From 42900cf170f135f88a87f57b0fd36e8af5ce67be Mon Sep 17 00:00:00 2001
From: Jay Ohms <jay@37signals.com>
Date: Thu, 26 Feb 2026 16:45:16 -0500
Subject: [PATCH] Only return identity accounts that are active with an active
 user

---
 app/controllers/my/identities_controller.rb   |  4 +++
 app/views/my/identities/show.json.jbuilder    |  2 +-
 .../my/identities_controller_test.rb          | 30 ++++++++++++++++++-
 3 files changed, 34 insertions(+), 2 deletions(-)

diff --git a/app/controllers/my/identities_controller.rb b/app/controllers/my/identities_controller.rb
index 7a388a3c3..07b54e4c7 100644
--- a/app/controllers/my/identities_controller.rb
+++ b/app/controllers/my/identities_controller.rb
@@ -3,5 +3,9 @@ class My::IdentitiesController < ApplicationController
 
   def show
     @identity = Current.identity
+    @active_users = @identity.users.active
+      .joins(:account)
+      .merge(Account.active)
+      .includes(:account)
   end
 end
diff --git a/app/views/my/identities/show.json.jbuilder b/app/views/my/identities/show.json.jbuilder
index 090e97dfe..ce28fa53f 100644
--- a/app/views/my/identities/show.json.jbuilder
+++ b/app/views/my/identities/show.json.jbuilder
@@ -1,6 +1,6 @@
 json.id @identity.id
 
-json.accounts @identity.users do |user|
+json.accounts @active_users do |user|
   json.partial! "my/identities/account", account: user.account
   json.user user, partial: "users/user", as: :user
 end
diff --git a/test/controllers/my/identities_controller_test.rb b/test/controllers/my/identities_controller_test.rb
index 392e9b547..29888e9db 100644
--- a/test/controllers/my/identities_controller_test.rb
+++ b/test/controllers/my/identities_controller_test.rb
@@ -7,12 +7,40 @@ class My::IdentitiesControllerTest < ActionDispatch::IntegrationTest
 
   test "show as JSON" do
     identity = identities(:kevin)
+    expected_count = identity.users.active.joins(:account).merge(Account.active).count
 
     untenanted do
       get my_identity_path, as: :json
       assert_response :success
       assert_equal identity.id, @response.parsed_body["id"]
-      assert_equal identity.accounts.count, @response.parsed_body["accounts"].count
+      assert_equal expected_count, @response.parsed_body["accounts"].count
+    end
+  end
+
+  test "show as JSON includes active users from active accounts only" do
+    identity = identities(:kevin)
+
+    active_account = Account.create!(external_account_id: 9999981, name: "Active Account")
+    cancelled_account = Account.create!(external_account_id: 9999982, name: "Cancelled Account")
+    inactive_user_account = Account.create!(external_account_id: 9999983, name: "Inactive User Account")
+
+    identity.users.create!(account: active_account, name: "Kevin", role: :owner)
+
+    cancelling_user = identity.users.create!(account: cancelled_account, name: "Kevin", role: :owner)
+    cancelled_account.cancel(initiated_by: cancelling_user)
+
+    inactive_user = identity.users.create!(account: inactive_user_account, name: "Kevin", role: :owner)
+    inactive_user.update!(active: false)
+
+    untenanted do
+      get my_identity_path, as: :json
+      assert_response :success
+
+      account_ids = @response.parsed_body["accounts"].map { |account| account["id"] }
+
+      assert_includes account_ids, active_account.id
+      assert_not_includes account_ids, cancelled_account.id
+      assert_not_includes account_ids, inactive_user_account.id
     end
   end
 end