Skip to content

[73431] SCIM user api return duplicate records#22514

Open
cholarajaa wants to merge 5 commits intoopf:devfrom
cholarajaa:bug/73431-scim-user-api-return-duplicate-records
Open

[73431] SCIM user api return duplicate records#22514
cholarajaa wants to merge 5 commits intoopf:devfrom
cholarajaa:bug/73431-scim-user-api-return-duplicate-records

Conversation

@cholarajaa
Copy link
Copy Markdown

@cholarajaa cholarajaa commented Mar 26, 2026

Ticket
https://community.openproject.org/projects/openproject/work_packages/73431

What are you trying to accomplish?
Fix duplicate records in the SCIM v2 Users API index response.

This PR includes:

[#73431] Fix SCIM v2 user API returning duplicate records
[#73431] Add tests for duplicate SCIM v2 user results
Users could appear multiple times in SCIM index results when they had multiple group memberships or multiple auth provider links.

Screenshots
N/A — backend API change (no UI changes).

What approach did you choose and why?
I added .distinct to the SCIM index query path to ensure each user is returned only once, even when left_joins expands rows through related tables.

I also extracted small helper methods (scim_index_storage_query, scim_all_attribute_names) to keep the action easier to read and maintain.

I added request specs to cover the regression and verify that duplicate users are not returned.

Merge checklist

  • Added/updated tests
  • Added/updated documentation in Lookbook (patterns, previews, etc)
  • Tested major browsers (Chrome, Firefox, Edge, ...)

The index action on the SCIM users endpoint was returning duplicate
records when a user belonged to multiple groups or had multiple auth
provider links. This happened because storage_scope uses left_joins,
which produces one row per join match.

Added .distinct to the index query to eliminate duplicates. Also
extracted scim_index_storage_query and scim_all_attribute_names into
their own private methods for better readability.
Adds request specs for the SCIM v2 users index endpoint to make sure
each user is returned only once, even with multiple group memberships
or auth provider links.

Covers the duplicate-record regression caused by joined relations.
@github-actions
Copy link
Copy Markdown

github-actions bot commented Mar 26, 2026

All contributors have signed the CLA ✍️ ✅
Posted by the CLA Assistant Lite bot.

@cholarajaa cholarajaa changed the title Bug/73431 SCIM user api return duplicate records [73431] SCIM user api return duplicate records Mar 26, 2026
@cholarajaa
Copy link
Copy Markdown
Author

recheck

@cholarajaa
Copy link
Copy Markdown
Author

I have read the CLA Document and I hereby sign the CLA

@cholarajaa
Copy link
Copy Markdown
Author

recheck

@cholarajaa
Copy link
Copy Markdown
Author

@NobodysNightmare Please review.

@ba1ash ba1ash self-requested a review March 30, 2026 12:07
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Development

Successfully merging this pull request may close these issues.

2 participants