From fc646475c8464a4edae9bee53602cb6a1f3a1ad5 Mon Sep 17 00:00:00 2001
From: Vagisha Sharma <vagisha@gmail.com>
Date: Sat, 25 Apr 2026 18:00:37 -0700
Subject: [PATCH 1/5] Added container filtering on test results tables.

---
 .../testresults/TestResultsController.java    |   9 +-
 .../labkey/testresults/TestResultsSchema.java |  69 +++++++++++-
 .../src/org/labkey/testresults/view/user.jsp  |   2 +-
 .../tests/testresults/TestResultsTest.java    | 106 +++++++++++++++++-
 4 files changed, 178 insertions(+), 8 deletions(-)

diff --git a/testresults/src/org/labkey/testresults/TestResultsController.java b/testresults/src/org/labkey/testresults/TestResultsController.java
index aeebef33..d7d467fa 100644
--- a/testresults/src/org/labkey/testresults/TestResultsController.java
+++ b/testresults/src/org/labkey/testresults/TestResultsController.java
@@ -410,10 +410,15 @@ public static void ensureRunDataCached(RunDetail[] runs, boolean keepObjData) {
 
     public static User[] getUsers(Container trainingDataContainer, String username) {
         SQLFragment sqlFragment = new SQLFragment();
-        sqlFragment.append("SELECT id, username FROM testresults.user");
+        sqlFragment.append("SELECT id, username FROM testresults.user WHERE 1=1");
+        if (trainingDataContainer != null)
+        {
+            sqlFragment.append(" AND id IN (SELECT userid FROM testresults.testruns WHERE container = ?)");
+            sqlFragment.add(trainingDataContainer.getEntityId());
+        }
         if (username != null && !username.isEmpty())
         {
-            sqlFragment.append(" WHERE username = ?");
+            sqlFragment.append(" AND username = ?");
             sqlFragment.add(username);
         }
         sqlFragment.append(" ORDER BY id");
diff --git a/testresults/src/org/labkey/testresults/TestResultsSchema.java b/testresults/src/org/labkey/testresults/TestResultsSchema.java
index d76d5ae9..ee0107ab 100644
--- a/testresults/src/org/labkey/testresults/TestResultsSchema.java
+++ b/testresults/src/org/labkey/testresults/TestResultsSchema.java
@@ -24,10 +24,12 @@
 import org.labkey.api.data.DbSchema;
 import org.labkey.api.data.DbSchemaType;
 import org.labkey.api.data.ForeignKey;
+import org.labkey.api.data.SQLFragment;
 import org.labkey.api.data.TableInfo;
 import org.labkey.api.data.dialect.SqlDialect;
 import org.labkey.api.module.Module;
 import org.labkey.api.query.DefaultSchema;
+import org.labkey.api.query.FieldKey;
 import org.labkey.api.query.FilteredTable;
 import org.labkey.api.query.QueryForeignKey;
 import org.labkey.api.query.QuerySchema;
@@ -86,7 +88,8 @@ public static SqlDialect getSqlDialect()
     @Override
     public @Nullable TableInfo createTable(@NotNull String name, @NotNull ContainerFilter cf)
     {
-        TableInfo dbTable = switch (name.toLowerCase())
+        String lower = name.toLowerCase();
+        TableInfo dbTable = switch (lower)
         {
             case TABLE_TEST_RUNS       -> getTableInfoTestRuns();
             case TABLE_USER            -> getTableInfoUser();
@@ -102,12 +105,74 @@ public static SqlDialect getSqlDialect()
         };
         if (dbTable == null)
             return null;
-        FilteredTable<TestResultsSchema> table = new FilteredTable<>(dbTable, this, cf);
+        FilteredTable<TestResultsSchema> table = switch (lower)
+        {
+            case TABLE_HANGS, TABLE_MEMORY_LEAKS, TABLE_HANDLE_LEAKS, TABLE_TEST_PASSES, TABLE_TEST_FAILS ->
+                    createRunChildTable(dbTable, cf, "testrunid");
+            case TABLE_TRAIN_RUNS ->
+                    createRunChildTable(dbTable, cf, "runid");
+            case TABLE_USER ->
+                    createUserTable(dbTable, cf);
+            default ->
+                    new FilteredTable<>(dbTable, this, cf);
+        };
         table.wrapAllColumns(true);
         resolveSchemaForeignKeys(table, cf);
         return table;
     }
 
+    /**
+     * Filters a table that has no container column of its own by joining to testruns
+     * via fkColumn and applying the container filter to testruns.container.
+     */
+    private FilteredTable<TestResultsSchema> createRunChildTable(TableInfo dbTable, ContainerFilter cf, String fkColumn)
+    {
+        return new FilteredTable<>(dbTable, this, cf)
+        {
+            @Override
+            public FieldKey getContainerFieldKey()
+            {
+                return FieldKey.fromParts(fkColumn, "container");
+            }
+
+            @Override
+            protected void applyContainerFilter(ContainerFilter filter)
+            {
+                FieldKey containerFieldKey = FieldKey.fromParts("container");
+                clearConditions(containerFieldKey);
+                SQLFragment sql = new SQLFragment().appendIdentifier(fkColumn).append(" IN (SELECT tr.id FROM ");
+                sql.append(getTableInfoTestRuns(), "tr");
+                sql.append(" WHERE ");
+                sql.append(filter.getSQLFragment(getSchema(), new SQLFragment("tr.container")));
+                sql.append(")");
+                addCondition(sql, containerFieldKey);
+            }
+        };
+    }
+
+    /**
+     * The user table has no container column and no FK to testruns. Filter it to users
+     * referenced by at least one testrun in an allowed container.
+     */
+    private FilteredTable<TestResultsSchema> createUserTable(TableInfo dbTable, ContainerFilter cf)
+    {
+        return new FilteredTable<>(dbTable, this, cf)
+        {
+            @Override
+            protected void applyContainerFilter(ContainerFilter filter)
+            {
+                FieldKey containerFieldKey = FieldKey.fromParts("container");
+                clearConditions(containerFieldKey);
+                SQLFragment sql = new SQLFragment("id IN (SELECT tr.userid FROM ");
+                sql.append(getTableInfoTestRuns(), "tr");
+                sql.append(" WHERE ");
+                sql.append(filter.getSQLFragment(getSchema(), new SQLFragment("tr.container")));
+                sql.append(")");
+                addCondition(sql, containerFieldKey);
+            }
+        };
+    }
+
     /**
      * Converts DbSchema-level FKs (propagated by wrapAllColumns()) into UserSchema-level FKs
      * so the Query Schema Browser renders hyperlinks and can navigate to target query grids.
diff --git a/testresults/src/org/labkey/testresults/view/user.jsp b/testresults/src/org/labkey/testresults/view/user.jsp
index 7396e469..954d7f22 100644
--- a/testresults/src/org/labkey/testresults/view/user.jsp
+++ b/testresults/src/org/labkey/testresults/view/user.jsp
@@ -86,7 +86,7 @@
 <%--        <input type="file" name="xml_file"><input type="submit" value="submit">This form is meant to parse and store xml files into the database--%>
 <%--    </form>--%>
     <%
-        User[] users = TestResultsController.getUsers(null, null);
+        User[] users = TestResultsController.getUsers(getViewContext().getContainer(), null);
         Arrays.sort(users, Comparator.comparing(User::getUsername)); %>
     <div style="margin: 12px 0;">
         <select id="users">
diff --git a/testresults/test/src/org/labkey/test/tests/testresults/TestResultsTest.java b/testresults/test/src/org/labkey/test/tests/testresults/TestResultsTest.java
index 28b57a81..917cd266 100644
--- a/testresults/test/src/org/labkey/test/tests/testresults/TestResultsTest.java
+++ b/testresults/test/src/org/labkey/test/tests/testresults/TestResultsTest.java
@@ -26,6 +26,7 @@
 import org.junit.BeforeClass;
 import org.junit.Test;
 import org.junit.experimental.categories.Category;
+import org.labkey.remoteapi.CommandException;
 import org.labkey.remoteapi.Connection;
 import org.labkey.remoteapi.query.SelectRowsCommand;
 import org.labkey.remoteapi.query.SelectRowsResponse;
@@ -44,6 +45,7 @@
 import org.labkey.test.util.TextSearcher;
 
 import java.io.File;
+import java.io.IOException;
 import java.time.LocalDate;
 import java.time.format.DateTimeFormatter;
 import java.util.List;
@@ -51,6 +53,7 @@
 
 import static org.junit.Assert.assertEquals;
 import static org.junit.Assert.assertFalse;
+import static org.junit.Assert.assertNotEquals;
 import static org.junit.Assert.assertTrue;
 
 @Category({External.class, MacCossLabModules.class})
@@ -115,12 +118,20 @@ private void doSetup()
     }
 
     /**
-     * Posts a sample XML file to PostAction.
+     * Posts a sample XML file to PostAction in the main project container.
      */
     private void postSampleXml(String sampleDataRelativePath)
+    {
+        postSampleXml(sampleDataRelativePath, PROJECT_NAME);
+    }
+
+    /**
+     * Posts a sample XML file to PostAction in the given container.
+     */
+    private void postSampleXml(String sampleDataRelativePath, String containerPath)
     {
         File xmlFile = TestFileUtils.getSampleData(sampleDataRelativePath);
-        String postUrl = WebTestHelper.buildURL("testresults", PROJECT_NAME, "post");
+        String postUrl = WebTestHelper.buildURL("testresults", containerPath, "post");
 
         try (CloseableHttpClient httpClient = WebTestHelper.getHttpClient())
         {
@@ -655,6 +666,90 @@ public void testDeleteRun()
         assertTextNotPresent("TestDisposableOne");
     }
 
+    /**
+     * Verifies that child tables in the testresults schema are container-filtered
+     * via a join to testruns. Creates a subfolder, posts a single run into it,
+     * then checks that testpasses, testfails, trainruns, and user queries from
+     * each container only return rows for runs in that container.
+     *
+     * Not separately tested: hangs, memoryleaks, handleleaks. These go through the
+     * same {@code createRunChildTable} helper as testpasses/testfails, so verifying
+     * those covers them by construction.
+     */
+    @Test
+    public void testContainerFiltering() throws IOException, CommandException
+    {
+        final String subFolder = "ContainerFilterTest";
+        final String subFolderPath = "/" + PROJECT_NAME + "/" + subFolder;
+        _containerHelper.createSubfolder(PROJECT_NAME, subFolder);
+        _containerHelper.enableModule(subFolderPath, "TestResults");
+        // pc1-run-0116-failures.xml: 150 tests (testsrun=150), 2 failures (TestFailOne, TestFailTwo).
+        postSampleXml("testresults/pc1-run-0116-failures.xml", subFolderPath);
+
+        Connection conn = WebTestHelper.getRemoteApiConnection();
+
+        // The subfolder has exactly one run (the one we just posted). Fetch its ID.
+        SelectRowsCommand runsCmd = new SelectRowsCommand("testresults", "testruns");
+        runsCmd.setColumns(List.of("id", "userid/username"));
+        SelectRowsResponse subRuns = runsCmd.execute(conn, subFolderPath);
+        assertEquals("Subfolder should have exactly 1 run", 1, subRuns.getRows().size());
+        int subRunId = ((Number) subRuns.getRows().getFirst().get("id")).intValue();
+
+        // testpasses: 150 rows, all referencing subRunId. None visible from parent.
+        assertTableContainerFiltered(conn, "testpasses", "testrunid", subFolderPath, subRunId, 150);
+
+        // testfails: 2 failures in the posted XML.
+        assertTableContainerFiltered(conn, "testfails", "testrunid", subFolderPath, subRunId, 2);
+
+        // Add the subfolder's run to the training set, then verify trainruns filtering.
+        JSONObject trainResp = postApi("trainRun",
+                Map.of("runId", String.valueOf(subRunId), "train", "true"),
+                subFolderPath);
+        assertTrue("Adding run to training set failed: " + trainResp, trainResp.optBoolean("Success", false));
+
+        assertTableContainerFiltered(conn, "trainruns", "runid", subFolderPath, subRunId, 1);
+
+        // user: the subfolder's only run is for TEST-PC-1, so only that user should
+        // be visible there. The parent has both TEST-PC-1 and TEST-PC-2.
+        SelectRowsCommand userCmd = new SelectRowsCommand("testresults", "user");
+        userCmd.setColumns(List.of("username"));
+        SelectRowsResponse subUsers = userCmd.execute(conn, subFolderPath);
+        assertEquals("Subfolder should see only TEST-PC-1", 1, subUsers.getRows().size());
+        assertEquals(COMPUTER_NAME_1, subUsers.getRows().getFirst().get("username"));
+
+        SelectRowsResponse parentUsers = userCmd.execute(conn, PROJECT_NAME);
+        List<String> parentUsernames = parentUsers.getRows().stream()
+                .map(r -> (String) r.get("username")).toList();
+        assertTrue("Parent should see TEST-PC-1", parentUsernames.contains(COMPUTER_NAME_1));
+        assertTrue("Parent should see TEST-PC-2", parentUsernames.contains(COMPUTER_NAME_2));
+    }
+
+    /**
+     * Asserts that {@code tableName} is container-filtered: the subfolder query
+     * returns exactly {@code expectedSubfolderRows} rows, all referencing
+     * {@code subRunId}; the parent query returns no rows referencing
+     * {@code subRunId}.
+     */
+    private void assertTableContainerFiltered(Connection conn, String tableName, String fkColumn,
+                                              String subFolderPath, int subRunId, int expectedSubfolderRows)
+            throws IOException, CommandException
+    {
+        SelectRowsCommand cmd = new SelectRowsCommand("testresults", tableName);
+        cmd.setColumns(List.of(fkColumn));
+
+        SelectRowsResponse subfolderRows = cmd.execute(conn, subFolderPath);
+        assertEquals(tableName + " row count in subfolder",
+                expectedSubfolderRows, subfolderRows.getRows().size());
+        for (Map<String, Object> row : subfolderRows.getRows())
+            assertEquals("All " + tableName + " rows in subfolder must reference subRunId",
+                    subRunId, ((Number) row.get(fkColumn)).intValue());
+
+        SelectRowsResponse parentRows = cmd.execute(conn, PROJECT_NAME);
+        for (Map<String, Object> row : parentRows.getRows())
+            assertNotEquals("Parent " + tableName + " must not reference subfolder's run " + subRunId,
+                    subRunId, ((Number) row.get(fkColumn)).intValue());
+    }
+
     // -------------------------------------------------------------------------
     // Helpers
     // -------------------------------------------------------------------------
@@ -860,7 +955,12 @@ private String getApiString(String action, int runId, String field)
      */
     private JSONObject postApi(String action, Map<String, String> params)
     {
-        StringBuilder url = new StringBuilder(WebTestHelper.buildURL("testresults", PROJECT_NAME, action));
+        return postApi(action, params, PROJECT_NAME);
+    }
+
+    private JSONObject postApi(String action, Map<String, String> params, String containerPath)
+    {
+        StringBuilder url = new StringBuilder(WebTestHelper.buildURL("testresults", containerPath, action));
         boolean first = true;
         for (Map.Entry<String, String> e : params.entrySet())
         {

From 9e0e872c146730d37ccb81d8dc4318b9f8aaeee9 Mon Sep 17 00:00:00 2001
From: Vagisha Sharma <vagisha@gmail.com>
Date: Sun, 14 Jun 2026 19:01:09 -0700
Subject: [PATCH 2/5] Added comment about why testresults.user table omits
 getContainerFieldKey.

---
 testresults/src/org/labkey/testresults/TestResultsSchema.java | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/testresults/src/org/labkey/testresults/TestResultsSchema.java b/testresults/src/org/labkey/testresults/TestResultsSchema.java
index ee0107ab..9054c6bd 100644
--- a/testresults/src/org/labkey/testresults/TestResultsSchema.java
+++ b/testresults/src/org/labkey/testresults/TestResultsSchema.java
@@ -153,6 +153,9 @@ protected void applyContainerFilter(ContainerFilter filter)
     /**
      * The user table has no container column and no FK to testruns. Filter it to users
      * referenced by at least one testrun in an allowed container.
+     *
+     * No getContainerFieldKey() override: a machine can post to several containers, so it
+     * has no single "home" container. applyContainerFilter() alone does the scoping.
      */
     private FilteredTable<TestResultsSchema> createUserTable(TableInfo dbTable, ContainerFilter cf)
     {

From 40e9c06b3ebd3983b436a3631c108da41e3e24f1 Mon Sep 17 00:00:00 2001
From: Vagisha Sharma <vagisha@gmail.com>
Date: Tue, 16 Jun 2026 17:52:12 -0700
Subject: [PATCH 3/5] Routed testresults getUsers() folder scoping through the
 filtered user table

* getUsers() now reads the filtered "user" query table instead of re-applying the
  folder semi-join, so the scoping rule lives only in createUserTable().
* Added findUserIdByName() for run ingestion (anonymous, matches a computer by name
  across all folders); ParseAndStoreXML uses it instead of getUsers().
* Threaded the security User through getUsers() and its callers (controller pages,
  user.jsp, email job).
* Extended testContainerFiltering to check the User-page dropdown.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
---
 .../testresults/SendTestResultsEmail.java     |  2 +-
 .../testresults/TestResultsController.java    | 93 ++++++++++---------
 .../src/org/labkey/testresults/view/user.jsp  |  2 +-
 .../tests/testresults/TestResultsTest.java    | 21 +++++
 4 files changed, 71 insertions(+), 47 deletions(-)

diff --git a/testresults/src/org/labkey/testresults/SendTestResultsEmail.java b/testresults/src/org/labkey/testresults/SendTestResultsEmail.java
index ebb956ee..f406ed23 100644
--- a/testresults/src/org/labkey/testresults/SendTestResultsEmail.java
+++ b/testresults/src/org/labkey/testresults/SendTestResultsEmail.java
@@ -106,7 +106,7 @@ public Pair<String, String> getHTMLEmail(org.labkey.api.security.User from)
             TestResultsController.ensureRunDataCached(runs, false);
             TestResultsController.populatePassesLeaksFails(runs);
 
-            User[] users = TestResultsController.getUsers(container, null);
+            User[] users = TestResultsController.getUsers(from, container, null);
 
             RunDownBean data = new RunDownBean(runs, users);
             RunProblems problems = new RunProblems(data.getRunsByDate(end));
diff --git a/testresults/src/org/labkey/testresults/TestResultsController.java b/testresults/src/org/labkey/testresults/TestResultsController.java
index d7d467fa..51116660 100644
--- a/testresults/src/org/labkey/testresults/TestResultsController.java
+++ b/testresults/src/org/labkey/testresults/TestResultsController.java
@@ -34,6 +34,7 @@
 import org.labkey.api.collections.IntHashMap;
 import org.labkey.api.data.CompareType;
 import org.labkey.api.data.Container;
+import org.labkey.api.data.ContainerFilter;
 import org.labkey.api.data.ContainerManager;
 import org.labkey.api.data.DbScope;
 import org.labkey.api.data.JdbcType;
@@ -44,6 +45,7 @@
 import org.labkey.api.data.SqlExecutor;
 import org.labkey.api.data.SqlSelector;
 import org.labkey.api.data.Table;
+import org.labkey.api.data.TableInfo;
 import org.labkey.api.data.TableSelector;
 import org.labkey.api.files.FileContentService;
 import org.labkey.api.notification.EmailMessage;
@@ -323,7 +325,7 @@ public static RunDownBean getRunDownBean(org.labkey.api.security.User user, Cont
 
         ensureRunDataCached(allRuns, false);
 
-        User[] users = getUsers(c, null);
+        User[] users = getUsers(user, c, null);
         return new RunDownBean(allRuns, users, viewType, null, endDate);
     }
 
@@ -408,55 +410,59 @@ public static void ensureRunDataCached(RunDetail[] runs, boolean keepObjData) {
         }
     }
 
-    public static User[] getUsers(Container trainingDataContainer, String username) {
-        SQLFragment sqlFragment = new SQLFragment();
-        sqlFragment.append("SELECT id, username FROM testresults.user WHERE 1=1");
-        if (trainingDataContainer != null)
-        {
-            sqlFragment.append(" AND id IN (SELECT userid FROM testresults.testruns WHERE container = ?)");
-            sqlFragment.add(trainingDataContainer.getEntityId());
-        }
+    public static User[] getUsers(org.labkey.api.security.User user, Container trainingDataContainer, String username) {
+        // Scope the computer list to the current folder via the filtered "user" query table.
+        TableInfo userTable = new TestResultsSchema(user, trainingDataContainer)
+                .getTable(TestResultsSchema.TABLE_USER, ContainerFilter.current(trainingDataContainer, user));
+        SimpleFilter filter = new SimpleFilter();
         if (username != null && !username.isEmpty())
-        {
-            sqlFragment.append(" AND username = ?");
-            sqlFragment.add(username);
-        }
-        sqlFragment.append(" ORDER BY id");
+            filter.addCondition(FieldKey.fromParts("username"), username);
         List<User> users = new ArrayList<>();
-        new SqlSelector(TestResultsSchema.getSchema(), sqlFragment).forEach(rs -> {
+        new TableSelector(userTable, filter, new Sort("id")).forEach(rs -> {
             User u = new User();
             u.setId(rs.getInt("id"));
             u.setUsername(rs.getString("username"));
             users.add(u);
         });
 
-        if (trainingDataContainer != null)
-        {
-            sqlFragment = new SQLFragment();
-            sqlFragment.append(
-                "SELECT userid, meantestsrun, meanmemory, stddevtestsrun, stddevmemory, active " +
-                "FROM testresults.userdata " +
-                "WHERE container = ?");
-            sqlFragment.add(trainingDataContainer.getEntityId());
-            new SqlSelector(TestResultsSchema.getSchema(), sqlFragment).forEach(rs -> {
-                for (User u : users)
+        // Attach the training stats (userdata is keyed by container).
+        SQLFragment sqlFragment = new SQLFragment();
+        sqlFragment.append(
+            "SELECT userid, meantestsrun, meanmemory, stddevtestsrun, stddevmemory, active " +
+            "FROM testresults.userdata " +
+            "WHERE container = ?");
+        sqlFragment.add(trainingDataContainer.getEntityId());
+        new SqlSelector(TestResultsSchema.getSchema(), sqlFragment).forEach(rs -> {
+            for (User u : users)
+            {
+                if (u.getId() == rs.getInt("userid"))
                 {
-                    if (u.getId() == rs.getInt("userid"))
-                    {
-                        u.setMeantestsrun(rs.getDouble("meantestsrun"));
-                        u.setMeanmemory(rs.getDouble("meanmemory"));
-                        u.setStddevtestsrun(rs.getDouble("stddevtestsrun"));
-                        u.setStddevmemory(rs.getDouble("stddevmemory"));
-                        u.setContainer(trainingDataContainer);
-                        u.setActive(rs.getBoolean("active"));
-                        break;
-                    }
+                    u.setMeantestsrun(rs.getDouble("meantestsrun"));
+                    u.setMeanmemory(rs.getDouble("meanmemory"));
+                    u.setStddevtestsrun(rs.getDouble("stddevtestsrun"));
+                    u.setStddevmemory(rs.getDouble("stddevmemory"));
+                    u.setContainer(trainingDataContainer);
+                    u.setActive(rs.getBoolean("active"));
+                    break;
                 }
-            });
-        }
+            }
+        });
         return users.toArray(new User[0]);
     }
 
+    /**
+     * Looks up a computer's id by exact name across all folders, or -1 if none exists. The "user"
+     * row is global (no container column), and run ingestion (ParseAndStoreXML) runs anonymously
+     * and may be the computer's first post to a given folder, so this lookup must not be container-scoped.
+     */
+    private static int findUserIdByName(String username)
+    {
+        SQLFragment sql = new SQLFragment("SELECT id FROM testresults.user WHERE username = ? ORDER BY id", username);
+        List<Integer> ids = new ArrayList<>();
+        new SqlSelector(TestResultsSchema.getSchema(), sql).forEach(rs -> ids.add(rs.getInt("id")));
+        return ids.isEmpty() ? -1 : ids.get(0);
+    }
+
     /**
      * action to view trainging data for each user
      */
@@ -479,7 +485,7 @@ public ModelAndView getView(Object o, BindException errors) throws Exception
 
             ensureRunDataCached(runs, false);
 
-            User[] users = getUsers(getContainer(), null);
+            User[] users = getUsers(getUser(), getContainer(), null);
             TestsDataBean bean = new TestsDataBean(runs, users);
             JspView<TestsDataBean> view = new JspView<>("/org/labkey/testresults/view/trainingdata.jsp", bean);
             view.setFrame(WebPartView.FrameType.PORTAL);
@@ -627,7 +633,7 @@ public ModelAndView getView(ShowUserForm form, BindException errors) throws Exce
             User user = null;
             if (StringUtils.isNotBlank(userName))
             {
-                User[] users = getUsers(getContainer(), userName);
+                User[] users = getUsers(getUser(), getContainer(), userName);
                 if (users.length == 1)
                     user = users[0];
             }
@@ -1826,19 +1832,16 @@ private static void ParseAndStoreXML(String xml, Container c) throws Exception
 
                 Element docElement = doc.getDocumentElement();
                 // USER ID
-                int userid;
                 String username = docElement.getAttribute("id");
-                User[] details = getUsers(null, username);
-                if (details.length == 0) {
-                    User newUser =  new User();
+                int userid = findUserIdByName(username);
+                if (userid == -1) {
+                    User newUser = new User();
                     newUser.setUsername(username);
                     User u = Table.insert(null, TestResultsSchema.getTableInfoUser(), newUser);
                     if (u == null) {
                         throw new Exception();
                     }
                     userid = u.getId();
-                } else {
-                    userid = details[0].getId();
                 }
                 if (userid == -1)
                     throw new Exception("Issue with user/userid, may not be set");
diff --git a/testresults/src/org/labkey/testresults/view/user.jsp b/testresults/src/org/labkey/testresults/view/user.jsp
index 954d7f22..082e0028 100644
--- a/testresults/src/org/labkey/testresults/view/user.jsp
+++ b/testresults/src/org/labkey/testresults/view/user.jsp
@@ -86,7 +86,7 @@
 <%--        <input type="file" name="xml_file"><input type="submit" value="submit">This form is meant to parse and store xml files into the database--%>
 <%--    </form>--%>
     <%
-        User[] users = TestResultsController.getUsers(getViewContext().getContainer(), null);
+        User[] users = TestResultsController.getUsers(getViewContext().getUser(), getViewContext().getContainer(), null);
         Arrays.sort(users, Comparator.comparing(User::getUsername)); %>
     <div style="margin: 12px 0;">
         <select id="users">
diff --git a/testresults/test/src/org/labkey/test/tests/testresults/TestResultsTest.java b/testresults/test/src/org/labkey/test/tests/testresults/TestResultsTest.java
index 917cd266..49ee3345 100644
--- a/testresults/test/src/org/labkey/test/tests/testresults/TestResultsTest.java
+++ b/testresults/test/src/org/labkey/test/tests/testresults/TestResultsTest.java
@@ -722,6 +722,27 @@ public void testContainerFiltering() throws IOException, CommandException
                 .map(r -> (String) r.get("username")).toList();
         assertTrue("Parent should see TEST-PC-1", parentUsernames.contains(COMPUTER_NAME_1));
         assertTrue("Parent should see TEST-PC-2", parentUsernames.contains(COMPUTER_NAME_2));
+
+        // The SelectRows checks above hit the "user" query table (the FilteredTable from
+        // TestResultsSchema.createUserTable) via the query API. The User-page dropdown is a
+        // separate code path - built by TestResultsController.getUsers() - so verify it is
+        // folder-scoped too: the subfolder lists only TEST-PC-1, the parent lists both.
+        assertUserDropdownContains(subFolderPath, List.of(COMPUTER_NAME_1), List.of(COMPUTER_NAME_2));
+        assertUserDropdownContains("/" + PROJECT_NAME, List.of(COMPUTER_NAME_1, COMPUTER_NAME_2), List.of());
+    }
+
+    /**
+     * Navigates to the User page (ShowUserAction) in the given folder and asserts the computer
+     * dropdown - populated by TestResultsController.getUsers() - lists the expected computers.
+     * This exercises the server-rendered getUsers() path, separate from the query "user" table.
+     */
+    private void assertUserDropdownContains(String containerPath, List<String> present, List<String> absent)
+    {
+        beginAt(WebTestHelper.buildRelativeUrl("testresults", containerPath, "showUser"));
+        for (String name : present)
+            assertElementPresent(Locator.xpath("//select[@id='users']/option[@value='" + name + "']"));
+        for (String name : absent)
+            assertElementNotPresent(Locator.xpath("//select[@id='users']/option[@value='" + name + "']"));
     }
 
     /**

From d71d8aa87d660561df269295e52103deeef77e32 Mon Sep 17 00:00:00 2001
From: Vagisha Sharma <vagisha@gmail.com>
Date: Tue, 16 Jun 2026 18:20:48 -0700
Subject: [PATCH 4/5] Address Copilot's comments - added a null check

---
 .../src/org/labkey/testresults/TestResultsController.java       | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/testresults/src/org/labkey/testresults/TestResultsController.java b/testresults/src/org/labkey/testresults/TestResultsController.java
index 51116660..0f312e81 100644
--- a/testresults/src/org/labkey/testresults/TestResultsController.java
+++ b/testresults/src/org/labkey/testresults/TestResultsController.java
@@ -411,6 +411,8 @@ public static void ensureRunDataCached(RunDetail[] runs, boolean keepObjData) {
     }
 
     public static User[] getUsers(org.labkey.api.security.User user, Container trainingDataContainer, String username) {
+        if (trainingDataContainer == null)
+            throw new IllegalArgumentException("getUsers requires a folder; use findUserIdByName(username) for the no-folder lookup");
         // Scope the computer list to the current folder via the filtered "user" query table.
         TableInfo userTable = new TestResultsSchema(user, trainingDataContainer)
                 .getTable(TestResultsSchema.TABLE_USER, ContainerFilter.current(trainingDataContainer, user));

From fa01688c8810ccf897319c081cc44ce28b7b194d Mon Sep 17 00:00:00 2001
From: Vagisha Sharma <vagisha@gmail.com>
Date: Tue, 16 Jun 2026 18:36:56 -0700
Subject: [PATCH 5/5] Addressed review: guard blank computer name and annotate
 nullability

* ParseAndStoreXML now rejects a posted run XML with a blank id (computer name)
  instead of silently creating a blank-named computer row.
* Annotated getUsers() and findUserIdByName() params with @NotNull/@Nullable.

Co-Authored-By: Claude <noreply@anthropic.com>
---
 .../src/org/labkey/testresults/TestResultsController.java  | 7 +++++--
 1 file changed, 5 insertions(+), 2 deletions(-)

diff --git a/testresults/src/org/labkey/testresults/TestResultsController.java b/testresults/src/org/labkey/testresults/TestResultsController.java
index 0f312e81..17faeb9f 100644
--- a/testresults/src/org/labkey/testresults/TestResultsController.java
+++ b/testresults/src/org/labkey/testresults/TestResultsController.java
@@ -25,6 +25,7 @@
 import org.apache.logging.log4j.LogManager;
 import org.apache.logging.log4j.Logger;
 import org.jetbrains.annotations.NotNull;
+import org.jetbrains.annotations.Nullable;
 import org.labkey.api.action.ApiSimpleResponse;
 import org.labkey.api.action.MutatingApiAction;
 import org.labkey.api.action.ReadOnlyApiAction;
@@ -410,7 +411,7 @@ public static void ensureRunDataCached(RunDetail[] runs, boolean keepObjData) {
         }
     }
 
-    public static User[] getUsers(org.labkey.api.security.User user, Container trainingDataContainer, String username) {
+    public static User[] getUsers(@NotNull org.labkey.api.security.User user, @NotNull Container trainingDataContainer, @Nullable String username) {
         if (trainingDataContainer == null)
             throw new IllegalArgumentException("getUsers requires a folder; use findUserIdByName(username) for the no-folder lookup");
         // Scope the computer list to the current folder via the filtered "user" query table.
@@ -457,7 +458,7 @@ public static User[] getUsers(org.labkey.api.security.User user, Container train
      * row is global (no container column), and run ingestion (ParseAndStoreXML) runs anonymously
      * and may be the computer's first post to a given folder, so this lookup must not be container-scoped.
      */
-    private static int findUserIdByName(String username)
+    private static int findUserIdByName(@NotNull String username)
     {
         SQLFragment sql = new SQLFragment("SELECT id FROM testresults.user WHERE username = ? ORDER BY id", username);
         List<Integer> ids = new ArrayList<>();
@@ -1835,6 +1836,8 @@ private static void ParseAndStoreXML(String xml, Container c) throws Exception
                 Element docElement = doc.getDocumentElement();
                 // USER ID
                 String username = docElement.getAttribute("id");
+                if (StringUtils.isBlank(username))
+                    throw new IllegalArgumentException("Posted run XML is missing the required computer name (id attribute)");
                 int userid = findUserIdByName(username);
                 if (userid == -1) {
                     User newUser = new User();