🐛: FIX: #13830: National user cannot assign case or event

[Pa-Touche]

National user cannot assign case even though it's enabled in user role configuration.

#13830

Fixes #13830

Summary by CodeRabbit

• Bug Fixes
  • Improved user reference filtering to correctly include users with national jurisdiction level alongside region, district, and community-based selections.
  • Enhanced jurisdiction-based access restrictions to properly account for national jurisdiction users when visibility permissions are limited.

[coderabbitai]

Warning

Review limit reached

@Pa-Touche, we couldn't start this review because you've reached your PR review rate limit.

More reviews will be available in 2 minutes and 8 seconds. Learn how PR review limits work.

Your organization has used up its prepaid credits, and credit purchases are no longer available. Enable the review add-on in the billing tab to keep reviews running — you're only billed for reviews past your plan's rate limits ($0.25/file).

⌛ How to resolve this issue?

After more reviews become available, a review can be triggered using the @coderabbitai review command as a PR comment. Alternatively, push new commits to this PR.

To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based credits.

🚦 How do rate limits work?

CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan refill rate.

For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, the refill rate gradually slows as usage increases. The highest same-day bursts are limited more strictly.

Please see our Fair Usage Limits Policy for further information.

ℹ️ Review info

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro

Run ID: b4d17cf1-ecc6-43f7-9b83-2345a6ef786d

📥 Commits

Reviewing files that changed from the base of the PR and between 30ca14d and 7e09339.

📒 Files selected for processing (2)

• sormas-backend/src/main/java/de/symeda/sormas/backend/user/UserService.java
• sormas-backend/src/test/java/de/symeda/sormas/backend/user/UserFacadeEjbTest.java

📝 Walkthrough

Walkthrough

UserService.getUserReferences is updated so that predicates filtering by regionUuids, districtUuids, and communityUuids each gain an OR branch matching users whose jurisdiction level is NATION. The same OR is applied to the jurisdiction restriction when the caller lacks SEE_PERSONAL_DATA_OUTSIDE_JURISDICTION. A new helper method createUserHasNationJurisdictionFilter encapsulates the NATION predicate, and debug/error logging is added at each filtering decision point.

Changes

National user visibility in getUserReferences

Layer / File(s)	Summary
Import wildcard consolidation sormas-backend/.../UserService.java	Specific java.util, javax.persistence.criteria, and de.symeda.sormas.api.user imports replaced with three wildcard imports.
createUserHasNationJurisdictionFilter helper and rights logging sormas-backend/.../UserService.java	New public method createUserHasNationJurisdictionFilter(CriteriaBuilder, From<?, User>) returns a JURISDICTION_LEVEL == NATION predicate. buildUserRightsFilter now emits an error-level log when userRights is non-empty.
getUserReferences predicates extended for NATION jurisdiction sormas-backend/.../UserService.java	regionUuids, districtUuids, and communityUuids filter predicates each OR with createUserHasNationJurisdictionFilter; the jurisdiction restriction when SEE_PERSONAL_DATA_OUTSIDE_JURISDICTION is absent likewise ORs with the nation predicate; debug logging added at each branch including the excludeLimitedDiseaseUsers path.

Estimated code review effort

🎯 3 (Moderate) | ⏱️ ~20 minutes

Poem

🐇 Hop, hop, the national hare
Was lost in the district's snare,
But now with an OR and a NATION check,
No bureaucratic predicate can hold me back!
I bound across all regions free,
Assigned at last — as it should be! 🌍

🚥 Pre-merge checks | ✅ 4 | ❌ 1

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Docstring Coverage	⚠️ Warning	Docstring coverage is 25.00% which is insufficient. The required threshold is 80.00%.	Write docstrings for the functions missing them to satisfy the coverage threshold.

✅ Passed checks (4 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title "FIX: #13830: National user cannot assign case or event" is directly related to the issue being fixed and clearly describes the main problem being addressed.
Description check	✅ Passed	The description includes the issue number (#13830) and explains the problem, though it follows the template minimally by providing the issue reference.
Linked Issues check	✅ Passed	The code changes to UserService.java directly address issue #13830 by treating nation-level jurisdiction users as eligible for case assignment, matching the expected behavior documented in the issue.
Out of Scope Changes check	✅ Passed	All changes in UserService.java are directly related to fixing the jurisdiction filtering logic for national-level users, with no extraneous modifications detected.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch fix/13830-national-user-cannot-be-responsible-user

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[coderabbitai]

Actionable comments posted: 1

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@sormas-backend/src/main/java/de/symeda/sormas/backend/user/UserService.java`:
- Line 737: The logging statement in UserService that logs userRights is using
the ERROR level instead of DEBUG level. Since logging userRights is normal
operational behavior (not an error condition), it pollutes production error logs
and triggers false alerts. Change the logger.error call that logs userRights to
logger.debug to align with the appropriate log level for routine operational
information and match the logging pattern used elsewhere in this PR.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro

Run ID: ffd581ec-a9b8-43d1-a5fc-7eb68ac40cda

📥 Commits

Reviewing files that changed from the base of the PR and between be5a6cd and 30ca14d.

📒 Files selected for processing (1)

• sormas-backend/src/main/java/de/symeda/sormas/backend/user/UserService.java