Issue Summary

Running any of the user assignable searches API will return results inconsistent with expectations

1)

/rest/user/assignable/multiProjectSearch

startAt=1000 and maxResults=1000 does not show results post 1000 records. The output is empty

2) 

/rest/user/assignable/search

startAt=1000 and maxResults=1000 does not show results post 1000 records. The output is empty

Steps to Reproduce

1. Create around 2000 users using the Data Generator plugin
2. Add these users to a project under users and roles
3. This API will produce 1000 results
   • http://localhost:8080/rest/api/2/user/assignable/multiProjectSearch?projectKeys=TEST&startAt=0&maxResults=1000&expand=changelog
4. This API will produce 0 results
   • http://localhost:8080/rest/api/2/user/assignable/multiProjectSearch?projectKeys=TEST&startAt=1000&maxResults=1000&expand=changelog
5. The results after 1000 records are not produced.

Expected Results

API calls to /rest/user/assignable/multiProjectSearch return all results using the:
startAt=0 and maxResults=1000
startAt=1000 and maxResults=1000
startAt=2000 and maxResults=1000 and so on

Actual Results

• maxResults appears to be ignored and only the default number of results is returned (either 1000 or 100 results).
• The API call /rest/user/assignable/multiProjectSearch with startAt=1000 and maxResults=2000 does not show results

Note: The same behavior is observed when making a request to /rest/user/search (the behavior is not limited to rest/user/assignable)

Workaround

Currently, there is no known workaround for this behavior, i.e. to fetch more than 1000 users.

Steps to Reproduce 2

1. Create around 2000 users using the Data Generator plugin
2. Add these users to a project under users and roles
3. This API will produce 1000 results
   • http://localhost:8080/rest/api/2/user/assignable/search?projectKeys=TEST&startAt=0&maxResults=1000
4. This API will produce the same 0 results
   • http://localhost:8080/rest/api/2/user/assignable/search?projectKeys=TEST&startAt=1000&maxResults=1000
5. The results after 1000 records are not produced.

Expected Results

API calls to /rest/user/assignable/search return all results using the:

startAt=0 and maxResults=1000
startAt=1000 and maxResults=1000
startAt=2000 and maxResults=1000 and so on

Actual Results

The API call /rest/user/assignable/search with startAt=1000 and maxResults=2000 does not show results

Workaround

There is workaround for use cases that have a large amount of users but do not need everyone in the list only a smaller subset.

This leverages the "Assignable User" permission for the given project(s).

You can create a separate group(s), that has a small subset of specific that really need to be the only assignable users on the project(s)

Then change the "Assignable User" permission for the project(s) so that it is restricted to the new smaller group(s) only.

Retry the rest endpoint and you will get the desired results of the smaller subset of users.

Ensure that when you call the endpoint you pass in only the project key and this permission will be checked.

 Alternatives

There is a rest endpoint rest/api/2/user/permission/search that allows you do exactly what user/assignable/search and user/assignable/multiProjectSearch does but with working pagination. The cons of this endpoint are
1) it require admin permission
2) it can cause some performance issues like user/assignable/search and user/assignable/multiProjectSearch does before our changes

This endpoint is deprecated because of performance issues and will be deleted any time in Jira 9.x, but no specific version has been given yet. However, it will remain in Jira 8.x.

Since Jira user pickers for assignable and mentionable users was improved, other possible solution may be delegating such integration directly to Jira. It also avoids redoing the searches Jira did to return all users. Server side integration can work as a proxy for requests even with some caching and other improvements if needed.