1.2.5

api/docs/space-api-docs.yaml

@@ -193,8 +193,9 @@ paths:
             type: string
           description: |
             Search query to match against usernames (case-insensitive regex).
-            - If provided and not empty: performs search filtering
-            - If not provided or empty: returns all users (ADMIN required)
+            - If provided with 4 or more characters: performs search filtering
+            - If not provided: returns all users (ADMIN required)
+            - If provided with less than 4 characters: returns users that match the filter (ADMIN required)
           example: john
         - name: limit
           in: query

api/src/main/controllers/UserController.ts

@@ -72,8 +72,8 @@ class UserController {
         return res.status(401).send({ error: 'Authentication required' });
       }
 
-      if (q.length === 0 && req.user.role !== 'ADMIN') {
-        return res.status(403).send({ error: 'PERMISSION ERROR: Only admins can retrieve the full user list without a search query' });
+      if (q.length < 4 && req.user.role !== 'ADMIN') {
+        return res.status(403).send({ error: 'PERMISSION ERROR: Only admins can retrieve the full user list without providing at least 4 characters in the search query' });
       }
 
       const searchLimit = limit ? parseInt(limit, 10) : 10;

api/src/test/user.test.ts

@@ -388,6 +388,51 @@ describe('User API routes', function () {
         expect(response.body).toHaveProperty('pagination');
       });
     });
+
+    describe('ACCESS CONTROL: USER role restrictions', function () {
+      it('returns 403 when USER tries to list users without q parameter', async function () {
+        const user = await createTestUser('USER', `user_no_q_${Date.now()}`);
+        trackUserForCleanup(user);
+
+        const response = await request(app)
+          .get(`${baseUrl}/users`)
+          .set('x-api-key', user.apiKey);
+
+        expect(response.status).toBe(403);
+        expect(response.body.error).toBeDefined();
+      });
+
+      it('returns 403 when USER provides q with fewer than 4 characters', async function () {
+        const user = await createTestUser('USER', `user_short_q_${Date.now()}`);
+        trackUserForCleanup(user);
+
+        const response = await request(app)
+          .get(`${baseUrl}/users?q=abc`)
+          .set('x-api-key', user.apiKey);
+
+        expect(response.status).toBe(403);
+        expect(response.body.error).toBeDefined();
+      });
+
+      it('returns 200 when USER provides q with 4 or more characters', async function () {
+        const requester = await createTestUser('USER', `user_q_ok_${Date.now()}`);
+        const match1 = await createTestUser('USER', `match_user_01_${Date.now()}`);
+        const match2 = await createTestUser('USER', `match_user_02_${Date.now()}`);
+
+        trackUserForCleanup(requester);
+        trackUserForCleanup(match1);
+        trackUserForCleanup(match2);
+
+        const response = await request(app)
+          .get(`${baseUrl}/users?q=match_user`)
+          .set('x-api-key', requester.apiKey);
+
+        expect(response.status).toBe(200);
+        expect(response.body).toHaveProperty('data');
+        expect(Array.isArray(response.body.data)).toBeTruthy();
+        expect(response.body.data.length).toBeGreaterThanOrEqual(2);
+      });
+    });
   });
 
 

frontend/src/pages/members/index.tsx

@@ -46,7 +46,7 @@ export default function MembersPage() {
     const trimmedQuery = userSearchQuery.trim();
     latestSearchQueryRef.current = trimmedQuery;
 
-    if (!trimmedQuery || trimmedQuery.length < 2) {
+    if (!trimmedQuery || trimmedQuery.length < 4) {
       setSearchResults([]);
       setShowDropdown(false);
       return;