From 1efc67ae9b2ae810309e9fb3de6d469cfb17add7 Mon Sep 17 00:00:00 2001
From: Jessica Lawshe <5312836+lawshe@users.noreply.github.com>
Date: Thu, 26 Feb 2026 08:21:33 -0600
Subject: [PATCH] Merge pull request #31736 from
 overleaf/jel-find-group-only-if-domain-confirmed

[web] Only query group with domain capture if domain is confirmed

GitOrigin-RevId: 612a711730b1f090f3e47410fd4ad68df33eca93
---
 .../Features/Institutions/InstitutionsAPI.mjs | 25 +++++++-------
 .../src/Institutions/InstitutionsAPI.test.mjs | 33 +++++++++++++++++++
 2 files changed, 47 insertions(+), 11 deletions(-)

diff --git a/services/web/app/src/Features/Institutions/InstitutionsAPI.mjs b/services/web/app/src/Features/Institutions/InstitutionsAPI.mjs
index fc675ea599..590cfbe91b 100644
--- a/services/web/app/src/Features/Institutions/InstitutionsAPI.mjs
+++ b/services/web/app/src/Features/Institutions/InstitutionsAPI.mjs
@@ -163,18 +163,21 @@ function getUserAffiliations(userId, callback) {
       if (body?.length > 0) {
         const concurrencyLimit = 10
         await promiseMapWithLimit(concurrencyLimit, body, async affiliation => {
-          const group = (
-            await Modules.promises.hooks.fire(
-              'getGroupWithDomainCaptureByV1Id',
-              affiliation.institution.id
-            )
-          )?.[0]
+          if (affiliation.institution.confirmed) {
+            // only check groups if domain is confirmed
+            const group = (
+              await Modules.promises.hooks.fire(
+                'getGroupWithDomainCaptureByV1Id',
+                affiliation.institution.id
+              )
+            )?.[0]
 
-          if (group) {
-            affiliation.group = {
-              _id: group._id,
-              managedUsersEnabled: Boolean(group.managedUsersEnabled),
-              domainCaptureEnabled: Boolean(group.domainCaptureEnabled),
+            if (group) {
+              affiliation.group = {
+                _id: group._id,
+                managedUsersEnabled: Boolean(group.managedUsersEnabled),
+                domainCaptureEnabled: Boolean(group.domainCaptureEnabled),
+              }
             }
           }
 
diff --git a/services/web/test/unit/src/Institutions/InstitutionsAPI.test.mjs b/services/web/test/unit/src/Institutions/InstitutionsAPI.test.mjs
index f4b3921c92..689501c96e 100644
--- a/services/web/test/unit/src/Institutions/InstitutionsAPI.test.mjs
+++ b/services/web/test/unit/src/Institutions/InstitutionsAPI.test.mjs
@@ -148,6 +148,7 @@ describe('InstitutionsAPI', function () {
           foo: 'bar',
           institution: {
             commonsAccount: true,
+            confirmed: true,
           },
         },
       ]
@@ -173,6 +174,7 @@ describe('InstitutionsAPI', function () {
           foo: 'bar',
           institution: {
             commonsAccount: false,
+            confirmed: true,
           },
         },
       ]
@@ -212,6 +214,37 @@ describe('InstitutionsAPI', function () {
       ])
     })
 
+    it('does not query for group with domain capture if domain is not confirmed', async function (ctx) {
+      const responseBody = [
+        {
+          id: '123abc',
+          foo: 'bar',
+          institution: {
+            commonsAccount: false,
+            confirmed: false,
+          },
+        },
+      ]
+      ctx.request.callsArgWith(1, null, { statusCode: 201 }, responseBody)
+
+      const body = await ctx.InstitutionsAPI.promises.getUserAffiliations(
+        ctx.stubbedUser._id
+      )
+      ctx.request.calledOnce.should.equal(true)
+      const requestOptions = ctx.request.lastCall.args[0]
+      const expectedUrl = `v1.url/api/v2/users/${ctx.stubbedUser._id}/affiliations`
+      requestOptions.url.should.equal(expectedUrl)
+      requestOptions.method.should.equal('GET')
+      requestOptions.maxAttempts.should.equal(3)
+      ctx.Modules.promises.hooks.fire.should.not.have.been.called
+      expect(requestOptions.body).not.to.exist
+      expect(body).to.deep.equal([
+        {
+          ...responseBody[0],
+        },
+      ])
+    })
+
     it('handle error', async function (ctx) {
       const body = { errors: 'affiliation error message' }
       ctx.request.callsArgWith(1, null, { statusCode: 503 }, body)