[HIGH] H7: UserSync SQL broken on Postgres — empty branch + PHP operator in SQL string

[rubenvdlinde]

Severity: HIGH

Location: lib/Service/OrganizationSyncService.php lines 478–531

Description:
The user-sync query has two defects:

1. Missing Postgres implementation: The if ($isPostgres) {} block is empty. The Postgres branch never assigns the query, so performUserSync throws an exception on every Postgres cron tick. The exception is caught upstream but recordSyncTime() is never reached, so the "last sync" timestamp is never updated.

2. PHP operator in SQL: Line 506 contains o.username !== '' (PHP not-identical operator) inside a raw SQL string. The database receives an invalid expression and rejects the query.

Scenario:
On any Postgres installation the scheduled user sync silently fails every cron cycle. Admins see a stale "last sync" timestamp and no error message because the exception is swallowed.

Suggested fix:

• Implement the Postgres branch using o.users::jsonb @> to_jsonb(o.username) or equivalent.
• Replace !== with <> in the SQL string.

---

Source: deep team-reviewer pass 2026-05-27

[rubenvdlinde]

Fixed in #355 (merged to development).