Function relationship_level 

pub fn relationship_level(
    is_owner: bool,
    connected: bool,
    following: bool,
    is_real_auth: bool,
) -> SubjectAccessLevel

The one relationship ladder, shared so the endpoints that list and the endpoint that searches cannot drift apart.

Callers compute the four inputs themselves, because how you become the owner or a real authenticated caller differs by endpoint — GET /api/search demotes every scoped caller to Public before asking (a file scope is handed to an untrusted app and carries no ambient authority), while GET /api/files resolves a scope through its own share lookup. What must never differ is the ordering below.

can_view_item carries a third copy of the ladder with a different signature: it folds the item owner into the owner test and an is_authenticated flag into is_real_auth.