Merge branch 'fix-users-api-500-error' into 'master'

Fix 500 errors when creating a user with identity via API

Closes #26295

See merge request !8442

3 files changed, 16 insertions, 7 deletions

diff --git a/changelogs/unreleased/fix-users-api-500-error.yml b/changelogs/unreleased/fix-users-api-500-error.yml
new file mode 100644
index 00000000000..ac9e7a480d8
--- /dev/null
+++ b/changelogs/unreleased/fix-users-api-500-error.yml
@@ -0,0 +1,4 @@
+---
+title: Fix 500 errors when creating a user with identity via API
+merge_request: 8442
+author:
diff --git a/lib/api/users.rb b/lib/api/users.rb
index de07fbf59fc..0db76ec7877 100644
--- a/lib/api/users.rb
+++ b/lib/api/users.rb
@@ -91,10 +91,11 @@ module API
         authenticated_as_admin!
 
         # Filter out params which are used later
-        identity_attrs = params.slice(:provider, :extern_uid)
+        user_params = declared_params(include_missing: false)
+        identity_attrs = user_params.slice(:provider, :extern_uid)
         confirm = params.delete(:confirm)
 
-        user = User.new(declared_params(include_missing: false))
+        user = User.new(user_params.except(:extern_uid, :provider))
         user.skip_confirmation! unless confirm
 
         if identity_attrs.any?
@@ -159,11 +160,7 @@ module API
           end
         end
 
-        # Delete already handled parameters
-        user_params.delete(:extern_uid)
-        user_params.delete(:provider)
-
-        if user.update_attributes(user_params)
+        if user.update_attributes(user_params.except(:extern_uid, :provider))
           present user, with: Entities::UserPublic
         else
           render_validation_error!(user)
diff --git a/spec/requests/api/users_spec.rb b/spec/requests/api/users_spec.rb
index 45b7988a054..2c2e17eddb0 100644
--- a/spec/requests/api/users_spec.rb
+++ b/spec/requests/api/users_spec.rb
@@ -265,6 +265,14 @@ describe API::Users, api: true  do
         expect(response).to have_http_status(409)
         expect(json_response['message']).to eq('Username has already been taken')
       end
+
+      it 'creates user with new identity' do
+        post api("/users", admin), attributes_for(:user, provider: 'github', extern_uid: '67890')
+
+        expect(response).to have_http_status(201)
+        expect(json_response['identities'].first['extern_uid']).to eq('67890')
+        expect(json_response['identities'].first['provider']).to eq('github')
+      end
     end
   end