Add paginated object-dependencies endpoint for users, avoid OOM

[jcPimcore]

Changes in this pull request

Resolves: pimcore/platform-version#308 Studio UI
Resolves: pimcore/admin-ui-classic-bundle#1106 Studio UI

GET /user/{id} OOMs / times out when the user is referenced by a very large number of DataObjects via a User-type class field, because ObjectDependenciesService::getDependenciesForUser() unconditionally hydrated every matching object and embedded the full, unbounded list in every response (same class of bug as pimcore/admin-ui-classic-bundle#1106, just not yet reported for Studio).

• Add ObjectDependenciesRepository/Interface: reproduces the class/field discovery, but counts matches per class first (cheap, non-hydrating) and only ever hydrates the slice of objects that falls inside a requested offset/limit window - bounded regardless of total match count or page depth.
• Add a new paginated GET /user/{id}/object-dependencies endpoint (GetObjectDependenciesController), modeled on the existing generic element Dependencies tab's CollectionController, to browse the full list. Enforces a MAX_PAGE_SIZE of 100 (matching the largest page size selectable in the Studio UI) before offset/limit are computed, and resolves/authorizes the target user first (404 if unknown, 403 if it's an admin and the caller isn't) instead of silently returning 200 with an empty collection.
• No schema-breaking change, but a real behavioral impact worth knowing about: objectDependencies on the main User schema keeps its existing dependencies/hasHidden fields exactly as they were (same names, same types) - it only gains a new field, totalItems, alongside them. totalItems is marked optional in the OpenAPI schema (even though it's always present in the actual response) specifically because studio-ui-bundle is an actively-published npm package and this type is re-exported through its public SDK entry point - making it required would generate a non-optional TS field and break any existing consumer code constructing/mocking a value of that type. However, dependencies previously contained the user's complete list of referencing objects, and now stops at 20. Any existing integration that assumed dependencies was exhaustive (rather than checking totalItems) will now silently see only the first 20 - such integrations must start reading totalItems and, if it exceeds dependencies.length, call the new paginated endpoint for the rest. hasHidden is affected the same way: it now only reflects permission-denied objects within that 20-item window, not across the full list as before. getPreviewForUser() is a new service method used only by UserHydrator for this embedded preview, kept separate from getPaginatedDependenciesForUser() (used by the new endpoint, returns the generic Collection type).
• Multi-User-field classes: dependency matching now joins conditions with OR instead of AND - an object referencing the user via any one of several User-type fields was previously excluded from both the preview and the endpoint unless every field matched.
• Deterministic ORDER BY id on the underlying listings, so offset/limit paging is stable across requests (verified: two adjacent pages against real data have zero overlap and no gap).
• Upgrade note added/refined across a few passes to accurately describe the above.

Additional info

Verified against a real 50,000-object repro (a backend user referenced by 50,000 DataObjects via a user field, via the real DI container against the live DB, not just unit-mocked):

• The new endpoint returns exactly the requested page (tested page 1, a mid page, and the true last page) with correct totalItems; memory stays flat across page depth (no growth as offset increases).
• UserHydrator's embedded preview returns class=ObjectDependencies, hasHidden=false, dependencies=20, totalItems=50000 in ~0.2s / ~90MB peak (bounded, no OOM).
• Schema/User.php diffs as byte-for-byte identical to its pre-change state; ObjectDependencies.php diffs as purely additive (only totalItems + its getter added, dependencies/hasHidden untouched).
• A focused unit test (ObjectDependenciesRepositoryTest) covers the cross-class pagination windowing math directly (class-boundary pages, deep offsets, exhausted budget, exact boundaries), since the surrounding dynamic class-discovery/listing code has no fixtures in this bundle's unit suite.

Related: pimcore/studio-ui-bundle's fix/308-paginated-user-object-dependencies (frontend for this endpoint), pimcore/ee-admin-ui-classic-bundle's fix/308-cap-user-object-dependencies (short-term cap for the classic admin UI, same root issue).

🤖 Generated with Claude Code

[Copilot]

Pull request overview

Adds bounded previews and paginated retrieval for user object dependencies to prevent excessive memory usage.

Changes:

• Adds a paginated object-dependencies endpoint and repository.
• Caps embedded user dependency previews at 20 items.
• Updates tests, API documentation, configuration, and upgrade guidance.

Reviewed changes

Copilot reviewed 13 out of 13 changed files in this pull request and generated 2 comments.

Show a summary per file

File	Description
translations/studio_api_docs.en.yaml	Adds endpoint documentation strings.
tests/Unit/User/Service/ObjectDependenciesServiceTest.php	Tests dependency permission filtering.
src/User/Service/ObjectDependenciesServiceInterface.php	Defines the paginated service API.
src/User/Service/ObjectDependenciesService.php	Hydrates paginated, permitted dependencies.
src/User/Schema/User.php	Uses the preview schema.
src/User/Schema/ObjectDependenciesPreview.php	Defines the bounded preview response.
src/User/Schema/ObjectDependencies.php	Removes the previous unbounded schema.
src/User/Repository/ObjectDependenciesRepositoryInterface.php	Defines paginated repository access.
src/User/Repository/ObjectDependenciesRepository.php	Implements cross-class counting and pagination.
src/User/Hydrator/UserHydrator.php	Builds the 20-item preview.
src/User/Controller/GetObjectDependenciesController.php	Exposes the paginated endpoint.
doc/02_Installation_and_Configuration/05_Upgrade.md	Documents the response schema change.
config/users.yaml	Registers the new repository.

Suppressed comments (3)

src/User/Repository/ObjectDependenciesRepository.php:100

• Joining multiple User-field predicates with AND only finds objects where every User field references this user. An object that references the user in just one of several User fields is omitted from both the page and totalItems; these predicates need OR semantics.

        $list->setCondition(implode(' AND ', $conditionParts), array_fill(0, count($conditionParts), $userId));

src/User/Controller/GetObjectDependenciesController.php:83

• No lookup validates $id before querying class listings, so an unknown user ID returns 200 with an empty collection even though this endpoint advertises NOT_FOUND. It also bypasses the admin-user visibility check used by UserService::getUserById(). Resolve and authorize the target user before returning dependencies.

        $collection = $this->objectDependenciesService->getPaginatedDependenciesForUser($id, $parameters);

src/User/Repository/ObjectDependenciesRepository.php:50

• The object listing is paged with OFFSET/LIMIT but has no ORDER BY. Database row order is not guaranteed, so repeated page requests can overlap or omit dependencies. Apply a deterministic unique order (for example, the object ID) before loading each slice.

                        $list->setOffset($localOffset);
                        $list->setLimit($localLimit);
                        $items = array_merge($items, $list->load());

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[jcPimcore]

Addressed all 5 points from the Copilot review in 2ca20d3:

• ObjectDependenciesRepository: multi-field User conditions now joined with OR instead of AND (an object referencing the user via any one of several User-type fields was previously excluded unless every field matched).
• Added a deterministic ORDER BY id so offset/limit paging is stable across requests — verified against the real 50k-row repro data: two adjacent pages now have zero overlap and no gap.
• GetObjectDependenciesController now resolves and authorizes the target user (404 if missing, 403 if it's an admin and the caller isn't, mirroring UserService::getUserById()) before querying dependencies, instead of silently returning 200 with an empty collection for an unknown/unauthorized id.
• Added a MAX_PAGE_SIZE = 100 cap (matching the largest selectable page size in the Studio UI), enforced before offset/limit are computed, since CollectionParameters has no upper bound on its own and an unbounded pageSize would reintroduce the OOM this endpoint exists to prevent.
• Extracted the cross-class windowing arithmetic into a pure resolveClassWindow() method and added ObjectDependenciesRepositoryTest covering class-boundary pages, deep offsets, exhausted budget, and exact boundaries — the surrounding dynamic class-discovery/listing code still has no unit fixtures in this bundle's suite, but the math that determines pagination correctness is now directly tested.

🤖 Generated with Claude Code

[Copilot]

Pull request overview

Copilot reviewed 13 out of 13 changed files in this pull request and generated no new comments.

Suppressed comments (2)

doc/02_Installation_and_Configuration/05_Upgrade.md:6

• The affected endpoint is singular (GET /user/{id} in GetUserController), so this upgrade note currently directs readers to a nonexistent /users/{id} route. Use the actual route name here.

- [User Management] Fixed: `GET /users/{id}` could time out or run out of memory when the user was referenced by a very large number of DataObjects (e.g. via a `User`-type class field), because the full, unbounded list of referencing objects was hydrated and embedded in every response. The `objectDependencies.dependencies` array on the `User` schema is now capped at 20 entries, and a new paginated `GET /user/{id}/object-dependencies` endpoint was added to browse the full list.

doc/02_Installation_and_Configuration/05_Upgrade.md:8

• Calling this “not a breaking change” is misleading: although the response shape is additive, dependencies previously contained the complete collection and now silently stops at 20. Existing API clients that rely on the full array must migrate to the new endpoint, so the upgrade note should explicitly identify that behavioral compatibility impact.

> **Note:** this is not a breaking change. `objectDependencies` keeps its existing `dependencies`/`hasHidden` fields; it only gains a new `totalItems` field alongside them. `hasHidden` now only reflects permission-denied objects within the 20-item preview window, rather than scanning every referencing object as before - use `totalItems` and `GET /user/{id}/object-dependencies?page=&pageSize=` to see the full picture beyond the preview.

[jcPimcore]

Addressed both points from this review in d8d01a8:

• Fixed the route typo: the upgrade note said GET /users/{id} (plural); the actual route is GET /user/{id} (singular, GetUserController).
• Reworded the "not a breaking change" note - it was an overclaim. To be precise: the objectDependencies schema genuinely has no breaking change (dependencies/hasHidden keep their names, types, and meaning; totalItems is purely additive). But you're right that there's a real behavioral compatibility impact: dependencies previously contained the complete list and now caps at 20. Any consumer that assumed completeness rather than checking totalItems will now silently see a partial view. The note states that plainly now instead of a blanket "not breaking" claim. Also updated the PR description to match.

🤖 Generated with Claude Code

[Copilot]

Pull request overview

Copilot reviewed 13 out of 13 changed files in this pull request and generated no new comments.

[Copilot]

Pull request overview

Copilot reviewed 13 out of 13 changed files in this pull request and generated no new comments.

Suppressed comments (2)

src/User/Controller/GetObjectDependenciesController.php:108

• The controller now performs user lookup and admin authorization directly in addition to calling the dependency service. This duplicates UserService::getUserById() (src/User/Service/UserService.php:157-165) and breaks the User-domain convention that controllers delegate to one service, making alternate service callers bypass these checks. Move target-user resolution and authorization into ObjectDependenciesServiceInterface/its implementation so this controller only invokes that service.

        $targetUser = $this->userRepository->getUserById($id);

        if ($targetUser->isAdmin() && !$this->securityService->getCurrentUser()->isAdmin()) {
            throw new ForbiddenException('Only admins can view other admins');

tests/Unit/User/Repository/ObjectDependenciesRepositoryTest.php:63

• This data provider is non-static, but the repository requires PHPUnit 12.5/13.1, where data providers must be public and static. PHPUnit will therefore reject or skip these cases, leaving the pagination math effectively untested.

    public function windowProvider(): array

[sonarqubecloud]

Quality Gate failed

Failed conditions
1 New Major Issues (required ≤ 0)

See analysis details on SonarQube Cloud

Catch issues before they fail your Quality Gate with our IDE extension SonarQube for IDE