fix(auth): normalize filters and prevent unbounded filter-based bulk user deletion

[vjymisal0]

Description

Fixes #7020

Problem

When DELETE /orchestrator/user/bulk is invoked with a listingRequest filter object (e.g. from the UI "select all matching across pages" action) and no explicit ids, getUserIdsHonoringFilters constructed query filters directly without applying the standard normalization (SetDefaultValuesIfNotPresent, setStatusFilterType, and setCurrentTimeInUserInfo). This caused requests targeting a subset (e.g. inactive users) to resolve to all users and deactivate unintended accounts. Furthermore, empty bulk deletion payloads were not rejected prior to execution.

Solution

1. Filter Normalization: In UserServiceImpl.getUserIdsHonoringFilters, invoke SetDefaultValuesIfNotPresent, setStatusFilterType, and setCurrentTimeInUserInfo before building and executing the filter query.
2. Payload Validation: Added ValidateBulkDeleteRequest in helper.go to ensure requests contain either concrete IDs or valid filter criteria. Added helper checks on BulkDeleteRequest.
3. Handler Validation: Added request validation check in UserRestHandlerImpl.BulkDeleteUsers to reject malformed/empty payloads with HTTP 400.
4. Testing: Added unit tests covering ValidateBulkDeleteRequest and BulkDeleteUsers in helper_test.go and UserService_test.go.

Files Changed:

• api/auth/user/UserRestHandler.go
• pkg/auth/user/UserService.go
• pkg/auth/user/UserService_test.go
• pkg/auth/user/bean/UserRequest.go
• pkg/auth/user/helper/helper.go
• pkg/auth/user/helper/helper_test.go

[bito-code-review]

Bito Review Skipped - Source Branch Not Found

Bito didn't review this change because the pull request is no longer valid. It may have been merged, or the source/target branch may no longer exist.

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud