User Service: Prevent fetching all permissions when no IDs are provided

src/Umbraco.Core/Services/UserService.cs

@@ -2055,6 +2055,11 @@ private async Task<Attempt<IEnumerable<NodePermissions>, UserOperationStatus>> G
         Dictionary<Guid, int> nodes,
         IEnumerable<UmbracoObjectTypes> objectTypes)
     {
+        if (nodes.Count == 0)
+        {
+            return Attempt.SucceedWithStatus(UserOperationStatus.Success, Enumerable.Empty<NodePermissions>());
+        }
+
         IUser? user = await GetAsync(userKey);
         if (user is null)
         {

tests/Umbraco.Tests.Integration/Umbraco.Infrastructure/Services/UserServiceTests.Permissions.cs

@@ -386,6 +386,33 @@ public async Task AssignUserGroupPermission_Sets_Permission_On_Multiple_Entities
         Assert.IsTrue(perms2.Permissions.Contains(ActionBrowse.ActionLetter));
     }
 
+    [Test]
+    public async Task GetDocumentPermissionsAsync_Returns_Empty_Permissions_For_Empty_Keys()
+    {
+        // Arrange
+        var userGroup = await CreateTestUserGroup();
+        var user = UserService.CreateUserWithIdentity("test1", "test1@test.com");
+        user.AddGroup(userGroup.ToReadOnlyGroup());
+        UserService.Save(user);
+
+        // Create content so the database is non-empty — we want to verify that an an empty key collection
+        // does not return ALL documents, producing a non-empty result instead of the expected empty one.
+        var contentType = ContentTypeBuilder.CreateSimpleContentType();
+        contentType.AllowedTemplates = null;
+        await ContentTypeService.CreateAsync(contentType, Constants.Security.SuperUserKey);
+        var content = ContentBuilder.CreateSimpleContent(contentType);
+        ContentService.Save(content);
+
+        // Act
+        var result = await UserService
+            .GetDocumentPermissionsAsync(user.Key, Array.Empty<Guid>());
+
+        // Assert
+        Assert.IsTrue(result.Success);
+        Assert.AreEqual(UserOperationStatus.Success, result.Status);
+        Assert.IsEmpty(result.Result);
+    }
+
     [Test]
     public async Task AssignUserGroupPermission_Adds_To_Existing_Permissions()
     {