Skip to content

fix(auth): normalize filter request and apply status filtering during bulk delete - #7023

Open
Tyagiquamar wants to merge 1 commit into
devtron-labs:mainfrom
Tyagiquamar:fix/bulk-delete-filter-resolution
Open

fix(auth): normalize filter request and apply status filtering during bulk delete#7023
Tyagiquamar wants to merge 1 commit into
devtron-labs:mainfrom
Tyagiquamar:fix/bulk-delete-filter-resolution

Conversation

@Tyagiquamar

Copy link
Copy Markdown

Closes #7020

Problem

When DELETE /orchestrator/user/bulk (and DELETE /orchestrator/role-group/bulk) was executed with a listingRequest filter (e.g. {"listingRequest":{"searchKey":"","status":["inactive"]}}), getUserIdsHonoringFilters and getGroupIdsHonoringFilters invoked the query builder without running default request normalization (SetDefaultValuesIfNotPresent) or setting status filter types (setStatusFilterType, setCurrentTimeInUserInfo). As a result, status filters were not applied and unbounded default scans could target all users instead of the filtered subset. Additionally, if the filter resolved to 0 IDs, the delete routines did not early-exit.

Solution

  1. In getUserIdsHonoringFilters (pkg/auth/user/UserService.go), invoked SetDefaultValuesIfNotPresent, setStatusFilterType, and setCurrentTimeInUserInfo before building the query.
  2. In getGroupIdsHonoringFilters (pkg/auth/user/RoleGroupService.go), invoked SetDefaultValuesIfNotPresent before building the query.
  3. Added early return guards in BulkDeleteUsers and BulkDeleteRoleGroups when resolved request.Ids is empty.
  4. Added unit tests for query building with search, pagination, and count checks in pkg/auth/user/repository/helper/UserRepositoryQueryBuilder_test.go.

@bito-code-review

Copy link
Copy Markdown

Bito Review Skipped - Source Branch Not Found

Bito didn't review this change because the pull request is no longer valid. It may have been merged, or the source/target branch may no longer exist.

@sonarqubecloud

sonarqubecloud Bot commented Sep 6, 2026

Copy link
Copy Markdown

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

Bug: Filter-based bulk user delete (DELETE /orchestrator/user/bulk) deletes far more users than the filter implies

1 participant