api/src/application/http/user/handlers/get_user_permissions.rs (1)

24-38: Consider adding 401 Unauthorized response to OpenAPI documentation.

The endpoint requires authentication (protected by auth middleware), so it can return a 401 Unauthorized response. Adding this to the OpenAPI documentation would provide more complete API documentation for consumers.

📝 Suggested OpenAPI enhancement

     responses(
         (status = 200, body = UserPermissionsResponse, description = "User permissions retrieved successfully"),
+        (status = 401, description = "Unauthorized: Authentication required"),
         (status = 404, description = "User not found"),
         (status = 403, description = "Forbidden: User does not have permission to access this user's permissions")
     )

core/src/domain/user/services.rs (2)

575-580: Note: Permission order is non-deterministic.

Converting from HashSet to Vec via into_iter().collect() produces a non-deterministic order. This is generally fine for permissions, but if API consumers rely on consistent ordering for testing or display, consider sorting:

let mut permissions: Vec<Permissions> = permissions.into_iter().collect();
permissions.sort();
Ok(permissions)

This is a minor consideration and may not be necessary depending on client requirements.

---

552-581: Add user existence validation to prevent information disclosure through response patterns.

The implementation retrieves permissions without verifying that the user_id belongs to a user in the specified realm. Since get_user_roles returns an empty vector for non-existent users (via INNER JOIN), the endpoint returns an empty permissions list—indistinguishable from a user with no roles. This allows callers to infer user existence based on response patterns, creating minor information disclosure even with the policy check in place.

The pattern is already established in this codebase: UserRoleServiceImpl::assign_role (line 84–88 of user_role_service.rs) validates user existence and realm membership before operating on roles. Apply the same pattern here.

💡 Suggested validation

         ensure_policy(
             self.policy
                 .can_view_user_permissions(&identity, &realm, input.user_id)
                 .await,
             "insufficient permissions",
         )?;
 
+        // Verify user exists in realm
+        let user = self.user_repository.get_by_id(input.user_id).await?;
+        if user.realm_id != realm.id {
+            return Err(CoreError::InvalidRealm);
+        }
+
         let roles = self
             .user_role_repository
             .get_user_roles(input.user_id)
             .await?;