Bulk user fetch for list of IDs

[david-crespo]

As a kind of workaround for #1207, it would be helpful to be able to fetch info on a specified set of users. We could put a comma-separated list of IDs in the query string.

I was initially concerned about the query string getting too long (UUID v4 is 36 characters), but as far as I can tell browser limits on query string length are pretty high. It's only Edge that's imposing any kind of limit we'd worry about, but I can't tell from various garbagey websites what exactly the limit is and whether it applies to background requests (it probably does). Some places claim it's around 2k chars, others claim it's 4k chars. It's worth looking into this further. If it doesn't work in the query string, we could use a POST.

[davepacheco]

Is it even worth doing this in bulk at this point or is that premature optimization?

[david-crespo]

Well, so far the number of users is almost always less than the max page size of 1000. But that could change soon and suddenly, couldn't it?

[davepacheco]

For sure. I was envisioning an API that fetches the details for one user, identified by id. I realize this could get bad in pathological cases. I'm expecting that most resources aren't going to have that many items in the policy, especially if customers are inclined to use groups.

[david-crespo]

Yeah, fetching for one user doesn't really help much if we're trying to display the table. I agree that groups are going to be the main way this is done. We also have this problem for group names, though in general there should be a lot fewer of them, so fetching all of them has a much longer lifetime as a temporary solution.

[davepacheco]

Can't you use the one-at-a-time API the same way you'd use the bulk API, just making separate requests?

Yeah, I think we'd need an analogous ones for groups.

[david-crespo]

You can, but browsers limit the number of concurrent requests to 4-8 (source), so that gets sad fast if you're doing 20. It could be ok for groups, though in that case I'd probably just pull them all in one request.

[davepacheco]

I imagine another prerequisite here is having any useful information about Silo Users. In #1261 they'll only have an id, so this doesn't seem useful. After #1210 they'll have an external_id, but even that may not generally be useful.

[david-crespo]

Yes, definitely. That broad problem may be a big deal for role assignment in the console. The UI for picking a user is not usable if you don't have a human-readable display name to choose them by.