From 8ae42e1852f000e9ed5bac1b0ade890dcee6dd9c Mon Sep 17 00:00:00 2001
From: Owen <owen@txv.io>
Date: Mon, 24 Aug 2026 11:18:09 -0400
Subject: [PATCH] Fix list users not respecting policy

Fixes #3632
---
 server/routers/resource/listResourceUsers.ts | 41 ++++++++++++++++++--
 1 file changed, 38 insertions(+), 3 deletions(-)

diff --git a/server/routers/resource/listResourceUsers.ts b/server/routers/resource/listResourceUsers.ts
index afabd3052..9a39444d2 100644
--- a/server/routers/resource/listResourceUsers.ts
+++ b/server/routers/resource/listResourceUsers.ts
@@ -1,7 +1,7 @@
 import { Request, Response, NextFunction } from "express";
 import { z } from "zod";
 import { db } from "@server/db";
-import { idp, userResources, users } from "@server/db"; // Assuming these are the correct tables
+import { idp, resources, userPolicies, userResources, users } from "@server/db"; // Assuming these are the correct tables
 import { eq } from "drizzle-orm";
 import response from "@server/lib/response";
 import HttpCode from "@server/types/HttpCode";
@@ -14,7 +14,23 @@ const listResourceUsersSchema = z.strictObject({
     resourceId: z.coerce.number().int().positive()
 });
 
-async function queryUsers(resourceId: number) {
+async function queryUsers(resourceId: number, policyId: number | null) {
+    if (policyId !== null) {
+        return await db
+            .select({
+                userId: userPolicies.userId,
+                username: users.username,
+                type: users.type,
+                idpName: idp.name,
+                idpId: users.idpId,
+                email: users.email
+            })
+            .from(userPolicies)
+            .innerJoin(users, eq(userPolicies.userId, users.userId))
+            .leftJoin(idp, eq(users.idpId, idp.idpId))
+            .where(eq(userPolicies.resourcePolicyId, policyId));
+    }
+
     return await db
         .select({
             userId: userResources.userId,
@@ -104,7 +120,26 @@ export async function listResourceUsers(
 
         const { resourceId } = parsedParams.data;
 
-        const resourceUsersList = await queryUsers(resourceId);
+        const [resource] = await db
+            .select()
+            .from(resources)
+            .where(eq(resources.resourceId, resourceId))
+            .limit(1);
+
+        if (!resource) {
+            return next(
+                createHttpError(HttpCode.NOT_FOUND, "Resource not found")
+            );
+        }
+
+        const isInlinePolicy =
+            resource.resourcePolicyId === null &&
+            resource.defaultResourcePolicyId !== null;
+
+        const resourceUsersList = await queryUsers(
+            resourceId,
+            isInlinePolicy ? resource.defaultResourcePolicyId! : null
+        );
 
         return response<ListResourceUsersResponse>(res, {
             data: {