Feature/userinfo by JasonRobertFrancis · Pull Request #273 · ucdavis/VIPER

JasonRobertFrancis · 2026-07-28T16:31:47Z

No description provided.

codecov-commenter · 2026-07-28T16:32:38Z

Bundle Report

Bundle size has no change ✅

codecov-commenter · 2026-07-28T16:33:34Z

Codecov Report

❌ Patch coverage is 27.71962% with 6352 lines in your changes missing coverage. Please review.
✅ Project coverage is 56.19%. Comparing base (dd7f02c) to head (5a8fdb3).
⚠️ Report is 44 commits behind head on main.

Files with missing lines	Patch %	Lines
web/Areas/Directory/Services/UserInfoService.cs	41.45%	764 Missing and 38 partials ⚠️
web/Areas/Directory/Views/UserInfo.cshtml	0.00%	386 Missing ⚠️
web/Models/PPS/VwUserinfoUser.cs	0.00%	149 Missing ⚠️
web/Models/PPS/PsJobV.cs	0.00%	125 Missing ⚠️
web/Models/PPS/JobDV.cs	0.00%	121 Missing ⚠️
web/Models/PPS/JpmJpItemDV.cs	0.00%	121 Missing ⚠️
web/Models/PPS/PositionDV.cs	0.00%	118 Missing ⚠️
web/Models/PPS/PsJpmJpItemsV.cs	0.00%	116 Missing ⚠️
web/Models/PPS/EdbperVc.cs	0.00%	104 Missing ⚠️
web/Models/PPS/VwAllJobPosOrg.cs	0.00%	102 Missing ⚠️
... and 196 more

Additional details and impacted files

@@            Coverage Diff             @@
##             main     #273      +/-   ##
==========================================
+ Coverage   50.07%   56.19%   +6.11%     
==========================================
  Files         998     1196     +198     
  Lines       58354    80434   +22080     
  Branches     5853     6185     +332     
==========================================
+ Hits        29221    45199   +15978     
- Misses      28228    34260    +6032     
- Partials      905      975      +70

Flag	Coverage Δ
backend	`56.02% <27.71%> (+6.77%)`	⬆️
frontend	`58.63% <ø> (+0.17%)`	⬆️

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

github-advanced-security

CodeQL found more than 20 potential problems in the proposed changes. Check the Files changed tab for more details.

…modal) and responds to code-quality bot userinfo recommendations

…t warnings

…and userinfo pages)

Copilot

Pull request overview

This PR expands the Directory/UserInfo functionality and supporting infrastructure in the VIPER web app by adding new UI styling, new/adjusted endpoints for directory search and session timeout, and a large set of scaffolded EF model types + DbContext registrations for additional data domains (PPS, Keys, IDCards, EquipmentLoan).

Changes:

Add Directory “userinfo” styling and wire it into the shared layout.
Add a new /GetSessionTimeout JSON endpoint and adjust the SessionTimeout view component behavior in development.
Introduce new Directory controller APIs and a large set of new EF entity classes, plus DbContext registrations for additional schemas/apps; update LDAP/IAM utilities and tests/docs accordingly.

Reviewed changes

Copilot reviewed 218 out of 220 changed files in this pull request and generated 7 comments.

Show a summary per file

File	Description
web/wwwroot/css/userinfo.css	Adds styling for the Directory “userinfo” page.
web/Viper.csproj	Adjusts build warning suppression configuration.
web/Views/Shared/Components/SessionTimeout/SessionTimeout.cs	Updates session timeout refresh URL behavior.
web/Views/Shared/_VIPERLayout.cshtml	Loads directory/userinfo CSS conditionally; normalizes helper variable naming.
web/Properties/launchSettings.json	Changes local launch behavior (launchBrowser).
web/Program.cs	Registers additional DbContexts and HTTP client services.
web/Models/PPS/VwStipend.cs	Scaffolded PPS EF entity.
web/Models/PPS/VwRankStepEthnicityPayRate.cs	Scaffolded PPS EF entity.
web/Models/PPS/VwPersonAccrual.cs	Scaffolded PPS EF entity.
web/Models/PPS/VwPerson.cs	Scaffolded PPS EF entity.
web/Models/PPS/VwLoa.cs	Scaffolded PPS EF entity.
web/Models/PPS/VwJobCodeAndGroup.cs	Scaffolded PPS EF entity.
web/Models/PPS/VwEmployee.cs	Scaffolded PPS EF entity.
web/Models/PPS/VwAccrualsCdm.cs	Scaffolded PPS EF entity.
web/Models/PPS/VwAccrual.cs	Scaffolded PPS EF entity.
web/Models/PPS/VisaPermitDataDV.cs	Scaffolded PPS EF entity.
web/Models/PPS/UpdateLog.cs	Scaffolded PPS EF entity.
web/Models/PPS/UnionDV.cs	Scaffolded PPS EF entity.
web/Models/PPS/UcpathVerificationItem.cs	Scaffolded PPS EF entity.
web/Models/PPS/UcpathOverride.cs	Scaffolded PPS EF entity.
web/Models/PPS/UcpathmissingpersonBk.cs	Scaffolded PPS EF entity.
web/Models/PPS/UcpathMissingPerson20190821.cs	Scaffolded PPS EF entity.
web/Models/PPS/UcpathMissingPerson.cs	Scaffolded PPS EF entity.
web/Models/PPS/UcpathItemNote.cs	Scaffolded PPS EF entity.
web/Models/PPS/UcdOrganizationDV.cs	Scaffolded PPS EF entity.
web/Models/PPS/UcdFauDV.cs	Scaffolded PPS EF entity.
web/Models/PPS/UcdEmployeeFlagsDV.cs	Scaffolded PPS EF entity.
web/Models/PPS/UcdEmployeeFlagsDOverride.cs	Scaffolded PPS EF entity.
web/Models/PPS/TitlecodeGroup.cs	Scaffolded PPS EF entity.
web/Models/PPS/TimeDailyDV.cs	Scaffolded PPS EF entity.
web/Models/PPS/ServiceCreditUnit.cs	Scaffolded PPS EF entity.
web/Models/PPS/ServiceCredit.cs	Scaffolded PPS EF entity.
web/Models/PPS/PsxlatitemV.cs	Scaffolded PPS EF entity.
web/Models/PPS/PsVisaPmtDataV.cs	Scaffolded PPS EF entity.
web/Models/PPS/PsUnionTblV.cs	Scaffolded PPS EF entity.
web/Models/PPS/PsUcSsDisclosurV.cs	Scaffolded PPS EF entity.
web/Models/PPS/PsUcJobGrpDescV.cs	Scaffolded PPS EF entity.
web/Models/PPS/PsUcJobCodeTblV.cs	Scaffolded PPS EF entity.
web/Models/PPS/PsUcJobCodesV.cs	Scaffolded PPS EF entity.
web/Models/PPS/PsUcFundAttribV.cs	Scaffolded PPS EF entity.
web/Models/PPS/PsUcExtSystemV.cs	Scaffolded PPS EF entity.
web/Models/PPS/PsUcdDmPsNamesPrefVnamesV.cs	Scaffolded PPS EF entity.
web/Models/PPS/PsUcCtoOscV.cs	Scaffolded PPS EF entity.
web/Models/PPS/PsUcAmSsTblV.cs	Scaffolded PPS EF entity.
web/Models/PPS/PsUcAmSsRcdV.cs	Scaffolded PPS EF entity.
web/Models/PPS/PsPrimaryJobsV.cs	Scaffolded PPS EF entity.
web/Models/PPS/PsPersonV.cs	Scaffolded PPS EF entity.
web/Models/PPS/PsPersonalPhoneV.cs	Scaffolded PPS EF entity.
web/Models/PPS/PsPersDataEffdtV.cs	Scaffolded PPS EF entity.
web/Models/PPS/PsPerOrgInstV.cs	Scaffolded PPS EF entity.
web/Models/PPS/PsJpmProfileV.cs	Scaffolded PPS EF entity.
web/Models/PPS/PsJpmCatTypesV.cs	Scaffolded PPS EF entity.
web/Models/PPS/PsJpmCatItemsV.cs	Scaffolded PPS EF entity.
web/Models/PPS/PsGpRsltAcumV.cs	Scaffolded PPS EF entity.
web/Models/PPS/PsGpAbsReasonV.cs	Scaffolded PPS EF entity.
web/Models/PPS/PsGpAbsEaV.cs	Scaffolded PPS EF entity.
web/Models/PPS/PsGpAbsEaStaV.cs	Scaffolded PPS EF entity.
web/Models/PPS/PsEthnicGrpTblV.cs	Scaffolded PPS EF entity.
web/Models/PPS/PsErnProgramTblV.cs	Scaffolded PPS EF entity.
web/Models/PPS/PsEmplClassTblV.cs	Scaffolded PPS EF entity.
web/Models/PPS/PsEmailAddressesV.cs	Scaffolded PPS EF entity.
web/Models/PPS/PsEarningsBalV.cs	Scaffolded PPS EF entity.
web/Models/PPS/PsDiversEthnicV.cs	Scaffolded PPS EF entity.
web/Models/PPS/PsDeptTblV.cs	Scaffolded PPS EF entity.
web/Models/PPS/PsDeptBudgetErnV.cs	Scaffolded PPS EF entity.
web/Models/PPS/PsDeptBudgetDtV.cs	Scaffolded PPS EF entity.
web/Models/PPS/PsCountryTblV.cs	Scaffolded PPS EF entity.
web/Models/PPS/PsCompRatecdTblV.cs	Scaffolded PPS EF entity.
web/Models/PPS/PsCompensationV.cs	Scaffolded PPS EF entity.
web/Models/PPS/PsCitizenStsTblV.cs	Scaffolded PPS EF entity.
web/Models/PPS/PsCitizenshipV.cs	Scaffolded PPS EF entity.
web/Models/PPS/PsAddressTypTblV.cs	Scaffolded PPS EF entity.
web/Models/PPS/PsAddressesV.cs	Scaffolded PPS EF entity.
web/Models/PPS/PsAddlPayDataV.cs	Scaffolded PPS EF entity.
web/Models/PPS/PsActnReasonTblV.cs	Scaffolded PPS EF entity.
web/Models/PPS/PsActionTblV.cs	Scaffolded PPS EF entity.
web/Models/PPS/PsAcctCdTblV.cs	Scaffolded PPS EF entity.
web/Models/PPS/Prj2EmpidToPpsid.cs	Scaffolded PPS EF entity.
web/Models/PPS/PrimaryJobsDV.cs	Scaffolded PPS EF entity.
web/Models/PPS/OrganizationDV.cs	Scaffolded PPS EF entity.
web/Models/PPS/OdsEmployeeFlagsDV.cs	Scaffolded PPS EF entity.
web/Models/PPS/JpmFV.cs	Scaffolded PPS EF entity.
web/Models/PPS/JobStatusDV.cs	Scaffolded PPS EF entity.
web/Models/PPS/JobOverride.cs	Scaffolded PPS EF entity.
web/Models/PPS/JobHistoryDetail.cs	Scaffolded PPS EF entity.
web/Models/PPS/JobHistory.cs	Scaffolded PPS EF entity.
web/Models/PPS/JobActionDV.cs	Scaffolded PPS EF entity.
web/Models/PPS/HistServiceCredit.cs	Scaffolded PPS EF entity.
web/Models/PPS/HistloaV.cs	Scaffolded PPS EF entity.
web/Models/PPS/GoAnywhereLog.cs	Scaffolded PPS EF entity.
web/Models/PPS/FurloughTarget.cs	Scaffolded PPS EF entity.
web/Models/PPS/Export.cs	Scaffolded PPS EF entity.
web/Models/PPS/EthnicityGender20210201.cs	Scaffolded PPS EF entity.
web/Models/PPS/EthnicityGender.cs	Scaffolded PPS EF entity.
web/Models/PPS/EmployeeHistory.cs	Scaffolded PPS EF entity.
web/Models/PPS/EdbeffrptLog.cs	Scaffolded PPS EF entity.
web/Models/PPS/Edbeffrpt.cs	Scaffolded PPS EF entity.
web/Models/PPS/Dvtloa.cs	Scaffolded PPS EF entity.
web/Models/PPS/DiversEthnicityDV.cs	Scaffolded PPS EF entity.
web/Models/PPS/DepartmentDV.cs	Scaffolded PPS EF entity.
web/Models/PPS/DepartmentBudgetEarnFV.cs	Scaffolded PPS EF entity.
web/Models/PPS/Ctvhme.cs	Scaffolded PPS EF entity.
web/Models/PPS/Ctltci.cs	Scaffolded PPS EF entity.
web/Models/PPS/Ctlcad.cs	Scaffolded PPS EF entity.
web/Models/PPS/CompensationFV.cs	Scaffolded PPS EF entity.
web/Models/PPS/CompensationDV.cs	Scaffolded PPS EF entity.
web/Models/PPS/CompensationDRateV.cs	Scaffolded PPS EF entity.
web/Models/PPS/AuditOverride.cs	Scaffolded PPS EF entity.
web/Models/PPS/AccountCodeDV.cs	Scaffolded PPS EF entity.
web/Models/PPS/AbsenceResultFV.cs	Scaffolded PPS EF entity.
web/Models/PPS/AbsenceResultDV.cs	Scaffolded PPS EF entity.
web/Models/PPS/AbsenceEventFV.cs	Scaffolded PPS EF entity.
web/Models/PPS/AbsenceEventDV.cs	Scaffolded PPS EF entity.
web/Models/PPS/AbsenceCalendarDV.cs	Scaffolded PPS EF entity.
web/Models/Keys/VwUserinfo.cs	Scaffolded Keys EF entity/view model.
web/Models/Keys/KeyManager.cs	Scaffolded Keys EF entity.
web/Models/Keys/KeyBuilding.cs	Scaffolded Keys EF entity.
web/Models/Keys/KeyAssignment.cs	Scaffolded Keys EF entity.
web/Models/Keys/Key.cs	Scaffolded Keys EF entity.
web/Models/Keys/Import3.cs	Scaffolded Keys import EF entity.
web/Models/Keys/Import2.cs	Scaffolded Keys import EF entity.
web/Models/Keys/Import.cs	Scaffolded Keys import EF entity.
web/Models/Keys/Disposition.cs	Scaffolded Keys EF entity.
web/Models/Keys/Building.cs	Scaffolded Keys EF entity.
web/Models/IDCards/VwLatestIdcard.cs	Scaffolded IDCards EF view entity.
web/Models/IDCards/VwDelimitedSpecialApprover.cs	Scaffolded IDCards EF view entity.
web/Models/IDCards/VwApproverMothraId.cs	Scaffolded IDCards EF view entity.
web/Models/IDCards/PrintQueue.cs	Scaffolded IDCards EF entity (with navigation).
web/Models/IDCards/PhotoExport.cs	Scaffolded IDCards EF entity.
web/Models/IDCards/LenelBadge.cs	Scaffolded IDCards EF entity.
web/Models/IDCards/IgnoreList.cs	Scaffolded IDCards EF entity.
web/Models/IDCards/IdCardToPrintQueue.cs	Scaffolded join entity.
web/Models/IDCards/IdCard.cs	Scaffolded IDCards EF entity.
web/Models/IDCards/ExtVisit.cs	Scaffolded IDCards EF entity.
web/Models/IDCards/EcoTimeBadgeExclusion.cs	Scaffolded IDCards EF entity.
web/Models/IDCards/DvtSvmUnit.cs	Scaffolded IDCards lookup entity.
web/Models/IDCards/DvtSpecialty.cs	Scaffolded IDCards lookup entity.
web/Models/IDCards/DvtSpecialApprover.cs	Scaffolded IDCards lookup entity.
web/Models/IDCards/DvtReason.cs	Scaffolded IDCards lookup entity.
web/Models/IDCards/DvtOverseer.cs	Scaffolded IDCards lookup entity.
web/Models/IDCards/DvtClient.cs	Scaffolded IDCards lookup entity.
web/Models/IDCards/DvtCardStatus.cs	Scaffolded IDCards lookup entity.
web/Models/IDCards/DvtApprover.cs	Scaffolded IDCards lookup entity.
web/Models/IDCards/Defuncted.cs	Scaffolded IDCards EF entity.
web/Models/IDCards/DbIdCard.cs	Scaffolded IDCards EF entity.
web/Models/IDCards/BulkLoadResult.cs	Scaffolded IDCards EF entity.
web/Models/IDCards/Audit.cs	Scaffolded IDCards audit EF entity.
web/Models/IDCards/AccessLevel.cs	Scaffolded IDCards lookup entity.
web/Models/IDCards/AccessExpiration.cs	Scaffolded IDCards EF entity.
web/Models/EquipmentLoan/VwLoan.cs	Scaffolded EquipmentLoan EF view entity.
web/Models/EquipmentLoan/Reason.cs	Scaffolded EquipmentLoan EF entity.
web/Models/EquipmentLoan/O.cs	Scaffolded EquipmentLoan EF entity (OS lookup).
web/Models/EquipmentLoan/LoanNote.cs	Scaffolded EquipmentLoan EF entity.
web/Models/EquipmentLoan/LoanItem.cs	Scaffolded EquipmentLoan EF entity.
web/Models/EquipmentLoan/Loan.cs	Scaffolded EquipmentLoan EF entity.
web/Models/EquipmentLoan/EmailTemplate.cs	Scaffolded EquipmentLoan EF entity.
web/Models/EquipmentLoan/EmailSent.cs	Scaffolded EquipmentLoan EF entity.
web/Models/EquipmentLoan/Audit.cs	Scaffolded EquipmentLoan audit EF entity.
web/Models/EquipmentLoan/AssetType.cs	Scaffolded EquipmentLoan lookup entity.
web/Models/EquipmentLoan/AssetNote.cs	Scaffolded EquipmentLoan EF entity.
web/Models/EquipmentLoan/Asset.cs	Scaffolded EquipmentLoan EF entity.
web/Models/EquipmentLoan/AppSetting.cs	Scaffolded EquipmentLoan EF entity.
web/Controllers/HomeController.cs	Adds a GetSessionTimeout endpoint.
web/Classes/Utilities/LdapService.cs	Adds MothraID lookup and improves sorting; extends LDAP helpers.
web/Classes/Utilities/IamApi.cs	Adds custom DateTime parsing for IAM API responses.
web/Classes/AreaController.cs	Adds PopulateLeftNav helper and adjusts dev nav link conversion.
web/Areas/Directory/Models/UCPathResult.cs	Adds Directory UCPath DTO.
web/Areas/Directory/Models/LoanResult.cs	Adds Directory loan DTO.
web/Areas/Directory/Models/LdapUserContact.cs	Adjusts LDAP contact model (MothraId nullable).
web/Areas/Directory/Models/KeyResult.cs	Adds Directory key DTO.
web/Areas/Directory/Models/InstinctResult.cs	Adds Directory instinct DTO.
web/Areas/Directory/Models/IndividualSearchResultWithIDs.cs	Adjusts Directory search result mapping.
web/Areas/Directory/Models/IndividualSearchResult.cs	Adjusts Directory search result mapping.
web/Areas/Directory/Models/IDCardResult.cs	Adds Directory ID card DTO.
web/Areas/Directory/Models/DirectoryUser.cs	Adds view model for Directory permissions/features.
web/Areas/Directory/Controllers/DirectoryController.cs	Adds query-based search endpoint and left-nav population.
Viper.sln.DotSettings	Updates ReSharper inspection severities.
test/Usings.cs	Disables xUnit test parallelization globally.
test/Areas/Directory/VMACSServiceTest.cs	Updates VMACS URL validation test cases.
CLAUDE.md	Updates repo contribution/testing guidance.
.gitignore	Updates ignore patterns (currently includes conflict marker and broad ignores).

rlorenzo · 2026-08-03T20:53:18Z

+            if (id == null) return null;
+            string filter = string.Format("(ucdpersonuuid = {0})", id);
+            var results = SearchLdap(filter);


@JasonRobertFrancis Yes, this was flagged in the previous PR and still an issue

    <ImplicitUsings>enable</ImplicitUsings>
    <AppendRuntimeIdentifierToOutputPath>false</AppendRuntimeIdentifierToOutputPath>
    <PublishDir>bin\Release\net10.0\publish\</PublishDir>
+    <NoWarn>$(NoWarn);NU1902;NU1608</NoWarn>


bsedwards

Please address the student information in the user info page - we need to remove sensitive information.

Other things I've noticed:

I was using the directory on secure-test earlier, but now when I search I'm getting an HTML page saying my session has timed out.

I was missing the AAUD Check, ID Check, and UC Path info links on directory entries.
Missing AD information from user info page.
Student information on the user info page only shows 5 flags for me. Please validate the permissions being checked.

bsedwards · 2026-08-03T16:27:49Z

+                return null;
+            }
+
+            Console.WriteLine($"[INSTINCT SERVICE] mothraId: '{mothraId}', iamId: '{iamId}', result.MothraId: '{result.MothraId}'");


I'm not sure we should have console.writeline in production code

bsedwards · 2026-08-03T16:34:09Z

+        /// <summary>
+        /// Get cumulative GPA - equivalent to getCumulativeGPA in SIS.cfc
+        /// </summary>
+        private async Task<string?> GetStudentCumulativeGPAAsync(string pidm, string termCode, string majorCode)


It looks like this is reimplementing every function in SIS.cfc inside UserInfoService.cs. I'm not sure how many of these functions the user info page is actually using (ref previous comment on sensitivity of this info). I suggest implementing these functions in a separate class and having the UserInfoService only reference what is needed and approved for display on the UserInfoPage.

bsedwards · 2026-08-03T16:37:41Z

+                result.StudentBannerId = await GetStudentBannerIdAsync(result.Pidm);
+                result.StudentConfidential = await IsStudentConfidentialAsync(result.Pidm);
+                result.StudentConfidentialScope = await GetStudentConfidentialScopeAsync(result.Pidm);
+                result.StudentBirthDate = await GetStudentBirthDateAsync(result.Pidm);


Are these shown on the User Info page? Many of these fields are sensitive and should only be shown to a small number of users.

bsedwards · 2026-08-03T16:40:40Z

+        public static async Task<byte[]?> GetUserPhotoAsync(string mailId, bool useAltPhoto = false)
+        {
+            // stubbed
+            return null;


bsedwards · 2026-08-03T16:41:52Z

+                var formContent = new FormUrlEncodedContent(formParams);
+                Console.WriteLine("[INSTINCT AUTH] Sending token POST request...");
+                var response = await httpClient.PostAsync(tokenUrl, formContent);
+                Console.WriteLine($"[INSTINCT AUTH] Response Status Code: {response.StatusCode}");


More Console.WriteLine

bsedwards · 2026-08-03T16:47:50Z

+                }
+                <li><strong>Dual Degree?:</strong> @(Model.StudentIsDualDegree ? "Yes" : "No")</li>
+
+                @if (Model.CanViewStudentID)


I'm not sure being able to view the student ID is sufficient permission to view this detail. I would suggest leaving out things like GPA, residency and citizenship, ethnicity, age, etc. off the UserInfo page entirely.

bsedwards · 2026-08-03T16:48:28Z

+                            <li><strong>Student Employer:</strong> @Model.StudentEmployer</li>
+                        }
+                    }
+                    @if (!string.IsNullOrEmpty(Model.StudentPermanentAddress))


Also leave addresses out of this page

bsedwards · 2026-08-03T17:00:18Z

    <ImplicitUsings>enable</ImplicitUsings>
    <AppendRuntimeIdentifierToOutputPath>false</AppendRuntimeIdentifierToOutputPath>
    <PublishDir>bin\Release\net10.0\publish\</PublishDir>
+    <NoWarn>$(NoWarn);NU1902;NU1608</NoWarn>


Do we want to disable warnings on these issues?

bsedwards · 2026-08-03T18:54:22Z

 # Used to reduce unnecessary dotnet builds
 .build-cache/

+<<<<<<< HEAD


Line created during a merge?

bsedwards · 2026-08-03T18:54:49Z


 # Agent folders
 .claude
+CLAUDE.md


Do we want to exclude the .md files? I think Rex committed some.

rlorenzo · 2026-08-03T20:52:25Z

+                userInfo.CanViewInstinct = ownPage || _userHelper.HasPermission(_rapsContext, currentUser, "SVMSecure.userinfo.instinct");
+                userInfo.CanViewADGroups = _userHelper.HasPermission(_rapsContext, currentUser, "SVMSecure.UserInfo.ADGroups");
+
+                userInfo.CanViewDirectoryDetail = true;


@JasonRobertFrancis The permission overrides are still in place. This has got to be debugging code, right?

rlorenzo · 2026-08-03T20:53:18Z

+            if (id == null) return null;
+            string filter = string.Format("(ucdpersonuuid = {0})", id);
+            var results = SearchLdap(filter);


@JasonRobertFrancis Yes, this was flagged in the previous PR and still an issue

rlorenzo · 2026-08-03T21:02:41Z

+            return NotFound();
+        }
+
+        [Route("/[area]/nav")]


@JasonRobertFrancis This will conflict with the /nav route for the Directory. Go to https://secure-test.vetmed.ucdavis.edu/2/Directory/nav and it will give an error that it doesn't on main/PROD.

rlorenzo · 2026-08-03T21:03:59Z

+                <img src="https://viper.vetmed.ucdavis.edu/public/utilities/getbase64image.cfm?mailid=@Model.MailId" width="87" height="111" alt="User Photo" />
+            </span>
+            <span class="photo2">
+                <img src="https://viper.vetmed.ucdavis.edu/public/utilities/getbase64image.cfm?mailid=@Model.MailId&amp;altphoto=1" width="87" height="111" alt="Alternative Photo" />


This shouldn't be hardcoded to prod VIPER1, right?

rlorenzo · 2026-08-03T21:04:14Z

+        <div class="direct">
+            <h2>User Information Page</h2>
+            <span class="photo">
+                <img src="https://viper.vetmed.ucdavis.edu/public/utilities/getbase64image.cfm?mailid=@Model.MailId" width="87" height="111" alt="User Photo" />


This shouldn't be hardcoded to prod VIPER1, right?

rlorenzo · 2026-08-03T21:05:15Z

+                {
+                    <li><strong>Banner ID:</strong> @Model.StudentBannerId</li>
+                }
+                <li><strong>Confidential?:</strong> @(Model.StudentConfidential ? "Yes" : "No")</li>


The flag is fetched, but it does not appear to be used to suppress any data. Is that right?

rlorenzo · 2026-08-03T21:06:11Z

+CLAUDE.md
+
+# Temp Agent Files
+DESIGN.md*


These should not be ignored either

rlorenzo · 2026-08-03T21:07:13Z

      "commandName": "Project",
      "dotnetRunMessages": true,
-      "launchBrowser": false,
+      "launchBrowser": true,


Not needed. If you use npm run dev the browser will be opened for you

rlorenzo · 2026-08-04T01:12:44Z

 </article>
+
+@section Scripts {
+    <script src="~/js/userinfo.js"></script>


This JS file does not exist

rlorenzo · 2026-08-04T01:14:32Z

+        {
+            if (vm?.item != null)
+            {
+                if (vm.item.Nextel != null) result.Nextel = vm.item.Nextel[0];


An empty value for Nextel/LDPager/Unit can crash the search.

Suggested code:

private static void PopulateVmacsDetails(IndividualSearchResult result, VMACSQuery? vm) { var item = vm?.item; if (item == null) { return; } if (item.Nextel is { Length: > 0 }) result.Nextel = item.Nextel[0]; if (item.LDPager is { Length: > 0 }) result.LDPager = item.LDPager[0]; if (item.Unit is { Length: > 0 }) result.Department = item.Unit[0]; }

rlorenzo · 2026-08-04T01:17:49Z

+                    .ThenByDescending(p => p.Effdt)
+                    .ToListAsync();
+
+                foreach (var history in historyData)


From a Claude code analysis:

N+1 with synchronous blocking EF calls in an async request
UserInfoService.cs:1333-1348 calls GetReportsToName(history) and GetReportsToPosition(history) per UCPath history row. Each helper (1359-1433) issues up to two FirstOrDefault() calls — synchronous, not FirstOrDefaultAsync — at lines 1367, 1377, 1405, 1416. And the two helpers query the identical rows independently, so it's up to 4 blocking round-trips per row where 1 async batch would do. A person with 30 job actions is 120 sequential blocking DB calls holding a thread-pool thread.

Also:

PopulateKeysAsync:1498 — one AAUD query per key assignment to resolve IssuedBy

GetUserPermissionsForSystemAsync — called 5× from 1126-1136, re-running the same two large RAPS joins each time; only the trailing StartsWith(systemPrefix) filter differs

No .AsNoTracking() anywhere in a 2,229-line entirely read-only service

Seems like a major performance concern.

rlorenzo · 2026-08-04T01:18:28Z

+        [Route("")]
+        public ActionResult Index()
+        {
+            return Redirect("/Directory");


This would go back to VIPER1, is that expected?

rlorenzo · 2026-08-04T01:19:45Z

+    @if (Model.CanViewRoles && Model.SystemRoles.Any())
+    {
+        <div class="roles">
+            <h2><a href="/RAPS/" target="_blank">System Roles</a></h2>


This would go back to VIPER1, is that expected?

rlorenzo · 2026-08-04T01:22:52Z

+                    }
+                    if (!foundMatch)
+                    {
+                        result.ErrorMessage = $"User found in API but no name match. Variations tried: {string.Join(", ", nameVariations)}. API users: {string.Join(", ", graphqlResponse.Data.SearchUsers.Select(u => $"{u.NameFirst} {u.NameLast}"))}";


When this returns no matches, it returns a list of API users. This seems like it would leak user information.

rlorenzo · 2026-08-04T01:23:29Z

+            // Create GraphQL query
+            var query = $@"
+            query {{
+                searchUsers(name: ""{lastName}"") {{


GraphQL query built by string interpolation

…ions links

rlorenzo · 2026-08-06T04:47:35Z

+{
+    [ApiController]
+    [Route("public/utilities")]
+    public class PublicPhotoController : ControllerBase


This already exists on main. CMSUserPhotoController serves the same ICmsUserPhotoService at /api/cms/photos/by-mail/{mailId}?altPhoto=true, with the same cache headers and 304 handling (5633bedd, VPR-59). UserInfoController is [Permission(Allow = "SVMSecure")], so the <img> requests carry the auth cookie and it would work here as-is.

Worth a deliberate call either way: this controller has no [Permission] or [Authorize], and Program.cs sets a DefaultPolicy but no FallbackPolicy, so photo lookup by mailId, mothraId, iamId, and mivId is open to unauthenticated callers. The CMS one is deliberately gated.

Suggest pointing the view at @HttpHelper.GetRootURL()/api/cms/photos/by-mail/@Model.MailId?altPhoto=true and dropping this. If it stays, the cache/304 block and the mivId resolution both belong in the shared service rather than copied here.

rlorenzo · 2026-08-06T04:47:35Z

+        /// <param name="mailID">Mail ID</param>
+        /// <param name="altphoto">Use alternative photo</param>
+        /// <returns></returns>
+        [Route("/userPhoto")]


This returns NotFound() for every request, and with PublicPhotoController there are now three photo routes in play alongside the existing /api/cms/photos/by-mail/{mailId}. Worth deleting.

+                    new("scope", "api_access")
+                };
+
+                var formContent = new FormUrlEncodedContent(formParams);


+                    foreach (var name in nameList)
+                    {
+                        if (!string.IsNullOrEmpty(name.StudentName) && name.ActivityDate.HasValue)
+                        {
+                            names.Add($"{name.StudentName} ({name.ActivityDate:MM/dd/yyyy})");
+                        }
+                    }


+                    foreach (var middlePart in middleParts)
+                    {
+                        if (middlePart.Length > 0)
+                        {
+                            var variation = $"{name} {middlePart[0]}";
+                            if (!nameVariations.Contains(variation))
+                            {
+                                nameVariations.Add(variation);
+                            }
+                        }
+                    }


+                foreach (var role in filteredRoles)
+                {
+                    string displayName = role.DisplayName ?? role.Role;
+                    result.SystemRoles.Add(new SystemRole
+                    {
+                        System = system,
+                        DisplayName = FormatPermissionName(displayName)
+                    });
+                }


+                foreach (var history in historyData)
+                {
+                    var ucpathResult = new UCPathResult
+                    {
+                        JobCode = history.Jobcode,
+                        JobCodeDescription = history.JobcodeDesc,
+                        DepartmentId = history.Deptid,
+                        DepartmentDescription = history.DeptDesc,
+                        ActionDescription = history.ActionDescr,
+                        PositionEffectiveDate = history.PositionEffdt.HasValue ? DateOnly.FromDateTime(history.PositionEffdt.Value) : null,
+                        ReportsTo = GetReportsToName(history),
+                        ReportsToPosition = GetReportsToPosition(history)
+                    };
+
+                    result.UCPathHistory.Add(ucpathResult);
+                }


+                    foreach (var groupDn in allGroups)
+                    {
+                        var formattedGroup = AdFormat(groupDn, domains);
+                        if (!string.IsNullOrEmpty(formattedGroup))
+                        {
+                            result.ADMemberOf.Add(formattedGroup);
+                        }
+                    }


+        foreach (var perm in permissions)
+        {
+            var parts = perm.Split('.');
+            var partsToProcess = parts.Skip(1).ToList();
+            if (!partsToProcess.Any())
+            {
+                continue;
+            }
+
+            var currentList = roots;
+            for (int i = 0; i < partsToProcess.Count; i++)
+            {
+                var part = partsToProcess[i];
+                var node = currentList.FirstOrDefault(n => n.Name == part);
+                if (node == null)
+                {
+                    node = new PermissionNode
+                    {
+                        Name = part,
+                        FullPath = string.Join('.', parts.Take(i + 2))
+                    };
+                    currentList.Add(node);
+                }
+                if (i == partsToProcess.Count - 1)
+                {
+                    node.IsPermission = true;
+                }
+                currentList = node.Children;
+            }
+        }


+            catch
+            {
+                return new List<string>();
+            }


+            catch (Exception ex)
+            {
+                Console.WriteLine($"Warning: PopulateDirectoryInfoAsync LDAP failed: {ex.Message}");
+            }


+            catch (Exception ex)
+            {
+                Console.WriteLine($"Warning: PopulateDirectoryInfoAsync VMACS failed: {ex.Message}");
+            }


rlorenzo · 2026-08-06T17:39:24Z

@JasonRobertFrancis "3165238 Merge branch 'Development' into feature/userinfo"

That is not good. That will merge in a bunch of unreleased features.

JasonRobertFrancis · 2026-08-06T18:58:04Z

@JasonRobertFrancis "3165238 Merge branch 'Development' into feature/userinfo"

That is not good. That will merge in a bunch of unreleased features.

Thanks for catching that. It has been rolled back

github-code-quality Bot found potential problems Jul 28, 2026

View reviewed changes

github-advanced-security AI found potential problems Jul 28, 2026

View reviewed changes

github-code-quality Bot found potential problems Jul 29, 2026

View reviewed changes

Comment thread web/Areas/Directory/Services/UserInfoService.cs Fixed

Comment thread web/Areas/Directory/Services/UserInfoService.cs Fixed

github-code-quality Bot found potential problems Jul 29, 2026

View reviewed changes

Comment thread web/Classes/Utilities/IamApi.cs Fixed

This comment was marked as resolved.

Sign in to view

JasonRobertFrancis added 14 commits July 30, 2026 08:32

Update LdapService.cs

bf2de8c

Adds models for UserInfo

db98b3d

Create UserInfoController.cs

8c27012

Update UserInfo.cshtml

96e5784

Update .gitignore

22f6e30

UserInfo first draft

25e46f4

Updates Userinfo page

6a5fdfe

Updates UserInfo page

e11c276

fix: clean up unused usings and resolve nullability warnings in tests

4223666

Addresses code-review issues

e89991c

fix: resolve S1144 and S6580 Sonar warnings in IamApi

f30712c

fix: address PR reviews and linter suggestions

f416e35

A few directory bug fixes (trailing slashes, race condition, loading …

fed2a98

…modal) and responds to code-quality bot userinfo recommendations

Fixes the results of the code-quality-bot's review

694ecd4

JasonRobertFrancis force-pushed the feature/userinfo branch from 22567dc to 694ecd4 Compare July 30, 2026 20:03

github-code-quality Bot found potential problems Jul 30, 2026

View reviewed changes

Comment thread web/Areas/Directory/Services/UserInfoService.cs Fixed

Comment thread web/Areas/Directory/Services/UserInfoService.cs Fixed

Comment thread web/Areas/Directory/Services/UserInfoService.cs Fixed

JasonRobertFrancis added 3 commits July 30, 2026 15:33

fix(directory): resolve ReSharper code quality, XML doc, and unit tes…

99eebf8

…t warnings

Refactors to remove clones (from adding the sidebar to the directory …

55a94ae

…and userinfo pages)

Fixes ReSharper redundant constructor and property initializers

4b023bf

This comment was marked as resolved.

Sign in to view

JasonRobertFrancis added 3 commits July 31, 2026 16:33

Merges main changes in

a65cc7c

Addresses linting issues

f32f07f

Addresses ReSharper issues

c674c9c

ReSharper issues

cfde89d

JasonRobertFrancis closed this Aug 3, 2026

JasonRobertFrancis reopened this Aug 3, 2026

JasonRobertFrancis requested review from bsedwards and rlorenzo August 3, 2026 16:16

This comment was marked as resolved.

Sign in to view

rlorenzo requested a review from Copilot August 3, 2026 16:44

Copilot started reviewing on behalf of rlorenzo August 3, 2026 16:45 View session

Copilot AI reviewed Aug 3, 2026

View reviewed changes

bsedwards reviewed Aug 3, 2026

View reviewed changes

rlorenzo requested changes Aug 3, 2026

View reviewed changes

rlorenzo requested changes Aug 4, 2026

View reviewed changes

JasonRobertFrancis added 4 commits August 5, 2026 06:01

parameterizes Instinct GraphQL query and updates system roles/permiss…

cb89d91

…ions links

Fixes loading modal on directory when refreshing the page

e8023d1

Fixes issue with potential null value

8cd6bd5

feat(userinfo): translate getBase64Image.cfm to PublicPhotoController

e29d9a9

rlorenzo reviewed Aug 6, 2026

View reviewed changes

JasonRobertFrancis force-pushed the feature/userinfo branch from be9ecd0 to e29d9a9 Compare August 6, 2026 14:07

JasonRobertFrancis added 2 commits August 6, 2026 07:37

Replaces .Where.FirstOrDefault to .FirstOrDefault

6a25271

Updates .gitignore

5a8fdb3

github-code-quality Bot found potential problems Aug 6, 2026

View reviewed changes

Updates links to User Photo and linting issues

aa17db0

github-code-quality Bot found potential problems Aug 6, 2026

View reviewed changes

Comment thread web/Areas/Directory/Services/UserInfoService.cs

Comment on lines +245 to +248

catch (Exception ex)

{

Console.WriteLine($"Warning: PopulateDirectoryInfoAsync VMACS failed: {ex.Message}");

}

Merge remote-tracking branch 'origin/main' into feature/userinfo

8563ac5

JasonRobertFrancis force-pushed the feature/userinfo branch from 3165238 to 8563ac5 Compare August 6, 2026 18:57

JasonRobertFrancis added 2 commits August 6, 2026 12:50

Removes redundant user photo code and updates links

ed417fa

Removing debugging (again)

0dbc8f4

Uh oh!

Conversation

JasonRobertFrancis commented Jul 28, 2026

Uh oh!

codecov-commenter commented Jul 28, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Bundle Report

Uh oh!

codecov-commenter commented Jul 28, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Codecov Report

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

github-advanced-security AI left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

This comment was marked as resolved.

Uh oh!

Uh oh!

Uh oh!

This comment was marked as resolved.

This comment was marked as resolved.

This comment was marked as resolved.

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

bsedwards left a comment

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

codecov-commenter commented Jul 28, 2026 •

edited

Loading

codecov-commenter commented Jul 28, 2026 •

edited

Loading