selection on search and explorer
4. Filter ga_standards by saved selection, with ?all=true bypass #1083 — Filter ga_standards with ?all=true bypass
5. Shareable CRE URLs stay the full graph; filter is session-only #1084 — Shareable CRE URLs stay the full graph
6. Later: filter chat RAG by saved standards selection #1085 — Later: filter chat RAG by selection (P3)

Existing: #1043 (original deferral; split into #1081 and #1083)