From 1c0b5e9b6dbfb0932cc1ef4c76a779c4857f8cd3 Mon Sep 17 00:00:00 2001
From: Cursor Agent <cursoragent@cursor.com>
Date: Tue, 12 Aug 2025 13:16:39 +0000
Subject: [PATCH] Fix select query handling to only return $id when no
 attributes specified

Co-authored-by: jakeb994 <jakeb994@gmail.com>
---
 app/controllers/api/users.php          | 10 ++++++++--
 tests/e2e/Services/Users/UsersBase.php | 19 ++++++++++++-------
 2 files changed, 20 insertions(+), 9 deletions(-)

diff --git a/app/controllers/api/users.php b/app/controllers/api/users.php
index 5a81618726..f4927a3bd0 100644
--- a/app/controllers/api/users.php
+++ b/app/controllers/api/users.php
@@ -662,9 +662,11 @@ App::get('/v1/users')
         
         $processedQueries = [];
         $allSelectedAttributes = [];
+        $hasSelectQuery = false;
         
         foreach ($queries as $query) {
             if ($query->getMethod() === Query::TYPE_SELECT) {
+                $hasSelectQuery = true;
                 $selectedAttributes = $query->getValues();
 
                 foreach ($selectedAttributes as $attribute) {
@@ -679,8 +681,12 @@ App::get('/v1/users')
             }
         }
 
-        if (!empty($allSelectedAttributes)) {
-            $processedQueries[] = Query::select(array_unique($allSelectedAttributes));
+        if ($hasSelectQuery) {
+            if (!empty($allSelectedAttributes)) {
+                $processedQueries[] = Query::select(array_unique($allSelectedAttributes));
+            } else {
+                $processedQueries[] = Query::select(['$id']);
+            }
         }
 
         $queries = $processedQueries;
diff --git a/tests/e2e/Services/Users/UsersBase.php b/tests/e2e/Services/Users/UsersBase.php
index b9825d4e69..7a09116df4 100644
--- a/tests/e2e/Services/Users/UsersBase.php
+++ b/tests/e2e/Services/Users/UsersBase.php
@@ -1965,16 +1965,17 @@ trait UsersBase
         $this->assertNotEmpty($response['body']);
         $this->assertNotEmpty($response['body']['users']);
         
-        // When only subQuery attributes are selected, they should be available since their filters are not skipped
+        // When only subQuery attributes are selected, only $id is passed to database select
+        // but the subQuery attributes should be available since their filters are not skipped
         $user = $response['body']['users'][0];
+        $this->assertArrayHasKey('$id', $user); // Only $id from database select
         $this->assertArrayHasKey('sessions', $user);
         $this->assertArrayHasKey('challenges', $user);
         $this->assertArrayHasKey('authenticators', $user);
         
-        // Other attributes should also be present since no select query is passed to database
-        $this->assertArrayHasKey('$id', $user);
-        $this->assertArrayHasKey('name', $user);
-        $this->assertArrayHasKey('email', $user);
+        // Other attributes should NOT be present since only $id was selected from database
+        $this->assertArrayNotHasKey('name', $user);
+        $this->assertArrayNotHasKey('email', $user);
 
         /**
          * Test Query::select with system attributes
@@ -2168,10 +2169,14 @@ trait UsersBase
         $this->assertNotEmpty($response['body']['users']);
         
         // Since targets is the only selected attribute and it's a subQuery attribute,
-        // but subQueryTargets is not skipped by default, all attributes should be returned
+        // only $id should be passed to database select, but targets should be available
         $user = $response['body']['users'][0];
-        $this->assertArrayHasKey('$id', $user);
+        $this->assertArrayHasKey('$id', $user); // Only $id from database select
         $this->assertArrayHasKey('targets', $user);
+        
+        // Other attributes should NOT be present since only $id was selected from database
+        $this->assertArrayNotHasKey('name', $user);
+        $this->assertArrayNotHasKey('email', $user);
 
         /**
          * Core functionality test: verify subQuery attributes handling