From 6961a82f3f2151d244472e1e6d3e32115c6da1c6 Mon Sep 17 00:00:00 2001
From: Leo Vasanko <leo@git>
Date: Tue, 10 Feb 2026 22:37:57 +0000
Subject: [PATCH] Remove unnecessary odd getter from db.operations.

---
 paskia/bootstrap.py     | 19 +++++++++++++------
 paskia/db/__init__.py   |  2 --
 paskia/db/operations.py |  9 ---------
 paskia/fastapi/admin.py |  6 +++---
 4 files changed, 16 insertions(+), 20 deletions(-)

diff --git a/paskia/bootstrap.py b/paskia/bootstrap.py
index 10caa2d..a6dae16 100644
--- a/paskia/bootstrap.py
+++ b/paskia/bootstrap.py
@@ -56,17 +56,24 @@ async def check_admin_credentials() -> bool:
         bool: True if a reset link was created, False if admin already has credentials
     """
     try:
-        # Get permission organizations to find admin users
+        # Find the auth:admin permission
         p = next(
             (p for p in db.data().permissions.values() if p.scope == "auth:admin"), None
         )
-        if not p or not p.orgs:
+        if not p:
             return False
 
-        # Get users from the first organization with admin permission
-        first_org_uuid = next(iter(p.orgs))
-        org_users = db.get_organization_users(first_org_uuid)
-        admin_users = [user for user, role in org_users if role == "Administration"]
+        perm_uuid = p.uuid
+
+        # Find all roles that have the auth:admin permission
+        admin_roles = [
+            r for r in db.data().roles.values() if perm_uuid in r.permissions
+        ]
+
+        # Collect all users from those roles
+        admin_users = []
+        for role in admin_roles:
+            admin_users.extend(role.users)
 
         if not admin_users:
             return False
diff --git a/paskia/db/__init__.py b/paskia/db/__init__.py
index 0c5b40b..cd19278 100644
--- a/paskia/db/__init__.py
+++ b/paskia/db/__init__.py
@@ -48,7 +48,6 @@ from paskia.db.operations import (
     delete_sessions_for_user,
     delete_user,
     get_config,
-    get_organization_users,
     get_reset_token,
     get_user_credential_ids,
     get_user_organization,
@@ -112,7 +111,6 @@ __all__ = [
     "build_user",
     # Read ops
     "get_config",
-    "get_organization_users",
     "get_reset_token",
     "get_user_credential_ids",
     "get_user_organization",
diff --git a/paskia/db/operations.py b/paskia/db/operations.py
index a571db1..eec2775 100644
--- a/paskia/db/operations.py
+++ b/paskia/db/operations.py
@@ -65,15 +65,6 @@ def get_user_organization(user_uuid: UUID) -> tuple[Org, str]:
     return role.org, role.display_name
 
 
-def get_organization_users(org_uuid: UUID) -> list[tuple[User, str]]:
-    """Get all users in an organization with their role names.
-
-    Returns list of (User, role_display_name) tuples.
-    """
-    org = _db.orgs[org_uuid]
-    return [(u, u.role.display_name) for role in org.roles for u in role.users]
-
-
 def get_user_credential_ids(user_uuid: UUID) -> list[bytes]:
     """Get credential IDs for a user (for WebAuthn exclude lists).
 
diff --git a/paskia/fastapi/admin.py b/paskia/fastapi/admin.py
index 3a40da9..20d861c 100644
--- a/paskia/fastapi/admin.py
+++ b/paskia/fastapi/admin.py
@@ -83,7 +83,6 @@ async def admin_list_orgs(request: Request, auth=AUTH_COOKIE):
         orgs = [o for o in orgs if o.uuid == ctx.org.uuid]
 
     def org_to_dict(o):
-        users = db.get_organization_users(o.uuid)
         return {
             "uuid": o.uuid,
             "display_name": o.display_name,
@@ -101,12 +100,13 @@ async def admin_list_orgs(request: Request, auth=AUTH_COOKIE):
                 {
                     "uuid": u.uuid,
                     "display_name": u.display_name,
-                    "role": role_name,
+                    "role": r.display_name,
                     "role_uuid": u.role_uuid,
                     "visits": u.visits,
                     "last_seen": u.last_seen,
                 }
-                for (u, role_name) in users
+                for r in o.roles
+                for u in r.users
             ],
         }