[devin-ai-integration]

Summary

Fixes code-scan finding sfind-cf43a4da. GET /api/user/all used to load every User. Serializing that list then lazy-loaded recipientList and userRoles once per user, plus each user's accounts.

• Pagination: GET /api/user/all?page=0&size=50 (default 50, max 200, sorted by userId; out-of-range values return 400). The response body is still a plain JSON array, so existing callers keep working. Totals go in the X-Total-Count, X-Page, X-Page-Size and X-Total-Pages headers, which RequestFilter now exposes via Access-Control-Expose-Headers.
• DAO and service: UserDao.findAll(Pageable) uses @EntityGraph(attributePaths = {"primaryAccount","savingsAccount"}, type = LOAD), so accounts are join-fetched into the single page query. UserService.findUserList() is now findUserList(Pageable). The unbounded List<User> findAll() is removed.
• User entity:
  • @JsonIgnore on User.recipientList, matching appointmentList. The admin screen never shows recipients.
  • @BatchSize(size = 200) on the EAGER userRoles.
  • The graph type matters: with the default FETCH type, Hibernate skipped batching and still ran one userRoles query per user. With LOAD it runs one batched IN (...) query.
• AdminPortal: UserService.getUsers(page, size) and a Previous/Next pager in user-account.component driven by X-Total-Pages.

Measured against MySQL 5.7 with 121 seeded users, 3 recipients each, counting spring.jpa.show-sql statements per request:

	master	this PR
SQL statements for GET /api/user/all	485	3 (page query with join + LIMIT, count, batched roles)
Users in response	121	50 (page 0 of 3)
Payload	94.9 KB	23.7 KB

Verification

• New UserResourceTest (standalone MockMvc + Mockito, 4 tests) covers the defaults and totals headers, passing page/size through, 400s for out-of-range values, and that recipientList is not serialized. It passes against the Boot 1.5-era jars (Spring 4.3.12, spring-data-commons 1.13.8), compiled with javac --release 8 and run through JUnitCore.
• The numbers in the table come from a /tmp copy of the app rebuilt on the cached Boot 2.7.18 parent (PageRequest.of instead of new PageRequest, findById in AppointmentServiceImpl, mysql-connector-j), logged in as an admin over HTTP.
• Not verified:
  • mvn test on the real Boot 1.5.4 build: the 1.5.4 parent isn't cached and Maven Central is blocked in this session.
  • The AdminPortal pager: no node_modules, and the npm registry is blocked, so it wasn't built or exercised in a browser.

Related

• PR bug: stop exposing User password hash via admin JSON APIs and toString #123 (UserSummary DTO + password-hash @JsonIgnore) and older migration PRs feature: migrate UserFront to Spring Boot 4.1.1 / Java 21 and AdminPortal to Angular 22 #111/feature: WS5 JPA/Hibernate 7 entity validation #116/COG-1150: W1 · User + UserRole GenerationType.IDENTITY and @JsonIgnore on recipientList #341 also put @JsonIgnore on recipientList. None of them paginate the endpoint. If both this PR and bug: stop exposing User password hash via admin JSON APIs and toString #123 land, the controller signatures need a merge.
• PR bug: AdminPortal user list – single JSON read, in-place enable/disable (no location.reload) #354 also edits user-account.component.ts (res.json(), in-place enable/disable). Expect a small conflict there.

Written by Devin

Devin-Org: engineering

Open in Devin Desktop: https://app.devin.ai/desktop/session/7e2990c52edb4f878983ffb32de62260?variant=devin

---

Devin Review

Status	Commit
⚪ Not started	—

Run Devin Review

[devin-ai-integration]

I'll fix CI failures and address comments from users with write access. I'll skip comments containing "(aside)".

• Disable automatic comment, CI, and merge conflict monitoring