fix(auth): deduplicate users in add_users_to_policy

[bhudevbhanpuriya]

Description

The add_users_to_policy function in database/istsos_auth.sql used simple array concatenation (old_roles_ || users_), which allows duplicate usernames to accumulate across repeated calls. Over time this causes role array drift, making audits harder and potentially leading to unexpected behavior.

Root cause Line 778 previously read:

new_roles_ := old_roles_ || users_;

This merges arrays without removing duplicates.

Fix Changed the merge to deduplicate using DISTINCT:

new_roles_ := (SELECT array_agg(DISTINCT x) FROM unnest(old_roles_ || users_) AS x);

This ensures the resulting array always contains unique usernames, whether duplicates existed in old_roles_, appear in users_, or span across both arrays.

Changes

• database/istsos_auth.sql - fixed the array merge
• test/database/test_auth_sql.py - added regression test test_add_users_to_policy_deduplicates_duplicate_users

Migration Existing databases may already have duplicate entries in policy role arrays. After deploying this fix, run a one-time cleanup:

UPDATE pg_policies SET roles = (SELECT array_agg(DISTINCT r) FROM unnest(roles) AS r) WHERE schemaname = 'sensorthings';

Alternatively, recreate policies via the existing admin endpoints.

Testing The new regression test verifies:

• Policy creation with initial users
• Adding a mix of already-present and new users
• Final role arrays contain exactly the deduplicated set

Run: pytest test/database/test_auth_sql.py::TestAuth::test_add_users_to_policy_deduplicates_duplicate_users