fix: app id in user id queries (#134)

sattvikc · web-flow · commit 3a0e10487ce3 · 2023-07-11T13:20:36.000+05:30
diff --git a/CHANGELOG.md b/CHANGELOG.md
@@ -7,6 +7,11 @@ to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
 ## [Unreleased]
 
+## [4.0.1] - 2023-07-11
+
+- Fixes duplicate users in users search queries when user is associated to multiple tenants
+
+
 ## [4.0.0] - 2023-06-02
 
 ### Changes
diff --git a/build.gradle b/build.gradle
@@ -2,7 +2,7 @@ plugins {
     id 'java-library'
 }
 
-version = "4.0.0"
+version = "4.0.1"
 
 repositories {
     mavenCentral()
diff --git a/src/main/java/io/supertokens/storage/postgresql/queries/EmailPasswordQueries.java b/src/main/java/io/supertokens/storage/postgresql/queries/EmailPasswordQueries.java
@@ -223,7 +223,7 @@ public static UserInfo getUserInfoUsingId_Transaction(Start start, Connection co
             }
             return null;
         });
-        return userInfoWithTenantIds_transaction(start, con, userInfo);
+        return userInfoWithTenantIds_transaction(start, con, appIdentifier, userInfo);
     }
 
     public static PasswordResetTokenInfo getPasswordResetTokenInfo(Start start, AppIdentifier appIdentifier, String token)
@@ -306,7 +306,7 @@ public static UserInfo signUp(Start start, TenantIdentifier tenantIdentifier, St
                     });
                 }
 
-                UserInfo userInfo = userInfoWithTenantIds_transaction(start, sqlCon, new UserInfoPartial(userId, email, passwordHash, timeJoined));
+                UserInfo userInfo = userInfoWithTenantIds_transaction(start, sqlCon, tenantIdentifier.toAppIdentifier(), new UserInfoPartial(userId, email, passwordHash, timeJoined));
 
                 sqlCon.commit();
                 return userInfo;
@@ -352,7 +352,7 @@ public static UserInfo getUserInfoUsingId(Start start, AppIdentifier appIdentifi
             }
             return null;
         });
-        return userInfoWithTenantIds(start, userInfo);
+        return userInfoWithTenantIds(start, appIdentifier, userInfo);
     }
 
     public static UserInfoPartial getUserInfoUsingId(Start start, Connection sqlCon, AppIdentifier appIdentifier, String id) throws SQLException, StorageQueryException {
@@ -371,13 +371,13 @@ public static UserInfoPartial getUserInfoUsingId(Start start, Connection sqlCon,
         });
     }
 
-    public static List<UserInfo> getUsersInfoUsingIdList(Start start, List<String> ids)
+    public static List<UserInfo> getUsersInfoUsingIdList(Start start, AppIdentifier appIdentifier, List<String> ids)
             throws SQLException, StorageQueryException {
         if (ids.size() > 0) {
             // No need to filter based on tenantId because the id list is already filtered for a tenant
             StringBuilder QUERY = new StringBuilder("SELECT user_id, email,  password_hash, time_joined "
                     + "FROM " + getConfig(start).getEmailPasswordUsersTable());
-            QUERY.append(" WHERE user_id IN (");
+            QUERY.append(" WHERE app_id = ? AND user_id IN (");
             for (int i = 0; i < ids.size(); i++) {
 
                 QUERY.append("?");
@@ -389,9 +389,10 @@ public static List<UserInfo> getUsersInfoUsingIdList(Start start, List<String> i
             QUERY.append(")");
 
             List<UserInfoPartial> userInfos = execute(start, QUERY.toString(), pst -> {
+                pst.setString(1, appIdentifier.getAppId());
                 for (int i = 0; i < ids.size(); i++) {
-                    // i+1 cause this starts with 1 and not 0
-                    pst.setString(i + 1, ids.get(i));
+                    // i+2 cause this starts with 1 and not 0, and 1 is appId
+                    pst.setString(i + 2, ids.get(i));
                 }
             }, result -> {
                 List<UserInfoPartial> finalResult = new ArrayList<>();
@@ -400,7 +401,7 @@ public static List<UserInfo> getUsersInfoUsingIdList(Start start, List<String> i
                 }
                 return finalResult;
             });
-            return userInfoWithTenantIds(start, userInfos);
+            return userInfoWithTenantIds(start, appIdentifier, userInfos);
         }
         return Collections.emptyList();
     }
@@ -423,7 +424,7 @@ public static UserInfo getUserInfoUsingEmail(Start start, TenantIdentifier tenan
             }
             return null;
         });
-        return userInfoWithTenantIds(start, userInfo);
+        return userInfoWithTenantIds(start, tenantIdentifier.toAppIdentifier(), userInfo);
     }
 
     public static boolean addUserIdToTenant_Transaction(Start start, Connection sqlCon,
@@ -477,35 +478,35 @@ public static boolean removeUserIdFromTenant_Transaction(Start start, Connection
         // automatically deleted from emailpassword_user_to_tenant because of foreign key constraint
     }
 
-    private static UserInfo userInfoWithTenantIds(Start start, UserInfoPartial userInfo)
+    private static UserInfo userInfoWithTenantIds(Start start, AppIdentifier appIdentifier, UserInfoPartial userInfo)
             throws SQLException, StorageQueryException {
         if (userInfo == null) return null;
         try (Connection con = ConnectionPool.getConnection(start)) {
-            return userInfoWithTenantIds_transaction(start, con, Arrays.asList(userInfo)).get(0);
+            return userInfoWithTenantIds_transaction(start, con, appIdentifier, Arrays.asList(userInfo)).get(0);
         }
     }
 
-    private static List<UserInfo> userInfoWithTenantIds(Start start, List<UserInfoPartial> userInfos)
+    private static List<UserInfo> userInfoWithTenantIds(Start start, AppIdentifier appIdentifier, List<UserInfoPartial> userInfos)
             throws SQLException, StorageQueryException {
         try (Connection con = ConnectionPool.getConnection(start)) {
-            return userInfoWithTenantIds_transaction(start, con, userInfos);
+            return userInfoWithTenantIds_transaction(start, con, appIdentifier, userInfos);
         }
     }
 
-    private static UserInfo userInfoWithTenantIds_transaction(Start start, Connection sqlCon, UserInfoPartial userInfo)
+    private static UserInfo userInfoWithTenantIds_transaction(Start start, Connection sqlCon, AppIdentifier appIdentifier, UserInfoPartial userInfo)
             throws SQLException, StorageQueryException {
         if (userInfo == null) return null;
-        return userInfoWithTenantIds_transaction(start, sqlCon, Arrays.asList(userInfo)).get(0);
+        return userInfoWithTenantIds_transaction(start, sqlCon, appIdentifier, Arrays.asList(userInfo)).get(0);
     }
 
-    private static List<UserInfo> userInfoWithTenantIds_transaction(Start start, Connection sqlCon, List<UserInfoPartial> userInfos)
+    private static List<UserInfo> userInfoWithTenantIds_transaction(Start start, Connection sqlCon, AppIdentifier appIdentifier, List<UserInfoPartial> userInfos)
             throws SQLException, StorageQueryException {
         String[] userIds = new String[userInfos.size()];
         for (int i = 0; i < userInfos.size(); i++) {
             userIds[i] = userInfos.get(i).id;
         }
 
-        Map<String, List<String>> tenantIdsForUserIds = GeneralQueries.getTenantIdsForUserIds_transaction(start, sqlCon, userIds);
+        Map<String, List<String>> tenantIdsForUserIds = GeneralQueries.getTenantIdsForUserIds_transaction(start, sqlCon, appIdentifier, userIds);
         List<UserInfo> result = new ArrayList<>();
         for (UserInfoPartial userInfo : userInfos) {
             result.add(new UserInfo(userInfo.id, userInfo.email, userInfo.passwordHash, userInfo.timeJoined,
diff --git a/src/main/java/io/supertokens/storage/postgresql/queries/GeneralQueries.java b/src/main/java/io/supertokens/storage/postgresql/queries/GeneralQueries.java
@@ -712,6 +712,7 @@ public static AuthRecipeUserInfo[] getUsers(Start start, TenantIdentifier tenant
                                 + " AS allAuthUsersTable" +
                                 " JOIN " + getConfig(start).getEmailPasswordUserToTenantTable()
                                 + " AS emailpasswordTable ON allAuthUsersTable.app_id = emailpasswordTable.app_id AND "
+                                + "allAuthUsersTable.tenant_id = emailpasswordTable.tenant_id AND "
                                 + "allAuthUsersTable.user_id = emailpasswordTable.user_id";
 
                         // attach email tags to queries
@@ -737,15 +738,14 @@ public static AuthRecipeUserInfo[] getUsers(Start start, TenantIdentifier tenant
                     // check if we should search through the thirdparty table
                     if (dashboardSearchTags.shouldThirdPartyTableBeSearched()) {
                         String QUERY = "SELECT  allAuthUsersTable.*" + " FROM " + getConfig(start).getUsersTable()
-                                + " AS allAuthUsersTable" +
-                                " JOIN " + getConfig(start).getThirdPartyUsersTable()
-                                + " AS thirdPartyTable ON allAuthUsersTable.app_id = thirdPartyTable.app_id AND"
-                                + " allAuthUsersTable.user_id = thirdPartyTable.user_id"
+                                + " AS allAuthUsersTable"
                                 + " JOIN " + getConfig(start).getThirdPartyUserToTenantTable()
-                                +
-                                " AS thirdPartyToTenantTable ON thirdPartyTable.app_id = thirdPartyToTenantTable" +
-                                ".app_id AND"
-                                + " thirdPartyTable.user_id = thirdPartyToTenantTable.user_id";
+                                + " AS thirdPartyToTenantTable ON allAuthUsersTable.app_id = thirdPartyToTenantTable.app_id AND"
+                                + " allAuthUsersTable.tenant_id = thirdPartyToTenantTable.tenant_id AND"
+                                + " allAuthUsersTable.user_id = thirdPartyToTenantTable.user_id"
+                                + " JOIN " + getConfig(start).getThirdPartyUsersTable()
+                                + " AS thirdPartyTable ON thirdPartyToTenantTable.app_id = thirdPartyTable.app_id AND"
+                                + " thirdPartyToTenantTable.user_id = thirdPartyTable.user_id";
 
                         // check if email tag is present
                         if (dashboardSearchTags.emails != null) {
@@ -810,6 +810,7 @@ public static AuthRecipeUserInfo[] getUsers(Start start, TenantIdentifier tenant
                                 + " AS allAuthUsersTable" +
                                 " JOIN " + getConfig(start).getPasswordlessUserToTenantTable()
                                 + " AS passwordlessTable ON allAuthUsersTable.app_id = passwordlessTable.app_id AND"
+                                + " allAuthUsersTable.tenant_id = passwordlessTable.tenant_id AND"
                                 + " allAuthUsersTable.user_id = passwordlessTable.user_id";
 
                         // check if email tag is present
@@ -985,7 +986,7 @@ public static AuthRecipeUserInfo[] getUsers(Start start, TenantIdentifier tenant
         // we give the userId[] for each recipe to fetch all those user's details
         for (RECIPE_ID recipeId : recipeIdToUserIdListMap.keySet()) {
             List<? extends AuthRecipeUserInfo> users = getUserInfoForRecipeIdFromUserIds(start,
-                    tenantIdentifier, recipeId, recipeIdToUserIdListMap.get(recipeId));
+                    tenantIdentifier.toAppIdentifier(), recipeId, recipeIdToUserIdListMap.get(recipeId));
 
             // we fill in all the slots in finalResult based on their position in
             // usersFromQuery
@@ -1004,16 +1005,16 @@ public static AuthRecipeUserInfo[] getUsers(Start start, TenantIdentifier tenant
     }
 
     private static List<? extends AuthRecipeUserInfo> getUserInfoForRecipeIdFromUserIds(Start start,
-                                                                                        TenantIdentifier tenantIdentifier,
+                                                                                        AppIdentifier appIdentifier,
                                                                                         RECIPE_ID recipeId,
                                                                                         List<String> userIds)
             throws StorageQueryException, SQLException {
         if (recipeId == RECIPE_ID.EMAIL_PASSWORD) {
-            return EmailPasswordQueries.getUsersInfoUsingIdList(start, userIds);
+            return EmailPasswordQueries.getUsersInfoUsingIdList(start, appIdentifier, userIds);
         } else if (recipeId == RECIPE_ID.THIRD_PARTY) {
-            return ThirdPartyQueries.getUsersInfoUsingIdList(start, userIds);
+            return ThirdPartyQueries.getUsersInfoUsingIdList(start, appIdentifier, userIds);
         } else if (recipeId == RECIPE_ID.PASSWORDLESS) {
-            return PasswordlessQueries.getUsersByIdList(start, userIds);
+            return PasswordlessQueries.getUsersByIdList(start, appIdentifier, userIds);
         } else {
             throw new IllegalArgumentException("No implementation of get users for recipe: " + recipeId.toString());
         }
@@ -1035,12 +1036,12 @@ public static String getRecipeIdForUser_Transaction(Start start, Connection sqlC
         });
     }
 
-    public static Map<String, List<String>> getTenantIdsForUserIds_transaction(Start start, Connection sqlCon, String[] userIds)
+    public static Map<String, List<String>> getTenantIdsForUserIds_transaction(Start start, Connection sqlCon, AppIdentifier appIdentifier, String[] userIds)
             throws SQLException, StorageQueryException {
         if (userIds != null && userIds.length > 0) {
             StringBuilder QUERY = new StringBuilder("SELECT user_id, tenant_id "
                     + "FROM " + getConfig(start).getUsersTable());
-            QUERY.append(" WHERE user_id IN (");
+            QUERY.append(" WHERE app_id = ? AND user_id IN (");
             for (int i = 0; i < userIds.length; i++) {
 
                 QUERY.append("?");
@@ -1052,9 +1053,10 @@ public static Map<String, List<String>> getTenantIdsForUserIds_transaction(Start
             QUERY.append(")");
 
             return execute(sqlCon, QUERY.toString(), pst -> {
+                pst.setString(1, appIdentifier.getAppId());
                 for (int i = 0; i < userIds.length; i++) {
-                    // i+1 cause this starts with 1 and not 0
-                    pst.setString(i + 1, userIds[i]);
+                    // i+2 cause this starts with 1 and not 0, and 1 is appId
+                    pst.setString(i + 2, userIds[i]);
                 }
             }, result -> {
                 Map<String, List<String>> finalResult = new HashMap<>();
diff --git a/src/main/java/io/supertokens/storage/postgresql/queries/PasswordlessQueries.java b/src/main/java/io/supertokens/storage/postgresql/queries/PasswordlessQueries.java
diff --git a/src/main/java/io/supertokens/storage/postgresql/queries/ThirdPartyQueries.java b/src/main/java/io/supertokens/storage/postgresql/queries/ThirdPartyQueries.java

Original file line number	Diff line number	Diff line change
`@@ -2,7 +2,7 @@ plugins {`
`2`	`2`	`id 'java-library'`
`3`	`3`	`}`
`4`	`4`
`5`		`-version = "4.0.0"`
	`5`	`+version = "4.0.1"`
`6`	`6`
`7`	`7`	`repositories {`
`8`	`8`	`mavenCentral()`
Original file line number	Diff line number	Diff line change
`@@ -223,7 +223,7 @@ public static UserInfo getUserInfoUsingId_Transaction(Start start, Connection co`
`223`	`223`	`}`
`224`	`224`	`return null;`
`225`	`225`	`});`
`226`		`- return userInfoWithTenantIds_transaction(start, con, userInfo);`
	`226`	`+ return userInfoWithTenantIds_transaction(start, con, appIdentifier, userInfo);`
`227`	`227`	`}`
`228`	`228`
`229`	`229`	`public static PasswordResetTokenInfo getPasswordResetTokenInfo(Start start, AppIdentifier appIdentifier, String token)`
`@@ -306,7 +306,7 @@ public static UserInfo signUp(Start start, TenantIdentifier tenantIdentifier, St`
`306`	`306`	`});`
`307`	`307`	`}`
`308`	`308`
`309`		`- UserInfo userInfo = userInfoWithTenantIds_transaction(start, sqlCon, new UserInfoPartial(userId, email, passwordHash, timeJoined));`
	`309`	`+ UserInfo userInfo = userInfoWithTenantIds_transaction(start, sqlCon, tenantIdentifier.toAppIdentifier(), new UserInfoPartial(userId, email, passwordHash, timeJoined));`
`310`	`310`
`311`	`311`	`sqlCon.commit();`
`312`	`312`	`return userInfo;`
`@@ -352,7 +352,7 @@ public static UserInfo getUserInfoUsingId(Start start, AppIdentifier appIdentifi`
`352`	`352`	`}`
`353`	`353`	`return null;`
`354`	`354`	`});`
`355`		`- return userInfoWithTenantIds(start, userInfo);`
	`355`	`+ return userInfoWithTenantIds(start, appIdentifier, userInfo);`
`356`	`356`	`}`
`357`	`357`
`358`	`358`	`public static UserInfoPartial getUserInfoUsingId(Start start, Connection sqlCon, AppIdentifier appIdentifier, String id) throws SQLException, StorageQueryException {`
`@@ -371,13 +371,13 @@ public static UserInfoPartial getUserInfoUsingId(Start start, Connection sqlCon,`
`371`	`371`	`});`
`372`	`372`	`}`
`373`	`373`
`374`		`- public static List<UserInfo> getUsersInfoUsingIdList(Start start, List<String> ids)`
	`374`	`+ public static List<UserInfo> getUsersInfoUsingIdList(Start start, AppIdentifier appIdentifier, List<String> ids)`
`375`	`375`	`throws SQLException, StorageQueryException {`
`376`	`376`	`if (ids.size() > 0) {`
`377`	`377`	`// No need to filter based on tenantId because the id list is already filtered for a tenant`
`378`	`378`	`StringBuilder QUERY = new StringBuilder("SELECT user_id, email, password_hash, time_joined "`
`379`	`379`	`+ "FROM " + getConfig(start).getEmailPasswordUsersTable());`
`380`		`- QUERY.append(" WHERE user_id IN (");`
	`380`	`+ QUERY.append(" WHERE app_id = ? AND user_id IN (");`
`381`	`381`	`for (int i = 0; i < ids.size(); i++) {`
`382`	`382`
`383`	`383`	`QUERY.append("?");`
`@@ -389,9 +389,10 @@ public static List<UserInfo> getUsersInfoUsingIdList(Start start, List<String> i`
`389`	`389`	`QUERY.append(")");`
`390`	`390`
`391`	`391`	`List<UserInfoPartial> userInfos = execute(start, QUERY.toString(), pst -> {`
	`392`	`+ pst.setString(1, appIdentifier.getAppId());`
`392`	`393`	`for (int i = 0; i < ids.size(); i++) {`
`393`		`- // i+1 cause this starts with 1 and not 0`
`394`		`- pst.setString(i + 1, ids.get(i));`
	`394`	`+ // i+2 cause this starts with 1 and not 0, and 1 is appId`
	`395`	`+ pst.setString(i + 2, ids.get(i));`
`395`	`396`	`}`
`396`	`397`	`}, result -> {`
`397`	`398`	`List<UserInfoPartial> finalResult = new ArrayList<>();`
`@@ -400,7 +401,7 @@ public static List<UserInfo> getUsersInfoUsingIdList(Start start, List<String> i`
`400`	`401`	`}`
`401`	`402`	`return finalResult;`
`402`	`403`	`});`
`403`		`- return userInfoWithTenantIds(start, userInfos);`
	`404`	`+ return userInfoWithTenantIds(start, appIdentifier, userInfos);`
`404`	`405`	`}`
`405`	`406`	`return Collections.emptyList();`
`406`	`407`	`}`
`@@ -423,7 +424,7 @@ public static UserInfo getUserInfoUsingEmail(Start start, TenantIdentifier tenan`
`423`	`424`	`}`
`424`	`425`	`return null;`
`425`	`426`	`});`
`426`		`- return userInfoWithTenantIds(start, userInfo);`
	`427`	`+ return userInfoWithTenantIds(start, tenantIdentifier.toAppIdentifier(), userInfo);`
`427`	`428`	`}`
`428`	`429`
`429`	`430`	`public static boolean addUserIdToTenant_Transaction(Start start, Connection sqlCon,`
`@@ -477,35 +478,35 @@ public static boolean removeUserIdFromTenant_Transaction(Start start, Connection`
`477`	`478`	`// automatically deleted from emailpassword_user_to_tenant because of foreign key constraint`
`478`	`479`	`}`
`479`	`480`
`480`		`- private static UserInfo userInfoWithTenantIds(Start start, UserInfoPartial userInfo)`
	`481`	`+ private static UserInfo userInfoWithTenantIds(Start start, AppIdentifier appIdentifier, UserInfoPartial userInfo)`
`481`	`482`	`throws SQLException, StorageQueryException {`
`482`	`483`	`if (userInfo == null) return null;`
`483`	`484`	`try (Connection con = ConnectionPool.getConnection(start)) {`
`484`		`- return userInfoWithTenantIds_transaction(start, con, Arrays.asList(userInfo)).get(0);`
	`485`	`+ return userInfoWithTenantIds_transaction(start, con, appIdentifier, Arrays.asList(userInfo)).get(0);`
`485`	`486`	`}`
`486`	`487`	`}`
`487`	`488`
`488`		`- private static List<UserInfo> userInfoWithTenantIds(Start start, List<UserInfoPartial> userInfos)`
	`489`	`+ private static List<UserInfo> userInfoWithTenantIds(Start start, AppIdentifier appIdentifier, List<UserInfoPartial> userInfos)`
`489`	`490`	`throws SQLException, StorageQueryException {`
`490`	`491`	`try (Connection con = ConnectionPool.getConnection(start)) {`
`491`		`- return userInfoWithTenantIds_transaction(start, con, userInfos);`
	`492`	`+ return userInfoWithTenantIds_transaction(start, con, appIdentifier, userInfos);`
`492`	`493`	`}`
`493`	`494`	`}`
`494`	`495`
`495`		`- private static UserInfo userInfoWithTenantIds_transaction(Start start, Connection sqlCon, UserInfoPartial userInfo)`
	`496`	`+ private static UserInfo userInfoWithTenantIds_transaction(Start start, Connection sqlCon, AppIdentifier appIdentifier, UserInfoPartial userInfo)`
`496`	`497`	`throws SQLException, StorageQueryException {`
`497`	`498`	`if (userInfo == null) return null;`
`498`		`- return userInfoWithTenantIds_transaction(start, sqlCon, Arrays.asList(userInfo)).get(0);`
	`499`	`+ return userInfoWithTenantIds_transaction(start, sqlCon, appIdentifier, Arrays.asList(userInfo)).get(0);`
`499`	`500`	`}`
`500`	`501`
`501`		`- private static List<UserInfo> userInfoWithTenantIds_transaction(Start start, Connection sqlCon, List<UserInfoPartial> userInfos)`
	`502`	`+ private static List<UserInfo> userInfoWithTenantIds_transaction(Start start, Connection sqlCon, AppIdentifier appIdentifier, List<UserInfoPartial> userInfos)`
`502`	`503`	`throws SQLException, StorageQueryException {`
`503`	`504`	`String[] userIds = new String[userInfos.size()];`
`504`	`505`	`for (int i = 0; i < userInfos.size(); i++) {`
`505`	`506`	`userIds[i] = userInfos.get(i).id;`
`506`	`507`	`}`
`507`	`508`
`508`		`- Map<String, List<String>> tenantIdsForUserIds = GeneralQueries.getTenantIdsForUserIds_transaction(start, sqlCon, userIds);`
	`509`	`+ Map<String, List<String>> tenantIdsForUserIds = GeneralQueries.getTenantIdsForUserIds_transaction(start, sqlCon, appIdentifier, userIds);`
`509`	`510`	`List<UserInfo> result = new ArrayList<>();`
`510`	`511`	`for (UserInfoPartial userInfo : userInfos) {`
`511`	`512`	`result.add(new UserInfo(userInfo.id, userInfo.email, userInfo.passwordHash, userInfo.timeJoined,`