From 639d73b3e71addbd8cbba1a4f5f3f745713e537d Mon Sep 17 00:00:00 2001
From: Ibrahim Serdar Acikgoz <serdaracikgoz86@gmail.com>
Date: Thu, 24 Aug 2023 15:14:01 +0300
Subject: [PATCH] api4/user: Deduplicate userids for getUsersByIds endpoint
 (#24344)

---
 server/channels/api4/user.go       |  4 ++++
 server/channels/api4/user_local.go | 10 +++++++---
 server/channels/api4/user_test.go  |  7 +++++++
 3 files changed, 18 insertions(+), 3 deletions(-)

diff --git a/server/channels/api4/user.go b/server/channels/api4/user.go
index 18ec975f23..f8f9787a20 100644
--- a/server/channels/api4/user.go
+++ b/server/channels/api4/user.go
@@ -957,6 +957,10 @@ func getUsersByIds(c *Context, w http.ResponseWriter, r *http.Request) {
 		return
 	}
 
+	// we remove the duplicate IDs as it can bring a significant load to the
+	// database.
+	userIDs = model.RemoveDuplicateStrings(userIDs)
+
 	sinceString := r.URL.Query().Get("since")
 
 	options := &store.UserGetByIdsOpts{
diff --git a/server/channels/api4/user_local.go b/server/channels/api4/user_local.go
index f4d423d728..f2e5a1fcdb 100644
--- a/server/channels/api4/user_local.go
+++ b/server/channels/api4/user_local.go
@@ -231,13 +231,17 @@ func localGetUsers(c *Context, w http.ResponseWriter, r *http.Request) {
 }
 
 func localGetUsersByIds(c *Context, w http.ResponseWriter, r *http.Request) {
-	userIds := model.ArrayFromJSON(r.Body)
+	userIDs := model.ArrayFromJSON(r.Body)
 
-	if len(userIds) == 0 {
+	if len(userIDs) == 0 {
 		c.SetInvalidParam("user_ids")
 		return
 	}
 
+	// we remove the duplicate IDs as it can bring a significant load to the
+	// database.
+	userIDs = model.RemoveDuplicateStrings(userIDs)
+
 	sinceString := r.URL.Query().Get("since")
 
 	options := &store.UserGetByIdsOpts{
@@ -253,7 +257,7 @@ func localGetUsersByIds(c *Context, w http.ResponseWriter, r *http.Request) {
 		options.Since = since
 	}
 
-	users, appErr := c.App.GetUsersByIds(userIds, options)
+	users, appErr := c.App.GetUsersByIds(userIDs, options)
 	if appErr != nil {
 		c.Err = appErr
 		return
diff --git a/server/channels/api4/user_test.go b/server/channels/api4/user_test.go
index df2f19b850..6bc2c214b0 100644
--- a/server/channels/api4/user_test.go
+++ b/server/channels/api4/user_test.go
@@ -1725,6 +1725,13 @@ func TestGetUsersByIds(t *testing.T) {
 
 			require.Len(t, users, 1, "1 user should be returned")
 		})
+
+		t.Run("should only return unique users when multiple IDs are requested", func(t *testing.T) {
+			users, _, err := client.GetUsersByIds(context.Background(), []string{th.BasicUser.Id, th.BasicUser.Id, th.BasicUser.Id})
+			require.NoError(t, err)
+
+			require.Len(t, users, 1, "1 user should be returned")
+		})
 	})
 
 	t.Run("should return error when not logged in", func(t *testing.T) {