Collections do not appear in OAI-PMH when unauthenticated

[ctgraham]

Summary

With the OAI-PMH ListSets verb, public collections do not appear when not authenticated.

Steps to Reproduce Issue

https://d-scholarship.pitt.edu/catalog/oai?verb=ListSets

When authenticated via HTTP cookie, this endpoint includes user collections, such as:

		<set>
			<setSpec>collection:01db6602-1e1f-4e9a-b08f-13824b0f9b91</setSpec>
			<setName>Collection: 01db6602 1e1f 4e9a B08f 13824b0f9b91</setName>
		</set>

When not authenticated via HTTP cookie, the endpoint only listed two admin sets on initial reporting (June 2026):

		<set>
			<setSpec>admin_set:26f0b20f-c1d8-4d80-8fd6-60661065ecbc</setSpec>
			<setName>Admin Set: 26f0b20f C1d8 4d80 8fd6 60661065ecbc</setName>
		</set>
		<set>
			<setSpec>admin_set:656e99ca-c20c-47f1-9752-31f84fbf87ee</setSpec>
			<setName>Admin Set: 656e99ca C20c 47f1 9752 31f84fbf87ee</setName>
		</set>

These admin sets don't correlate by ID to known admin sets, and all 7 admin sets are private in d-scholarship.

Upon retesting in July 2026, unauthenticated ListSets returned all Admin Set with existing Works:

	<ListSets>
		<set>
			<setSpec>admin_set:4de3ae17-bf60-4142-a09b-3fb957eeb902</setSpec>
			<setName>Admin Set: 4de3ae17 Bf60 4142 A09b 3fb957eeb902</setName>
		</set>
		<set>
			<setSpec>admin_set:69a55629-a08f-415e-a038-90b1c066a2cf</setSpec>
			<setName>Admin Set: 69a55629 A08f 415e A038 90b1c066a2cf</setName>
		</set>
		<set>
			<setSpec>admin_set:7f69ca54-2412-4686-9dc5-c43cb8c905b1</setSpec>
			<setName>Admin Set: 7f69ca54 2412 4686 9dc5 C43cb8c905b1</setName>
		</set>
		<set>
			<setSpec>admin_set:8377d479-2171-420a-9e88-ae7c640f61a7</setSpec>
			<setName>Admin Set: 8377d479 2171 420a 9e88 Ae7c640f61a7</setName>
		</set>
		<set>
			<setSpec>admin_set:d26ed598-6409-4c9c-99fb-df2e375f00d1</setSpec>
			<setName>Admin Set: D26ed598 6409 4c9c 99fb Df2e375f00d1</setName>
		</set>
	</ListSets>

Acceptance Criteria

• When unauthenticated, all Admin Sets and all public User Collections are expressed in the OAI-PMH ListSets operation
• When authenticated, all Admin Set and User Collections to which the user has access are expressed in the OAI-PMH ListSets operation.

Screenshots or Video

n/a

Testing Instructions and Sample Files

To be filled out by dev

Notes

[ctgraham]

This has changed in production. The unauthenticated ListSets operation still does not expose any public User Collections (which is an error), but it does expose each Admin Set which contains records.