A few directory bug fixes (trailing slashes, race condition, loading modal) and responds to code-quality bot userinfo recommendations

Author: JasonRobertFrancis

CLAUDE.md

@@ -49,6 +49,7 @@ When I ask a question or make an observation, respond with an answer - do NOT ju
 
 ## Testing & Git
 
+- **No VMACS production calls**: Unit tests, local environments, and test environments must NEVER send requests to the VMACS production server. All external HTTP requests (e.g., VMACS, Instinct, IAM API) must be mocked using in-memory databases and mock HTTP clients/factories to prevent production spam.
 - **UI**: Test UI changes with Playwright MCP (modals, forms, keyboard nav)
 - **API**: Use Playwright MCP to visit endpoints — APIs require browser auth, `curl` fails
 - **Git**: NEVER stage files until after code review. Workflow: changes → test → lint → summary → approval → stage

test/Areas/Directory/VMACSServiceTest.cs

@@ -31,7 +31,6 @@ public void BuildSearchPath_IncludesAuthToken()
 
         [Theory]
         [InlineData("https://vmacs-qa.example.edu")]
-        [InlineData("http://vmacs.example.edu/")]
         public void IsValidBaseUrl_True_ForAbsoluteHttpUrls(string baseUrl)
         {
             Assert.True(VMACSService.IsValidBaseUrl(baseUrl));
@@ -44,7 +43,7 @@ public void IsValidBaseUrl_True_ForAbsoluteHttpUrls(string baseUrl)
         [InlineData("not-a-url")]
         [InlineData("/relative/path")]
         [InlineData("vmacs-qa.example.edu")]
-        [InlineData("ftp://vmacs.example.edu")]
+        [InlineData("ftp://vmacs-qa.example.edu")]
         [InlineData("file:///etc/passwd")]
         public void IsValidBaseUrl_False_ForMissingOrNonHttpUrls(string? baseUrl)
         {

web/Areas/Directory/Controllers/DirectoryController.cs

@@ -9,6 +9,8 @@
 using Viper.Classes.Utilities;
 using Viper.Models.AAUD;
 using Web.Authorization;
+using Microsoft.AspNetCore.Mvc.Filters;
+using Viper.Areas.CMS.Data;
 
 namespace Viper.Areas.Directory.Controllers
 {
@@ -49,6 +51,24 @@ public async Task<ActionResult<IEnumerable<NavMenuItem>>> Nav()
         }
 
 
+        /// <summary>
+        /// Directory search via query parameters (handles special characters and avoids race conditions)
+        /// </summary>
+        [SupportedOSPlatform("windows")]
+        [HttpGet("search")]
+        public async Task<ActionResult<IEnumerable<IndividualSearchResult>>> GetFromQuery([FromQuery] string search, [FromQuery] bool ucd = false)
+        {
+            if (string.IsNullOrWhiteSpace(search))
+            {
+                return Ok(new List<IndividualSearchResult>());
+            }
+            if (ucd)
+            {
+                return await GetUCD(search);
+            }
+            return await Get(search);
+        }
+
         /// <summary>
         /// Directory list
         /// </summary>
@@ -148,5 +168,19 @@ public async Task<IActionResult> DirectoryResult(string mothraID)
             // pull in the user based on uid
             return await Task.Run(() => View("~/Areas/Directory/Views/UserInfo.cshtml"));
         }
+
+        public override async Task OnActionExecutionAsync(ActionExecutingContext context,
+                                                         ActionExecutionDelegate next)
+        {
+            var viperContext = context.HttpContext.RequestServices.GetRequiredService<VIPERContext>();
+            var rapsContext = context.HttpContext.RequestServices.GetRequiredService<RAPSContext>();
+            var menu = new LeftNavMenu(viperContext, rapsContext).GetLeftNavMenus(friendlyName: "viper-home")?.FirstOrDefault();
+            if (menu != null)
+            {
+                ConvertNavLinksForDevelopment(menu);
+            }
+            ViewData["ViperLeftNav"] = menu ?? new NavMenu("", new List<NavMenuItem>());
+            await base.OnActionExecutionAsync(context, next);
+        }
     }
 }

web/Areas/Directory/Controllers/UserInfoController.cs

@@ -5,6 +5,8 @@
 using Viper.Classes.SQLContext;
 using Viper.Areas.Directory.Services;
 using Microsoft.Extensions.Caching.Memory;
+using Microsoft.AspNetCore.Mvc.Filters;
+using Viper.Areas.CMS.Data;
 
 namespace Viper.Areas.Directory.Controllers
 {
@@ -139,5 +141,19 @@ public async Task<ActionResult<IEnumerable<NavMenuItem>>> Nav()
             var nav = new List<NavMenuItem>();
             return await Task.Run(() => nav);
         }
+
+        public override async Task OnActionExecutionAsync(ActionExecutingContext context,
+                                                         ActionExecutionDelegate next)
+        {
+            var viperContext = context.HttpContext.RequestServices.GetRequiredService<VIPERContext>();
+            var rapsContext = context.HttpContext.RequestServices.GetRequiredService<RAPSContext>();
+            var menu = new LeftNavMenu(viperContext, rapsContext).GetLeftNavMenus(friendlyName: "viper-home")?.FirstOrDefault();
+            if (menu != null)
+            {
+                ConvertNavLinksForDevelopment(menu);
+            }
+            ViewData["ViperLeftNav"] = menu ?? new NavMenu("", new List<NavMenuItem>());
+            await base.OnActionExecutionAsync(context, next);
+        }
     }
 }

web/Areas/Directory/Services/UserInfoService.cs

@@ -9,6 +9,7 @@
 using System.Text.Json;
 using System.Text.Json.Serialization;
 using Viper.Areas.RAPS.Services;
+using System.Data.Common;
 
 namespace Viper.Areas.Directory.Services
 {
@@ -118,7 +119,7 @@ public UserInfoService(
 
                 return await MapToUserInfoResultAsync(user, currentTerms);
             }
-            catch (Exception ex)
+            catch (DbException ex)
             {
                 Console.WriteLine($"Warning: GetUserByIamIdAsync failed: {ex.Message}");
                 return null;
@@ -145,7 +146,7 @@ public UserInfoService(
 
                 return await MapToUserInfoResultAsync(user, currentTerms);
             }
-            catch (Exception ex)
+            catch (DbException ex)
             {
                 Console.WriteLine($"Warning: GetUserByMothraIdAsync failed: {ex.Message}");
                 return null;
@@ -1101,12 +1102,12 @@ private async Task PopulateSystemRolesAsync(UserInfoResult result)
             foreach (var system in systems)
             {
                 // Filter roles belonging to the current system/instance
-                var filtered = roleMembers
+                var filteredRoles = roleMembers
                     .Where(rm => rm.Role != null && RAPSSecurityService.RoleBelongsToInstance(system, rm.Role))
-                    .OrderBy(rm => rm.Role.DisplayName ?? rm.Role.Role)
-                    .ToList();
+                    .Select(rm => rm.Role!)
+                    .OrderBy(r => r.DisplayName ?? r.Role);
 
-                foreach (var role in filtered.Select(rm => rm.Role).Where(r => r != null))
+                foreach (var role in filteredRoles)
                 {
                     string displayName = role.DisplayName ?? role.Role;
                     result.SystemRoles.Add(new SystemRole

web/Areas/Directory/Views/Card.cshtml

@@ -33,42 +33,42 @@
     <div class="row q-pa-sm q-gutter-sm" id="directoryResults">
         <q-card v-for="user in results" class="col-2 col-xs-8 col-sm-5 col-md-8 col-lg-3 col-xl-2 block directory">
             <q-card-section class="grid row card_header" :class="[user.svm ? 'SVM' : '']">
-                <a v-if="user.svm && user.iamId && user.mothraId" :href="'@HttpHelper.GetRootURL()/UserInfo/' + user.mothraId" :aria-label="'User information for ' + user.name" class="userinfo_button top_button">
+                <a v-if="user.svm && user.iamId && user.mothraId" :href="'@HttpHelper.GetRootURL()/UserInfo/' + user.mothraId" @@click="onLinkClick($event, 'Loading user profile...')" :aria-label="'User information for ' + user.name" class="userinfo_button top_button">
                     <q-icon name="person" size="xs"></q-icon>
                     <q-tooltip>User Information</q-tooltip>
                 </a>
                 <a v-if="user.mailId" :href="'mailto:' + user.mailId + '@@ucdavis.edu'" :aria-label="'Email ' + user.mailId + '@@ucdavis.edu'" class="email_button top_button">
                     <q-icon name="email" size="xs"></q-icon>
                     <q-tooltip>Email {{user.mailId}}@@ucdavis.edu</q-tooltip>
                 </a>
-                <a v-if="user.svm" :href="'@HttpHelper.GetRootURL()/EmulateUser/' + user.loginId" :aria-label="'Emulate ' + user.name" class="emulate_button top_button">
+                <a v-if="user.svm" :href="'@HttpHelper.GetRootURL()/EmulateUser/' + user.loginId" @@click="onLinkClick($event, 'Emulating user...')" :aria-label="'Emulate ' + user.name" class="emulate_button top_button">
                     <q-icon name="face" size="xs"></q-icon>
                     <q-tooltip>Emulate {{user.name}}</q-tooltip>
                 </a>
-                <a v-if="ids && user.mothraId && user.loginId" :href="'@HttpHelper.GetOldViperRootURL()' + '/default.cfm?Page=AAUDCheck&mothraID=' + user.mothraId + '&loginID=' + user.loginId" :aria-label="'AAUD check for ' + user.name" class="AAUD_button top_button">
+                <a v-if="ids && user.mothraId && user.loginId" :href="'@HttpHelper.GetOldViperRootURL()' + '/default.cfm?Page=AAUDCheck&mothraID=' + user.mothraId + '&loginID=' + user.loginId" @@click="onLinkClick($event, 'Opening AAUD Check...')" :aria-label="'AAUD check for ' + user.name" class="AAUD_button top_button">
                     <q-icon name="account_circle" size="xs"></q-icon>
                     <q-tooltip>AAUD Check</q-tooltip>
                 </a>
-                <a v-if="ids && user.loginId" :href="'@HttpHelper.GetOldViperRootURL()' + '/default.cfm?Page=IDCardCheck&LoginID=' + user.loginId" :aria-label="'ID check for ' + user.name" class="ID_button top_button">
+                <a v-if="ids && user.loginId" :href="'@HttpHelper.GetOldViperRootURL()' + '/default.cfm?Page=IDCardCheck&LoginID=' + user.loginId" @@click="onLinkClick($event, 'Opening ID Check...')" :aria-label="'ID check for ' + user.name" class="ID_button top_button">
                     <q-icon name="account_box" size="xs"></q-icon>
                     <q-tooltip>ID Check</q-tooltip>
                 </a>
-                <a :href="'@HttpHelper.GetOldViperRootURL()' + '/default.cfm?Page=UnitHeads&MailID=' + user.mailId" v-if="ids && user.mailId" :aria-label="'MSO/CAO lookup for ' + user.name" class="MSO_button top_button">
+                <a :href="'@HttpHelper.GetOldViperRootURL()' + '/default.cfm?Page=UnitHeads&MailID=' + user.mailId" v-if="ids && user.mailId" @@click="onLinkClick($event, 'Opening MSO/CAO Lookup...')" :aria-label="'MSO/CAO lookup for ' + user.name" class="MSO_button top_button">
                     <q-icon name="supervisor_account" size="xs"></q-icon>
                     <q-tooltip>MSO/CAO Lookup</q-tooltip>
                 </a>
                 @if (UserHelper.HasPermission(rapsContext, UserHelper.GetCurrentUser(), "SVMSecure.DirectoryUCPathInfo"))
                 {
                     @:
-                    <a :href="'@HttpHelper.GetOldViperRootURL()' + '/default.cfm?Page=UCPathInfo&emplid=' + user.employeeId" v-if="ids && user.employeeId" :aria-label="'UCPath info for ' + user.name" class="UCPath_button top_button">
+                    <a :href="'@HttpHelper.GetOldViperRootURL()' + '/default.cfm?Page=UCPathInfo&emplid=' + user.employeeId" v-if="ids && user.employeeId" @@click="onLinkClick($event, 'Opening UCPath Info...')" :aria-label="'UCPath info for ' + user.name" class="UCPath_button top_button">
                         <q-icon name="school" size="sm"></q-icon>
                         <q-tooltip>UCPath Info</q-tooltip>
                     </a>
                 }
                     @if (UserHelper.HasPermission(rapsContext, UserHelper.GetCurrentUser(), "SVMSecure.CATS.ServiceDesk"))
                 {
                     @:
-                    <a :href="'@HttpHelper.GetOldViperRootURL()' + '/default.cfm?Page=alternatePhoto&iamID=' + user.iamId + '&mailID=' + user.mailId + '&empName=' + encodeURIComponent(user.name)" v-if="ids && user.iamId && user.mailId" :aria-label="'Alternate photo for ' + user.name" class="photo_button top_button">
+                    <a :href="'@HttpHelper.GetOldViperRootURL()' + '/default.cfm?Page=alternatePhoto&iamID=' + user.iamId + '&mailID=' + user.mailId + '&empName=' + encodeURIComponent(user.name)" v-if="ids && user.iamId && user.mailId" @@click="onLinkClick($event, 'Opening Alternate Photo...')" :aria-label="'Alternate photo for ' + user.name" class="photo_button top_button">
                         <q-icon name="photo_camera" size="xs"></q-icon>
                         <q-tooltip>Alt. Photo</q-tooltip>
                     </a>
@@ -138,21 +138,45 @@
                     ucd: getItemFromStorage("directory_ucd") ?? false,
                     ids: getItemFromStorage("directory_ids") ?? false,
                     spinner: false,
-                    results: []
+                    results: [],
+                    searchId: 0
                 }
             },
             methods: {
                 findUsers: async function () {
                     this.spinner = false;
                     this.results = [];
-                    var urlBase = "@Url.Content("~/Directory/search/")" + this.userSearch;
+                    
+                    var search = this.userSearch.trim();
+                    if (search.length < 2) {
+                        return;
+                    }
+                    
+                    this.searchId++;
+                    var currentSearchId = this.searchId;
+                    
+                    var urlBase = "@Url.Content("~/Directory/search")" + "?search=" + encodeURIComponent(search);
                     if (this.ucd) {
-                        urlBase += "/ucd"
+                        urlBase += "&ucd=true";
+                    }
+                    
+                    this.spinner = true;
+                    try {
+                        var response = await viperFetch(this, urlBase);
+                        if (currentSearchId === this.searchId) {
+                            this.results = response || [];
+                        }
+                    } finally {
+                        if (currentSearchId === this.searchId) {
+                            this.spinner = false;
+                        }
                     }
-                    if (this.userSearch.length >= 2) {
-                        this.spinner = true;
-                        this.results = (await viperFetch(this, urlBase))
-                        this.spinner = false;
+                },
+                onLinkClick: function (e, msg) {
+                    if (e.button === 0 && !e.ctrlKey && !e.shiftKey && !e.altKey && !e.metaKey) {
+                        this.$q.loading.show({
+                            message: msg || 'Loading...'
+                        });
                     }
                 }
             },

web/Controllers/HomeController.cs

@@ -117,6 +117,24 @@ public IActionResult RefreshSession()
             return Ok(SessionTimeoutService.GetSessionTimeout(_viperContext));
         }
 
+        [Route("/GetSessionTimeout")]
+        [SearchExclude]
+        public IActionResult GetSessionTimeout()
+        {
+            var timeout = SessionTimeoutService.GetSessionTimeout(_viperContext);
+            if (timeout == null)
+            {
+                return NotFound();
+            }
+            var secondsLeft = (int)(timeout.SessionTimeoutDateTime - DateTime.Now).TotalSeconds;
+            return Ok(new
+            {
+                sessionTimeoutDateTime = timeout.SessionTimeoutDateTime,
+                secondsUntilTimeout = secondsLeft,
+                loginId = timeout.LoginId
+            });
+        }
+
         /// <summary>
         /// CAS Login function -- redirects to original page, no VIEW
         /// </summary>

web/Views/Shared/Components/SessionTimeout/SessionTimeout.cs

@@ -10,10 +10,12 @@ public async Task<IViewComponentResult> InvokeAsync()
             UserHelper userHelper = new UserHelper();
             string? loginId = userHelper.GetCurrentUser()?.LoginId;
             bool onDev = HttpHelper.Environment?.EnvironmentName == "Development";
-            ViewData["sessionRefreshUrl"] = (onDev ? "http://localhost/" : ("https://" + HttpHelper.HttpContext?.Request.Host.Value + "/"))
-                + "/public/timeout/seconds_until_timeout_v2.cfm?id="
-                + (loginId ?? "")
-                + "&service=" + (onDev ? "Viper2-dev" : "Viper2");
+            ViewData["sessionRefreshUrl"] = onDev
+                ? "/GetSessionTimeout"
+                : ("https://" + HttpHelper.HttpContext?.Request.Host.Value + "/")
+                    + "public/timeout/seconds_until_timeout_v2.cfm?id="
+                    + (loginId ?? "")
+                    + "&service=Viper2";
             return await Task.Run(() => View("Default"));
         }
 

web/Viper.csproj

@@ -6,6 +6,7 @@
     <ImplicitUsings>enable</ImplicitUsings>
     <AppendRuntimeIdentifierToOutputPath>false</AppendRuntimeIdentifierToOutputPath>
     <PublishDir>bin\Release\net10.0\publish\</PublishDir>
+    <NoWarn>$(NoWarn);NU1902;NU1608</NoWarn>
   </PropertyGroup>
 
   <ItemGroup>