Skip to content

[PM-38269] refactor: remove redundant permissions round-trip in OrganizationUserUserDetailsQuery - #8119

Draft
r-tome wants to merge 1 commit into
mainfrom
pm-38269/remove-redundant-permissions-roundtrip
Draft

[PM-38269] refactor: remove redundant permissions round-trip in OrganizationUserUserDetailsQuery#8119
r-tome wants to merge 1 commit into
mainfrom
pm-38269/remove-redundant-permissions-roundtrip

Conversation

@r-tome

@r-tome r-tome commented Jul 31, 2026

Copy link
Copy Markdown
Contributor

🎟️ Tracking

https://bitwarden.atlassian.net/browse/PM-38269

📔 Objective

For each Custom-role user, OrganizationUserUserDetailsQuery was deserializing the Permissions JSON string from the database and immediately re-serializing it back to a string — a no-op round-trip before the string reaches the API response model, which deserializes it once anyway.

This PR removes the three identical if (Type == Custom) blocks from GetOrganizationUserUserDetails, Get, and GetAccountRecoveryEnrolledUsers, and drops the now-unused using Bit.Core.Utilities import.

An API integration test is added to OrganizationUsersControllerGetTests to verify that Custom-user permissions survive the full pipeline (DB → query → response model → JSON) correctly.

@r-tome r-tome added ai-review Request a Claude code review t:tech-debt Change Type - Tech debt labels Jul 31, 2026
@github-actions

github-actions Bot commented Jul 31, 2026

Copy link
Copy Markdown
Contributor

🤖 Bitwarden Claude Code Review

Overall Assessment: APPROVE

Reviewed the removal of the Permissions deserialize/re-serialize round-trip from GetOrganizationUserUserDetails, Get, and GetAccountRecoveryEnrolledUsers, plus the new API integration test. Traced the data path: both response-model constructors (OrganizationUserResponseModel) already call CoreHelpers.LoadClassFromJsonData<Permissions> with the same camelCase JsonSerializerOptions the removed ClassToJsonData call used, so for populated or literal-"null" permission JSON the round-trip produced a byte-identical response, and unknown legacy keys were already dropped by the typed response model. The only behavioral delta is a Custom user whose Permissions column is NULL/empty: permissions changes from null to an all-false object, which is semantically identical and matches what non-Custom users already returned, so it is not flagged. The new integration test exercises DB → query → response model → JSON and matches the shape of its neighbors in test/Api.IntegrationTest/AdminConsole/Controllers/.

Code Review Details
  • ♻️ : GetOrganizationUserUserDetails is now a bare pass-through with no production callers; its unit tests no longer assert meaningful behavior
    • src/Core/AdminConsole/OrganizationFeatures/OrganizationUsers/OrganizationUserUserDetailsQuery.cs:39

…izationUserUserDetailsQuery

For each Custom-role user the query was deserializing the Permissions JSON
string then immediately re-serializing it back — a no-op before the string
reaches the response model, which deserializes it once anyway. Remove the
three identical if (Type == Custom) blocks and the now-unused CoreHelpers
import. Add an API integration test to verify permissions survive the full
pipeline end-to-end.
@r-tome
r-tome force-pushed the pm-38269/remove-redundant-permissions-roundtrip branch from 0f4bebe to e0ba63b Compare July 31, 2026 16:36

return o;
});
return organizationUsers;

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

♻️ DEBT: With the round-trip removed, GetOrganizationUserUserDetails is a bare pass-through with no production callers.

Details

The permissions block was the only logic in this method; it now just forwards to _organizationUserRepository.GetManyDetailsByOrganizationAsync. A repo-wide search for GetOrganizationUserUserDetails finds only the interface declaration, this implementation, and test setup — no caller in src/ or bitwarden_license/ (OrganizationUsersController.GetAll uses Get / GetAccountRecoveryEnrolledUsers).

Related stale tests:

  • test/Api.Test/AdminConsole/Queries/OrganizationUserUserDetailsQueryTests.csGet_HandlesNullPermissionsObject existed to prove the removed GetPermissions()/ClassToJsonData path tolerated a "null" permissions string; it now asserts only that IDs round-trip through a mocked repository.
  • test/Api.Test/AdminConsole/Controllers/OrganizationUsersControllerTests.cs:452GetMany_Setup still stubs GetOrganizationUserUserDetails.

Consider dropping the method plus its interface member and these tests in this PR, or leave a note if it is being kept intentionally for an in-flight consumer.

@codecov

codecov Bot commented Jul 31, 2026

Copy link
Copy Markdown

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 62.95%. Comparing base (b4d4c55) to head (e0ba63b).

Additional details and impacted files
@@             Coverage Diff             @@
##             main    #8119       +/-   ##
===========================================
+ Coverage   14.99%   62.95%   +47.95%     
===========================================
  Files        1409     2301      +892     
  Lines       61097   100187    +39090     
  Branches     4864     9016     +4152     
===========================================
+ Hits         9161    63068    +53907     
+ Misses      51780    34937    -16843     
- Partials      156     2182     +2026     

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:
  • ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
  • 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

ai-review Request a Claude code review t:tech-debt Change Type - Tech debt

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant