fix(users): fetch_user raises NameError after EVO-1947 removed the users helper

[eniatec]

Problem

The EVO-1947 refactor (#50) moved the users index into Users::FilterService and deleted the private users helper from Api::V1::UsersController — but fetch_user, the before_action for show, update and check_permission, still calls it:

def fetch_user
  @user = users.find(params[:id])   # NameError: undefined local variable or method 'users'
end

Every /api/v1/users/:id route now returns 500. The practical impact is severe: services that gate requests on POST /users/:id/check_permission receive the 500 and treat it as a denial, so every consumer relying on the permission check loses authorization entirely (we hit this in production-like validation: the CRM turned every request into 403).

The EVO-1947 request specs only cover the index action, which is the one route that does not run fetch_user — that is why CI stayed green.

Fix

Resolve the record directly in fetch_user, keeping the user_roles preload that role_data uses, and add a request spec for GET /users/:id that fails with the NameError on current develop.

🤖 Generated with Claude Code

Summary by Sourcery

Fix user fetch in the users API controller and add a regression test for the users show endpoint.

Bug Fixes:

• Resolve users in fetch_user via User model with preloaded user_roles to prevent NameError on /api/v1/users/:id routes.

Tests:

• Add request spec for GET /api/v1/users/:id to ensure the endpoint returns 200 and guards against the previous NameError regression.

[sourcery-ai]

Reviewer's Guide

Fixes the users controller’s before_action to resolve the user record directly via ActiveRecord, preserving role preloading, and adds a focused request spec to prevent regressions on GET /api/v1/users/:id.

Sequence diagram for updated GET /api/v1/users/:id request handling

sequenceDiagram
  actor Client
  participant UsersController as ApiV1UsersController
  participant UserModel as User
  participant DB

  Client->>UsersController: GET /api/v1/users/:id
  activate UsersController
  UsersController->>UserModel: includes(user_roles)
  UserModel->>DB: SELECT users WITH user_roles WHERE id = params[:id]
  DB-->>UserModel: user + preloaded user_roles
  UserModel-->>UsersController: @user
  UsersController-->>Client: 200 OK with user response
  deactivate UsersController

Loading

File-Level Changes

Change	Details	Files
Resolve @user in fetch_user using User.includes(:user_roles).find(params[:id]) instead of the removed users helper.	Replace indirect users helper call with direct ActiveRecord query on User. Preserve eager loading of associated user_roles to support downstream role_data usage. Ensure fetch_user correctly initializes @user for show, update, and check_permission actions without raising NameError.	app/controllers/api/v1/users_controller.rb
Add a regression request spec for GET /api/v1/users/:id to assert a successful response instead of NameError/500.	Create a dedicated request spec describing the EVO-1947 fetch_user regression scenario. Set up realistic test data: reader role with users.read permission, current_user with that role, target user, and access token. Assert that GET /api/v1/users/:id returns 200 OK when authorized instead of failing in the before_action.	spec/requests/api/v1/users_show_spec.rb

---

Tips and commands

Interacting with Sourcery

• Trigger a new review: Comment @sourcery-ai review on the pull request.
• Continue discussions: Reply directly to Sourcery's review comments.
• Generate a GitHub issue from a review comment: Ask Sourcery to create an
  issue from a review comment by replying to it. You can also reply to a
  review comment with @sourcery-ai issue to create an issue from it.
• Generate a pull request title: Write @sourcery-ai anywhere in the pull
  request title to generate a title at any time. You can also comment
  @sourcery-ai title on the pull request to (re-)generate the title at any time.
• Generate a pull request summary: Write @sourcery-ai summary anywhere in
  the pull request body to generate a PR summary at any time exactly where you
  want it. You can also comment @sourcery-ai summary on the pull request to
  (re-)generate the summary at any time.
• Generate reviewer's guide: Comment @sourcery-ai guide on the pull
  request to (re-)generate the reviewer's guide at any time.
• Resolve all Sourcery comments: Comment @sourcery-ai resolve on the
  pull request to resolve all Sourcery comments. Useful if you've already
  addressed all the comments and don't want to see them anymore.
• Dismiss all Sourcery reviews: Comment @sourcery-ai dismiss on the pull
  request to dismiss all existing Sourcery reviews. Especially useful if you
  want to start fresh with a new review - don't forget to comment
  @sourcery-ai review to trigger a new review!

Customizing Your Experience

Access your dashboard to:

• Enable or disable review features such as the Sourcery-generated pull request
  summary, the reviewer's guide, and others.
• Change the review language.
• Add, remove or edit custom review instructions.
• Adjust other review settings.

Getting Help

• Contact our support team for questions or feedback.
• Visit our documentation for detailed guides and information.
• Keep in touch with the Sourcery team by following us on X/Twitter, LinkedIn or GitHub.

[sourcery-ai]

Hey - I've reviewed your changes and they look great!

---

Sourcery is free for open source - if you like our reviews please consider sharing them ✨

• X
• Mastodon
• LinkedIn
• Facebook

_{Help me be more useful! Please click 👍 or 👎 on each comment and I'll use the feedback to improve your reviews.}