From 74865a04e3bd7a5a0a20ff4f65a4c9bbebc32626 Mon Sep 17 00:00:00 2001
From: rushtong <grushton@broadinstitute.org>
Date: Thu, 22 May 2025 18:28:57 -0400
Subject: [PATCH 01/26] wip: first pass at making LCs singular - compilation
 and most tests pass

---
 .idea/codeStyles/Project.xml                  |   1 +
 .../consent/http/db/LibraryCardDAO.java       |   4 +-
 .../consent/http/db/UserDAO.java              |  81 +++++--
 .../http/db/mapper/DarCollectionReducer.java  |   2 +-
 .../http/db/mapper/UserWithRolesReducer.java  |  57 +++--
 .../consent/http/models/LibraryCard.java      |   7 +
 .../consent/http/models/User.java             |  24 +--
 .../consent/http/resources/DaaResource.java   |  34 ++-
 .../resources/DataAccessRequestResource.java  |   2 +-
 .../service/DataAccessRequestService.java     |   7 +-
 .../http/service/LibraryCardService.java      |  59 +++--
 .../consent/http/service/UserService.java     |  44 ++--
 .../consent/http/db/DarCollectionDAOTest.java |  18 +-
 .../consent/http/db/LibraryCardDAOTest.java   |  57 ++---
 .../consent/http/db/UserDAOTest.java          |  10 +-
 .../http/resources/DaaResourceTest.java       | 202 +++++++++---------
 .../DataAccessRequestResourceTest.java        |  14 +-
 .../service/DataAccessRequestServiceTest.java |  12 +-
 .../http/service/LibraryCardServiceTest.java  |  89 +++-----
 .../consent/http/service/UserServiceTest.java |  50 ++---
 .../http/service/dao/NihServiceDAOTest.java   |  11 +-
 21 files changed, 379 insertions(+), 406 deletions(-)

diff --git a/.idea/codeStyles/Project.xml b/.idea/codeStyles/Project.xml
index b6c57434e5..9672c273ac 100644
--- a/.idea/codeStyles/Project.xml
+++ b/.idea/codeStyles/Project.xml
@@ -49,6 +49,7 @@
       </option>
       <option name="IMPORT_LAYOUT_TABLE">
         <value>
+          <package name="" withSubpackages="true" static="false" module="true" />
           <package name="" withSubpackages="true" static="true" />
           <emptyLine />
           <package name="" withSubpackages="true" static="false" />
diff --git a/src/main/java/org/broadinstitute/consent/http/db/LibraryCardDAO.java b/src/main/java/org/broadinstitute/consent/http/db/LibraryCardDAO.java
index 0153c67370..2f9dbe67de 100644
--- a/src/main/java/org/broadinstitute/consent/http/db/LibraryCardDAO.java
+++ b/src/main/java/org/broadinstitute/consent/http/db/LibraryCardDAO.java
@@ -89,7 +89,7 @@ WITH daa_deletes AS (DELETE FROM lc_daa lc_daa WHERE lc_daa.lc_id = :libraryCard
       LEFT JOIN lc_daa ld ON lc.id = ld.lc_id
       WHERE lc.user_id = :userId
       """)
-  List<LibraryCard> findLibraryCardsByUserId(@Bind("userId") Integer userId);
+  LibraryCard findLibraryCardByUserId(@Bind("userId") Integer userId);
 
   @RegisterBeanMapper(value = LibraryCard.class)
   @UseRowReducer(LibraryCardReducer.class)
@@ -115,7 +115,7 @@ WITH daa_deletes AS (DELETE FROM lc_daa lc_daa WHERE lc_daa.lc_id = :libraryCard
   @UseRowReducer(LibraryCardReducer.class)
   @SqlQuery("SELECT * FROM library_card " +
       "WHERE user_email = :email")
-  List<LibraryCard> findAllLibraryCardsByUserEmail(@Bind("email") String email);
+  LibraryCard findLibraryCardByUserEmail(@Bind("email") String email);
 
   @SqlUpdate("DELETE FROM library_card WHERE user_id = :userId OR create_user_id = :userId OR update_user_id = :userId")
   void deleteAllLibraryCardsByUser(@Bind("userId") Integer userId);
diff --git a/src/main/java/org/broadinstitute/consent/http/db/UserDAO.java b/src/main/java/org/broadinstitute/consent/http/db/UserDAO.java
index fa77c0083c..a20d86f52a 100644
--- a/src/main/java/org/broadinstitute/consent/http/db/UserDAO.java
+++ b/src/main/java/org/broadinstitute/consent/http/db/UserDAO.java
@@ -27,16 +27,38 @@ public interface UserDAO extends Transactional<UserDAO> {
   @RegisterBeanMapper(value = User.class, prefix = "u")
   @RegisterBeanMapper(value = UserRole.class)
   @RegisterBeanMapper(value = Institution.class, prefix = "i")
+  @RegisterBeanMapper(value = LibraryCard.class, prefix = "lc")
   @UseRowReducer(UserWithRolesReducer.class)
-  @SqlQuery("SELECT "
-      + User.QUERY_FIELDS_WITH_U_PREFIX + QUERY_FIELD_SEPARATOR
-      + Institution.QUERY_FIELDS_WITH_I_PREFIX + QUERY_FIELD_SEPARATOR
-      + "     ur.user_role_id, ur.user_id, ur.role_id, ur.dac_id, r.name  "
-      + " FROM users u "
-      + " LEFT JOIN user_role ur ON ur.user_id = u.user_id "
-      + " LEFT JOIN roles r ON r.role_id = ur.role_id "
-      + " LEFT JOIN institution i ON u.institution_id = i.institution_id"
-      + " WHERE u.user_id = :userId")
+  @SqlQuery("""
+            SELECT
+          u.user_id as u_user_id,
+          u.email as u_email,
+          u.display_name as u_display_name,
+          u.create_date as u_create_date,
+          u.email_preference as u_email_preference,
+          u.institution_id as u_institution_id,
+          u.era_commons_id as u_era_commons_id,
+          i.institution_id as i_id,
+          i.institution_name as i_name,
+          i.it_director_name as i_it_director_name,
+          i.it_director_email as i_it_director_email,
+          i.create_date as i_create_date,
+          i.update_date as i_update_date,
+          ur.user_role_id as ur_user_role_id, ur.user_id as ur_user_id,
+          ur.role_id as ur_role_id, ur.dac_id as ur_dac_id, r.name as ur_name,
+          lc.id AS lc_id, lc.user_id AS lc_user_id,
+          lc.user_name AS lc_user_name, lc.user_email AS lc_user_email,
+          lc.create_user_id AS lc_create_user_id, lc.create_date AS lc_create_date,
+          lc.update_user_id AS lc_update_user_id,
+          ld.daa_id as lc_daa_id
+      FROM users u
+      LEFT JOIN user_role ur ON ur.user_id = u.user_id
+      LEFT JOIN roles r ON r.role_id = ur.role_id
+      LEFT JOIN institution i ON u.institution_id = i.institution_id
+      LEFT JOIN library_card lc ON lc.user_id = u.user_id
+      LEFT JOIN lc_daa ld ON lc.id = ld.lc_id
+      WHERE u.user_id = :userId
+      """)
   User findUserById(@Bind("userId") Integer userId);
 
   @RegisterBeanMapper(value = User.class, prefix = "u")
@@ -92,17 +114,38 @@ public interface UserDAO extends Transactional<UserDAO> {
   @RegisterBeanMapper(value = User.class, prefix = "u")
   @RegisterBeanMapper(value = UserRole.class, prefix = "ur")
   @RegisterBeanMapper(value = Institution.class, prefix = "i")
+  @RegisterBeanMapper(value = LibraryCard.class, prefix = "lc")
   @UseRowReducer(UserWithRolesReducer.class)
-  @SqlQuery("SELECT "
-      + User.QUERY_FIELDS_WITH_U_PREFIX + QUERY_FIELD_SEPARATOR
-      + Institution.QUERY_FIELDS_WITH_I_PREFIX + QUERY_FIELD_SEPARATOR
-      + "     ur.user_role_id as ur_user_role_id, ur.user_id as ur_user_id, "
-      + "     ur.role_id as ur_role_id, ur.dac_id as ur_dac_id, r.name as ur_name "
-      + " FROM users u "
-      + " LEFT JOIN user_role ur ON ur.user_id = u.user_id "
-      + " LEFT JOIN roles r ON r.role_id = ur.role_id "
-      + " LEFT JOIN institution i ON u.institution_id = i.institution_id"
-      + " WHERE LOWER(u.email) = LOWER(:email)")
+  @SqlQuery("""
+      SELECT
+          u.user_id as u_user_id,
+          u.email as u_email,
+          u.display_name as u_display_name,
+          u.create_date as u_create_date,
+          u.email_preference as u_email_preference,
+          u.institution_id as u_institution_id,
+          u.era_commons_id as u_era_commons_id,
+          i.institution_id as i_id,
+          i.institution_name as i_name,
+          i.it_director_name as i_it_director_name,
+          i.it_director_email as i_it_director_email,
+          i.create_date as i_create_date,
+          i.update_date as i_update_date,
+          ur.user_role_id as ur_user_role_id, ur.user_id as ur_user_id,
+          ur.role_id as ur_role_id, ur.dac_id as ur_dac_id, r.name as ur_name,
+          lc.id AS lc_id, lc.user_id AS lc_user_id,
+          lc.user_name AS lc_user_name, lc.user_email AS lc_user_email,
+          lc.create_user_id AS lc_create_user_id, lc.create_date AS lc_create_date,
+          lc.update_user_id AS lc_update_user_id,
+          ld.daa_id as lc_daa_id
+      FROM users u
+      LEFT JOIN user_role ur ON ur.user_id = u.user_id
+      LEFT JOIN roles r ON r.role_id = ur.role_id
+      LEFT JOIN institution i ON u.institution_id = i.institution_id
+      LEFT JOIN library_card lc ON lc.user_id = u.user_id
+      LEFT JOIN lc_daa ld ON lc.id = ld.lc_id
+      WHERE LOWER(u.email) = LOWER(:email)
+      """)
   User findUserByEmail(@Bind("email") String email);
 
   @RegisterBeanMapper(value = User.class, prefix = "u")
diff --git a/src/main/java/org/broadinstitute/consent/http/db/mapper/DarCollectionReducer.java b/src/main/java/org/broadinstitute/consent/http/db/mapper/DarCollectionReducer.java
index 05e513fd45..64bd0d34fa 100644
--- a/src/main/java/org/broadinstitute/consent/http/db/mapper/DarCollectionReducer.java
+++ b/src/main/java/org/broadinstitute/consent/http/db/mapper/DarCollectionReducer.java
@@ -94,7 +94,7 @@ public void accumulate(Map<Integer, DarCollection> map, RowView rowView) {
         user.setInstitution(institution);
       }
       if (Objects.nonNull(libraryCard)) {
-        user.addLibraryCard(libraryCard);
+        user.setLibraryCard(libraryCard);
       }
       if (Objects.nonNull(userProperty)) {
         user.addProperty(userProperty);
diff --git a/src/main/java/org/broadinstitute/consent/http/db/mapper/UserWithRolesReducer.java b/src/main/java/org/broadinstitute/consent/http/db/mapper/UserWithRolesReducer.java
index 2c1470b598..ae9b889cfd 100644
--- a/src/main/java/org/broadinstitute/consent/http/db/mapper/UserWithRolesReducer.java
+++ b/src/main/java/org/broadinstitute/consent/http/db/mapper/UserWithRolesReducer.java
@@ -2,7 +2,6 @@
 
 import java.util.Map;
 import java.util.Objects;
-import java.util.Optional;
 import org.broadinstitute.consent.http.models.Institution;
 import org.broadinstitute.consent.http.models.LibraryCard;
 import org.broadinstitute.consent.http.models.User;
@@ -33,19 +32,12 @@ public void accumulate(Map<Integer, User> map, RowView rowView) {
             id -> rowView.getRow(User.class));
 
     try {
-      // Some queries look for `user_role_id` while those that use a prefix look for `u_user_role_id`
-      Integer userRoleId = null;
-      if (hasNonZeroColumn(rowView, "user_role_id")) {
-        userRoleId = rowView.getColumn("user_role_id", Integer.class);
-      } else if (hasNonZeroColumn(rowView, "ur_user_role_id")) {
-        userRoleId = rowView.getColumn("ur_user_role_id", Integer.class);
-      }
-      if (Objects.nonNull(userRoleId)) {
-        UserRole ur = rowView.getRow(UserRole.class);
-        user.addRole(ur);
+      UserRole userRole = mapUserRoleFromRowView(rowView, userId);
+      if (userRole != null) {
+        user.addRole(userRole);
       }
     } catch (MappingException e) {
-      // Ignore any attempt to map a column that doesn't exist
+      logWarn("Error adding User Role to User", e);
     }
     try {
       if (Objects.nonNull(rowView.getColumn("i_id", Integer.class))) {
@@ -56,26 +48,21 @@ public void accumulate(Map<Integer, User> map, RowView rowView) {
         }
       }
     } catch (MappingException e) {
-      //Ignore institution mapping errors, possible for new users to not have an institution
+      logWarn("Error adding Institution to User", e);
     }
     //user role join can cause duplication of data if done in tandem with joins on other tables
     //ex) The same LC can end up being repeated multiple times
     //Below only adds LC if not currently saved on the array
     try {
       if (rowView.getColumn("lc_id", Integer.class) != null) {
-        int lcId = rowView.getColumn("lc_id", Integer.class);
-        LibraryCard lc;
-        Optional<LibraryCard> existingLibraryCard = user.getLibraryCards().stream()
-                .filter(card -> card.getId().equals(lcId))
-                .findFirst();
-        lc = existingLibraryCard.orElseGet(() -> rowView.getRow(LibraryCard.class));
+        LibraryCard lc = rowView.getRow(LibraryCard.class);
         if (rowView.getColumn("lc_daa_id", Integer.class) != null) {
           lc.addDaa(rowView.getColumn("lc_daa_id", Integer.class));
         }
-        user.addLibraryCard(lc);
+        user.setLibraryCard(lc);
       }
     } catch (MappingException e) {
-      //Ignore exceptions here, user may not have a library card issued under this instiution
+      logWarn("Error adding Library Card to User", e);
     }
     try {
       if (Objects.nonNull(rowView.getColumn("up_property_id", Integer.class))) {
@@ -83,7 +70,33 @@ public void accumulate(Map<Integer, User> map, RowView rowView) {
         user.addProperty(p);
       }
     } catch (MappingException e) {
-      // Ignore any attempt to map a column that doesn't exist
+      logWarn("Error adding User Property to User", e);
+    }
+  }
+
+  private UserRole mapUserRoleFromRowView(RowView rowView, Integer userId) {
+    Integer userRoleId;
+    Integer roleId;
+    String name;
+    Integer dacId = null;
+    // Some queries look for `user_role_id` while those that use a prefix look for `ur_user_role_id`
+    if (hasNonZeroColumn(rowView, "user_role_id")) {
+      userRoleId = rowView.getColumn("user_role_id", Integer.class);
+      roleId = rowView.getColumn("role_id", Integer.class);
+      name = rowView.getColumn("name", String.class);
+      if (hasNonZeroColumn(rowView, "dac_id")) {
+        dacId = rowView.getColumn("dac_id", Integer.class);
+      }
+      return new UserRole(userRoleId, userId, roleId, name, dacId);
+    } else if (hasNonZeroColumn(rowView, "ur_user_role_id")) {
+      userRoleId = rowView.getColumn("ur_user_role_id", Integer.class);
+      roleId = rowView.getColumn("ur_role_id", Integer.class);
+      name = rowView.getColumn("ur_name", String.class);
+      if (hasNonZeroColumn(rowView, "ur_dac_id")) {
+        dacId = rowView.getColumn("ur_dac_id", Integer.class);
+      }
+      return new UserRole(userRoleId, userId, roleId, name, dacId);
     }
+    return null;
   }
 }
diff --git a/src/main/java/org/broadinstitute/consent/http/models/LibraryCard.java b/src/main/java/org/broadinstitute/consent/http/models/LibraryCard.java
index 8e05d1bb4c..e46eeea680 100644
--- a/src/main/java/org/broadinstitute/consent/http/models/LibraryCard.java
+++ b/src/main/java/org/broadinstitute/consent/http/models/LibraryCard.java
@@ -3,6 +3,7 @@
 import java.util.ArrayList;
 import java.util.Date;
 import java.util.List;
+import java.util.Objects;
 import org.apache.commons.lang3.builder.EqualsBuilder;
 
 public class LibraryCard {
@@ -116,6 +117,12 @@ public boolean equals(Object libraryCard) {
     return new EqualsBuilder().append(id, other.getId()).isEquals();
   }
 
+  @Override
+  public int hashCode() {
+    return Objects.hash(id, userId, userName, userEmail, createDate, createUserId, updateDate,
+        updateUserId, daaIds);
+  }
+
   public void addDaa(Integer daaId) {
     if (this.daaIds == null) {
       this.daaIds = new ArrayList<>();
diff --git a/src/main/java/org/broadinstitute/consent/http/models/User.java b/src/main/java/org/broadinstitute/consent/http/models/User.java
index 48e7d24812..1b3cfadfe1 100644
--- a/src/main/java/org/broadinstitute/consent/http/models/User.java
+++ b/src/main/java/org/broadinstitute/consent/http/models/User.java
@@ -57,7 +57,7 @@ public class User {
 
   private Institution institution;
 
-  private List<LibraryCard> libraryCards;
+  private LibraryCard libraryCard;
 
   public User() {
   }
@@ -101,7 +101,7 @@ public User(String json) {
     // Nor do we need to retrieve the full institution object from user-provided data.
     JsonObject filteredUserJsonObject = filterFields(
         userJsonObject,
-        Arrays.asList("createDate", "institution", "libraryCards"));
+        Arrays.asList("createDate", "institution", "libraryCard"));
     User u = gson.fromJson(filteredUserJsonObject.toString(), User.class);
     setUserId(u);
     setEmail(u);
@@ -278,15 +278,12 @@ public Institution getInstitution() {
     return institution;
   }
 
-  public void setLibraryCards(List<LibraryCard> cards) {
-    this.libraryCards = cards;
+  public LibraryCard getLibraryCard() {
+    return libraryCard;
   }
 
-  public List<LibraryCard> getLibraryCards() {
-    if (this.libraryCards == null) {
-      this.libraryCards = new ArrayList<>();
-    }
-    return this.libraryCards;
+  public void setLibraryCard(LibraryCard libraryCard) {
+    this.libraryCard = libraryCard;
   }
 
   public void addRole(UserRole userRole) {
@@ -308,15 +305,6 @@ public void addProperty(UserProperty userProp) {
     }
   }
 
-  public void addLibraryCard(LibraryCard card) {
-    if (this.libraryCards == null) {
-      this.libraryCards = new ArrayList<>();
-    }
-    if (!this.libraryCards.contains(card)) {
-      this.libraryCards.add(card);
-    }
-  }
-
   @Override
   public int hashCode() {
     return this.getUserId();
diff --git a/src/main/java/org/broadinstitute/consent/http/resources/DaaResource.java b/src/main/java/org/broadinstitute/consent/http/resources/DaaResource.java
index 9f9b641de4..1c0897886c 100644
--- a/src/main/java/org/broadinstitute/consent/http/resources/DaaResource.java
+++ b/src/main/java/org/broadinstitute/consent/http/resources/DaaResource.java
@@ -114,19 +114,14 @@ public Response createLibraryCardDaaRelation(
       } else if (authedUser.hasUserRole(UserRoles.SIGNINGOFFICIAL) && authedUserInstitutionId != userInstitutionId) {
           return Response.status(Status.FORBIDDEN).build();
       }
-      List<LibraryCard> libraryCards = libraryCardService.findLibraryCardsByUserId(userId);
-      LibraryCard workingLibraryCard;
-      if (libraryCards.isEmpty()) {
-        workingLibraryCard = libraryCardService.createLibraryCardForSigningOfficial(user, authedUser);
-      } else {
-        workingLibraryCard = libraryCards.get(0);
-      }
-      int libraryCardId = workingLibraryCard.getId();
-      libraryCardService.addDaaToLibraryCard(libraryCardId, daaId);
+      LibraryCard libraryCard = user.getLibraryCard() == null ?
+          libraryCardService.createLibraryCardForSigningOfficial(user, authedUser) :
+          user.getLibraryCard();
+      libraryCardService.addDaaToLibraryCard(libraryCard.getId(), daaId);
       URI uri = info.getBaseUriBuilder()
           .replacePath("api/libraryCards/{libraryCardId}")
-          .build(libraryCardId);
-      return Response.ok().location(uri).entity(workingLibraryCard).build();
+          .build(libraryCard.getId());
+      return Response.ok().location(uri).entity(libraryCard).build();
     } catch (Exception e) {
       return createExceptionResponse(e);
     }
@@ -186,10 +181,9 @@ public Response deleteDaaForUser(
       @PathParam("daaId") Integer daaId,
       @PathParam("userId") Integer userId) {
     try {
-      User user = userService.findUserByEmail(authUser.getEmail());
-      List<LibraryCard> libraryCards = libraryCardService.findLibraryCardsByUserId(userId);
-      for (LibraryCard libraryCard : libraryCards) {
-        libraryCardService.removeDaaFromLibraryCard(libraryCard.getId(), daaId);
+      User user = userService.findUserById(userId);
+      if (user.getLibraryCard() != null) {
+        libraryCardService.removeDaaFromLibraryCard(user.getLibraryCard().getId(), daaId);
       }
       return Response.ok().build();
     } catch (Exception e) {
@@ -225,8 +219,10 @@ public Response sendDaaRequestMessage(
       if (user.getInstitutionId() == null) {
         throw new BadRequestException("This user has not set their institution: " + user.getDisplayName());
       }
-      if (user.getLibraryCards().stream()
-          .anyMatch(libraryCard -> libraryCard.getDaaIds().contains(daaId))) {
+      if (user.getLibraryCard() == null) {
+        throw new BadRequestException("This user does not have a library card: " + user.getDisplayName());
+      }
+      if (user.getLibraryCard().getDaaIds().contains(daaId)) {
         throw new IllegalArgumentException("User already has this DAA associated with their Library Card");
       }
       daaService.sendDaaRequestEmails(user, daaId);
@@ -284,7 +280,7 @@ public Response bulkRemoveUsersFromDaa(
       }
       daaService.findById(daaId);
       for (User user : users) {
-        libraryCardService.removeDaaFromUserLibraryCards(user, daaId);
+        libraryCardService.removeDaaFromUserLibraryCard(user, daaId);
       }
       return Response.ok().build();
     } catch (Exception e) {
@@ -332,7 +328,7 @@ public Response bulkRemoveDAAsFromUser(
       }
       List<DataAccessAgreement> daaList = daaService.findDAAsInJsonArray(json, "daaList");
       for (DataAccessAgreement daa : daaList) {
-        libraryCardService.removeDaaFromUserLibraryCards(user, daa.getDaaId());
+        libraryCardService.removeDaaFromUserLibraryCard(user, daa.getDaaId());
       }
       return Response.ok().build();
     } catch (Exception e) {
diff --git a/src/main/java/org/broadinstitute/consent/http/resources/DataAccessRequestResource.java b/src/main/java/org/broadinstitute/consent/http/resources/DataAccessRequestResource.java
index 1385d3b815..b2a7c7ef38 100644
--- a/src/main/java/org/broadinstitute/consent/http/resources/DataAccessRequestResource.java
+++ b/src/main/java/org/broadinstitute/consent/http/resources/DataAccessRequestResource.java
@@ -643,7 +643,7 @@ private void checkAuthorizedUpdateUser(User user, DataAccessRequest dar) {
     if (!user.getUserId().equals(dar.getUserId())) {
       throw new ForbiddenException("User not authorized to update this Data Access Request");
     }
-    if (user.getLibraryCards().isEmpty()) {
+    if (user.getLibraryCard() == null) {
       throw new LibraryCardRequiredException();
     }
   }
diff --git a/src/main/java/org/broadinstitute/consent/http/service/DataAccessRequestService.java b/src/main/java/org/broadinstitute/consent/http/service/DataAccessRequestService.java
index 6ef29b5b8e..2c06354011 100644
--- a/src/main/java/org/broadinstitute/consent/http/service/DataAccessRequestService.java
+++ b/src/main/java/org/broadinstitute/consent/http/service/DataAccessRequestService.java
@@ -135,7 +135,7 @@ public DataAccessRequest insertDraftDataAccessRequest(User user, DataAccessReque
       throw new IllegalArgumentException("User and DataAccessRequest are required");
     }
 
-    if (user.getLibraryCards().isEmpty()) {
+    if (user.getLibraryCard() == null) {
       throw new LibraryCardRequiredException();
     }
 
@@ -297,7 +297,7 @@ public void validateDar(User user, DataAccessRequest dar) {
       throw new IllegalArgumentException("User and DataAccessRequest are required");
     }
 
-    if (user.getLibraryCards().isEmpty()) {
+    if (user.getLibraryCard() == null) {
       throw new NIHComplianceRuleException();
     }
 
@@ -317,8 +317,7 @@ public void validateInternalCollaborators(DataAccessRequest payload) {
         throw new NotFoundException(
             "Unable to find User with the provided email: " + collaborator.getEmail());
       }
-      List<LibraryCard> libraryCards = collabUser.getLibraryCards();
-      if (libraryCards.isEmpty()) {
+      if (collabUser.getLibraryCard() == null) {
         throw new BadRequestException(
             "Collaborator " + collaborator.getEmail() + " does not have a library card.");
       }
diff --git a/src/main/java/org/broadinstitute/consent/http/service/LibraryCardService.java b/src/main/java/org/broadinstitute/consent/http/service/LibraryCardService.java
index 38504dbbb0..ee09084984 100644
--- a/src/main/java/org/broadinstitute/consent/http/service/LibraryCardService.java
+++ b/src/main/java/org/broadinstitute/consent/http/service/LibraryCardService.java
@@ -3,11 +3,9 @@
 import com.google.inject.Inject;
 import jakarta.ws.rs.BadRequestException;
 import jakarta.ws.rs.NotFoundException;
-import java.util.ArrayList;
 import java.util.Date;
 import java.util.List;
 import java.util.Objects;
-import java.util.Optional;
 import org.broadinstitute.consent.http.db.InstitutionDAO;
 import org.broadinstitute.consent.http.db.LibraryCardDAO;
 import org.broadinstitute.consent.http.db.UserDAO;
@@ -80,8 +78,8 @@ public List<LibraryCard> findAllLibraryCards() {
     return libraryCardDAO.findAllLibraryCards();
   }
 
-  public List<LibraryCard> findLibraryCardsByUserId(Integer userId) {
-    return libraryCardDAO.findLibraryCardsByUserId(userId);
+  public LibraryCard findLibraryCardByUserId(Integer userId) {
+    return libraryCardDAO.findLibraryCardByUserId(userId);
   }
 
   public List<LibraryCard> findLibraryCardsByInstitutionId(Integer institutionId) {
@@ -108,29 +106,26 @@ public void removeDaaFromLibraryCard(Integer libraryCardId, Integer daaId) {
     libraryCardDAO.deleteLibraryCardDaaRelation(libraryCardId, daaId);
   }
 
-  public List<LibraryCard> addDaaToUserLibraryCardByInstitution(User user, User signingOfficial, Integer daaId) {
+  public LibraryCard addDaaToUserLibraryCardByInstitution(User user, User signingOfficial, Integer daaId) {
     if (signingOfficial.getInstitutionId() == null) {
       throw new BadRequestException("This signing official does not have an institution.");
     }
-    List<LibraryCard> libraryCards = new ArrayList<>(libraryCardDAO.findLibraryCardsByUserId(user.getUserId()));
-    if (libraryCards.isEmpty()) {
-      LibraryCard lc = createLibraryCardForSigningOfficial(user, signingOfficial);
-      libraryCards.add(lc);
+    LibraryCard libraryCard = libraryCardDAO.findLibraryCardByUserId(user.getUserId());
+    if (libraryCard == null) {
+      libraryCard = createLibraryCardForSigningOfficial(user, signingOfficial);
     }
     // typically there should be one library card per user per institution
-    for (LibraryCard libraryCard : libraryCards) {
-      addDaaToLibraryCard(libraryCard.getId(), daaId);
-    }
-    return libraryCardDAO.findLibraryCardsByUserId(user.getUserId());
+    addDaaToLibraryCard(libraryCard.getId(), daaId);
+    return libraryCardDAO.findLibraryCardByUserId(user.getUserId());
   }
 
-  public List<LibraryCard> removeDaaFromUserLibraryCards(User user, Integer daaId) {
-    List<LibraryCard> libraryCards = findLibraryCardsByUserId(user.getUserId());
+  public LibraryCard removeDaaFromUserLibraryCard(User user, Integer daaId) {
+    LibraryCard libraryCard = findLibraryCardByUserId(user.getUserId());
     // typically there should be one library card per user
-    for (LibraryCard libraryCard : libraryCards) {
+    if (libraryCard != null) {
       removeDaaFromLibraryCard(libraryCard.getId(), daaId);
     }
-    return libraryCards;
+    return findLibraryCardByUserId(user.getUserId());
   }
 
   public LibraryCard createLibraryCardForSigningOfficial(User user, User signingOfficial) {
@@ -189,26 +184,22 @@ private void throwIfNull(LibraryCard libraryCard) {
 
   //helper method for create method, checks to see if card already exists
   private void checkIfCardExists(LibraryCard payload) {
-    Integer userId = payload.getUserId();
-    String email = payload.getUserEmail();
-    Optional<LibraryCard> foundCard;
-    List<LibraryCard> results;
-
-    if (Objects.nonNull(payload.getUserId())) {
-      results = libraryCardDAO.findLibraryCardsByUserId(userId);
-    } else if (Objects.nonNull(email)) {
-      results = libraryCardDAO.findAllLibraryCardsByUserEmail(email);
+    LibraryCard result = null;
+
+    if (payload.getUserId() != null) {
+      result = libraryCardDAO.findLibraryCardByUserId(payload.getUserId());
+    } else if (payload.getUserEmail() != null) {
+      result = libraryCardDAO.findLibraryCardByUserEmail(payload.getUserEmail());
     } else {
       throw new BadRequestException();
     }
-    foundCard = results.stream().filter(card -> {
-      Boolean sameUserId = Objects.nonNull(userId) && card.getUserId().equals(userId);
-      Boolean sameUserEmail = Objects.nonNull(email) && card.getUserEmail().equalsIgnoreCase(email);
-      return (sameUserId || sameUserEmail);
-    }).findFirst();
-
-    if (foundCard.isPresent()) {
-      throw new ConsentConflictException();
+
+    if (result != null) {
+      Boolean sameUserId = payload.getUserId() != null && result.getUserId().equals(payload.getUserId());
+      Boolean sameUserEmail = payload.getUserEmail() != null && result.getUserEmail().equalsIgnoreCase(payload.getUserEmail());
+      if (sameUserId || sameUserEmail) {
+        throw new ConsentConflictException("Library card already exists for this user.");
+      }
     }
   }
 
diff --git a/src/main/java/org/broadinstitute/consent/http/service/UserService.java b/src/main/java/org/broadinstitute/consent/http/service/UserService.java
index a1f6b204ae..e2d598ff49 100644
--- a/src/main/java/org/broadinstitute/consent/http/service/UserService.java
+++ b/src/main/java/org/broadinstitute/consent/http/service/UserService.java
@@ -50,7 +50,7 @@
 
 public class UserService implements ConsentLogger {
 
-  public static final String LIBRARY_CARDS_FIELD = "libraryCards";
+  public static final String LIBRARY_CARDS_FIELD = "libraryCard";
   public static final String USER_PROPERTIES_FIELD = "properties";
   public static final String USER_STATUS_INFO_FIELD = "userStatusInfo";
 
@@ -180,7 +180,7 @@ public User createUser(User user) {
     Integer userId = userDAO.insertUser(user.getEmail(), user.getDisplayName(),
         user.getInstitutionId(), new Date());
     insertUserRoles(user.getRoles(), userId);
-    addExistingLibraryCards(user);
+    addFloatingLibraryCardToUser(user);
     return userDAO.findUserById(userId);
   }
 
@@ -189,10 +189,6 @@ public User findUserById(Integer id) throws NotFoundException {
     if (user == null) {
       throw new NotFoundException("Unable to find user with id: " + id);
     }
-    List<LibraryCard> cards = libraryCardDAO.findLibraryCardsByUserId(user.getUserId());
-    if (Objects.nonNull(cards) && !cards.isEmpty()) {
-      user.setLibraryCards(cards);
-    }
     return user;
   }
 
@@ -201,10 +197,6 @@ public User findUserByEmail(String email) throws NotFoundException {
     if (user == null) {
       throw new NotFoundException("Unable to find user with email: " + email);
     }
-    List<LibraryCard> cards = libraryCardDAO.findLibraryCardsByUserId(user.getUserId());
-    if (Objects.nonNull(cards) && !cards.isEmpty()) {
-      user.setLibraryCards(cards);
-    }
     return user;
   }
 
@@ -334,13 +326,10 @@ public JsonObject findUserWithPropertiesByIdAsJsonObject(AuthUser authUser, Inte
     Gson gson = GsonUtil.getInstance();
     User user = findUserById(userId);
     List<UserProperty> props = findAllUserProperties(user.getUserId());
-    List<LibraryCard> entries =
-        Objects.nonNull(user.getLibraryCards()) ? user.getLibraryCards() : List.of();
     JsonObject userJson = gson.toJsonTree(user).getAsJsonObject();
     JsonArray propsJson = gson.toJsonTree(props).getAsJsonArray();
-    JsonArray entriesJson = gson.toJsonTree(entries).getAsJsonArray();
     userJson.add(USER_PROPERTIES_FIELD, propsJson);
-    userJson.add(LIBRARY_CARDS_FIELD, entriesJson);
+    userJson.add(LIBRARY_CARDS_FIELD, gson.toJsonTree(user.getLibraryCard()));
     if (authUser.getEmail().equalsIgnoreCase(user.getEmail()) && Objects.nonNull(
         authUser.getUserStatusInfo())) {
       JsonObject userStatusInfoJson = gson.toJsonTree(authUser.getUserStatusInfo())
@@ -377,19 +366,15 @@ public void insertUserRoles(List<UserRole> roles, Integer userId) {
     userRoleDAO.insertUserRoles(roles, userId);
   }
 
-  private void addExistingLibraryCards(User user) {
-    List<LibraryCard> libraryCards = libraryCardDAO.findAllLibraryCardsByUserEmail(user.getEmail());
-
-    libraryCards
-        .forEach(lc -> {
-          libraryCardDAO.updateLibraryCardById(
-              lc.getId(),
-              user.getUserId(),
-              lc.getUserName(),
-              lc.getUserEmail(),
-              user.getUserId(),
-              new Date());
-        });
+  private void addFloatingLibraryCardToUser(User user) {
+    LibraryCard libraryCard = libraryCardDAO.findLibraryCardByUserEmail(user.getEmail());
+    libraryCardDAO.updateLibraryCardById(
+        libraryCard.getId(),
+        user.getUserId(),
+        user.getDisplayName(),
+        user.getEmail(),
+        user.getUserId(),
+        new Date());
   }
 
   public User findOrCreateUser(AuthUser authUser) throws Exception {
@@ -424,15 +409,14 @@ public List<User> findUsersInJsonArray(String json, String arrayKey) {
   }
 
   public void hasValidActiveERACredentials(User user) {
-    List<LibraryCard> cards = user.getLibraryCards();
-    List<UserProperty> userProperties = findAllUserProperties(user.getUserId());
-    if (cards.isEmpty()) {
+    if (user.getLibraryCard() == null) {
       throw new LibraryCardRequiredException();
     }
     boolean hasEraCommonsId = user.getEraCommonsId() != null;
     if (!hasEraCommonsId) {
       throw new BadRequestException("User does not have an Era Commons ID");
     }
+    List<UserProperty> userProperties = findAllUserProperties(user.getUserId());
     List<UserProperty> eraStatusProps = userProperties.stream().filter(
             userProperty -> userProperty.getPropertyKey().equalsIgnoreCase(ERA_STATUS.getValue()))
         .toList();
diff --git a/src/test/java/org/broadinstitute/consent/http/db/DarCollectionDAOTest.java b/src/test/java/org/broadinstitute/consent/http/db/DarCollectionDAOTest.java
index d3a0bc3709..5eeef070e9 100644
--- a/src/test/java/org/broadinstitute/consent/http/db/DarCollectionDAOTest.java
+++ b/src/test/java/org/broadinstitute/consent/http/db/DarCollectionDAOTest.java
@@ -144,7 +144,7 @@ void testFindDARCollectionByCollectionId() {
     userProperties.forEach(p -> assertEquals(collection.getCreateUserId(),
         p.getUserId()));
 
-    assertTrue(returned.getCreateUser().getLibraryCards().isEmpty());
+    assertNull(returned.getCreateUser().getLibraryCard());
   }
 
   @Test
@@ -163,20 +163,20 @@ void testFindDARCollectionByCollectionIdMultipleUserProperties() {
   @Test
   void testFindDARCollectionByCollectionIdLibraryCard() {
     User user = createUser();
-    LibraryCard libraryCard = createLibraryCard(user);
+    createLibraryCard(user);
+    User updatedUser = userDAO.findUserById(user.getUserId());
     String darCode = "DAR-" + randomInt(100, 1000);
-    Integer collectionId = darCollectionDAO.insertDarCollection(darCode, user.getUserId(),
+    Integer collectionId = darCollectionDAO.insertDarCollection(darCode, updatedUser.getUserId(),
         new Date());
-    createDataAccessRequest(user.getUserId(), collectionId);
+    createDataAccessRequest(updatedUser.getUserId(), collectionId);
 
     DarCollection collection = darCollectionDAO.findDARCollectionByCollectionId(collectionId);
     User returnedUser = collection.getCreateUser();
-    assertEquals(user, returnedUser);
+    assertEquals(updatedUser, returnedUser);
 
-    List<LibraryCard> returnedLibraryCards = returnedUser.getLibraryCards();
-    assertEquals(1, returnedLibraryCards.size());
-    assertEquals(libraryCard, returnedLibraryCards.get(0));
-    assertEquals(user.getUserId(), returnedLibraryCards.get(0).getUserId());
+    LibraryCard returnedLibraryCard = returnedUser.getLibraryCard();
+    assertNotNull(returnedLibraryCard);
+    assertEquals(updatedUser.getLibraryCard(), returnedLibraryCard);
   }
 
   @Test
diff --git a/src/test/java/org/broadinstitute/consent/http/db/LibraryCardDAOTest.java b/src/test/java/org/broadinstitute/consent/http/db/LibraryCardDAOTest.java
index a68be1d91a..847a7a9d06 100644
--- a/src/test/java/org/broadinstitute/consent/http/db/LibraryCardDAOTest.java
+++ b/src/test/java/org/broadinstitute/consent/http/db/LibraryCardDAOTest.java
@@ -3,15 +3,12 @@
 import static org.junit.jupiter.api.Assertions.assertEquals;
 import static org.junit.jupiter.api.Assertions.assertNotNull;
 import static org.junit.jupiter.api.Assertions.assertNull;
+import static org.junit.jupiter.api.Assertions.assertSame;
 import static org.junit.jupiter.api.Assertions.assertTrue;
-import static org.junit.jupiter.api.Assertions.assertFalse;
-
 
 import java.time.Instant;
 import java.util.Date;
 import java.util.List;
-import org.apache.commons.lang3.RandomStringUtils;
-import org.apache.commons.lang3.RandomUtils;
 import org.broadinstitute.consent.http.models.DataAccessAgreement;
 import org.broadinstitute.consent.http.models.Institution;
 import org.broadinstitute.consent.http.models.LibraryCard;
@@ -97,7 +94,7 @@ void testDeleteLibraryCardById() {
   @Test
   void testDeleteLibraryCardByIdNegative() {
     try {
-      libraryCardDAO.deleteLibraryCardById(RandomUtils.nextInt(1, 1000));
+      libraryCardDAO.deleteLibraryCardById(randomInt(1, 1000));
     } catch (Exception e) {
       assertEquals(PSQLState.UNIQUE_VIOLATION.getState(),
           ((PSQLException) e.getCause()).getSQLState());
@@ -112,7 +109,7 @@ void testDeleteLibraryCardWithDaaRelationships() {
     // 3. DAA so we can link it to a user's Library Card
     // 4. Library Card <-> DAA relationship that represents a Signing Official's acceptance of a DAA for the user
     LibraryCard card = createLibraryCard();
-    int dacId = dacDAO.createDac(RandomStringUtils.randomAlphabetic(10), RandomStringUtils.randomAlphabetic(10), new Date());
+    int dacId = dacDAO.createDac(randomAlphabetic(10), randomAlphabetic(10), new Date());
     int daaId = daaDAO.createDaa(card.getCreateUserId(), Instant.now(), card.getCreateUserId(), Instant.now(), dacId);
     daaDAO.createDacDaaRelation(dacId, daaId);
     libraryCardDAO.createLibraryCardDaaRelation(card.getId(), daaId);
@@ -135,7 +132,7 @@ void testFindLibraryCardById() {
 
   @Test
   void testFindLibraryCardByIdNegative() {
-    LibraryCard cardFromDAO = libraryCardDAO.findLibraryCardById(RandomUtils.nextInt(100, 200));
+    LibraryCard cardFromDAO = libraryCardDAO.findLibraryCardById(randomInt(100, 200));
     assertNull(cardFromDAO);
   }
 
@@ -198,7 +195,7 @@ void testFindLibraryCardDaaByIdNoDaas() {
 
   @Test
   void testFindLibraryCardDaaByIdNegative() {
-    LibraryCard cardFromDAO = libraryCardDAO.findLibraryCardDaaById(RandomUtils.nextInt(100, 200));
+    LibraryCard cardFromDAO = libraryCardDAO.findLibraryCardDaaById(randomInt(100, 200));
     assertNull(cardFromDAO);
   }
 
@@ -222,18 +219,15 @@ void testFindLibraryCardByInstitutionId() {
   @Test
   void testFindLibraryCardByUserIdInstitutionId() {
     LibraryCard libraryCard = createLibraryCard();
-    int dacId = dacDAO.createDac(RandomStringUtils.randomAlphabetic(5), RandomStringUtils.randomAlphabetic(5), RandomStringUtils.randomAlphabetic(5), new Date());
+    int dacId = dacDAO.createDac(randomAlphabetic(5), randomAlphabetic(5), randomAlphabetic(5), new Date());
     Instant now = Instant.now();
     int daaId = daaDAO.createDaa(libraryCard.getUserId(), now, libraryCard.getUserId(), now, dacId);
     daaDAO.createDacDaaRelation(dacId, daaId);
     libraryCardDAO.createLibraryCardDaaRelation(libraryCard.getId(), daaId);
-    List<LibraryCard> cardsFromDAO = libraryCardDAO.findLibraryCardsByUserId(
+    LibraryCard cardFromDAO = libraryCardDAO.findLibraryCardByUserId(
         libraryCard.getUserId());
-    assertNotNull(cardsFromDAO);
-    assertEquals(1, cardsFromDAO.size());
-    assertEquals(cardsFromDAO.get(0).getId(), libraryCard.getId());
-    assertEquals(cardsFromDAO.get(0).getUserId(), libraryCard.getUserId());
-    assertFalse(cardsFromDAO.get(0).getDaaIds().isEmpty());
+    assertNotNull(cardFromDAO);
+    assertEquals(cardFromDAO, libraryCard);
   }
 
   @Test
@@ -248,28 +242,21 @@ void testFindAllLibraryCards() {
   }
 
   @Test
-  void testFindAllLibraryCardsByUserEmail() {
+  void testFindLibraryCardsByUserEmail() {
     User user = createUser();
     LibraryCard libraryCard = createLibraryCard(user);
-    List<LibraryCard> libraryCards = libraryCardDAO.findAllLibraryCardsByUserEmail(user.getEmail());
-    assertNotNull(libraryCards);
-    assertEquals(1, libraryCards.size());
-    assertEquals(user.getEmail(), libraryCards.get(0).getUserEmail());
-    assertEquals(libraryCard.getId(), libraryCards.get(0).getId());
+    LibraryCard cardFromDAO = libraryCardDAO.findLibraryCardByUserEmail(user.getEmail());
+    assertNotNull(cardFromDAO);
+    assertEquals(cardFromDAO, libraryCard);
   }
 
   @Test
-  void testFindAllLibraryCardsByUserId() {
+  void testFindLibraryCardsByUserId() {
     User user = createUser();
     LibraryCard one = createLibraryCard(user);
-    LibraryCard two = createLibraryCard(user);
-    List<LibraryCard> libraryCards = libraryCardDAO.findLibraryCardsByUserId(user.getUserId());
-    assertNotNull(libraryCards);
-    assertEquals(2, libraryCards.size());
-    assertEquals(one.getId(), libraryCards.get(0).getId());
-    assertEquals(two.getId(), libraryCards.get(1).getId());
-    assertTrue(one.getDaaIds().isEmpty());
-    assertTrue(two.getDaaIds().isEmpty());
+    LibraryCard cardFromDAO = libraryCardDAO.findLibraryCardByUserId(user.getUserId());
+    assertNotNull(cardFromDAO);
+    assertEquals(cardFromDAO, one);
   }
 
   @Test
@@ -287,8 +274,8 @@ void testCreateLibraryCardDaaAssociation() {
     LibraryCard card = createLibraryCard(user);
     LibraryCard card2 = createLibraryCard(user2);
     Integer userId = user.getUserId();
-    Integer dacId = dacDAO.createDac(RandomStringUtils.randomAlphabetic(5), RandomStringUtils.randomAlphabetic(5), "",  new Date());
-    Integer dacId2 = dacDAO.createDac(RandomStringUtils.randomAlphabetic(5), RandomStringUtils.randomAlphabetic(5), "",  new Date());
+    Integer dacId = dacDAO.createDac(randomAlphabetic(5), randomAlphabetic(5), "",  new Date());
+    Integer dacId2 = dacDAO.createDac(randomAlphabetic(5), randomAlphabetic(5), "",  new Date());
     Integer daaId1 = daaDAO.createDaa(userId, new Date().toInstant(), userId, new Date().toInstant(), dacId);
     Integer daaId2 = daaDAO.createDaa(userId, new Date().toInstant(), userId, new Date().toInstant(), dacId2);
     libraryCardDAO.createLibraryCardDaaRelation(card.getId(), daaId1);
@@ -309,7 +296,7 @@ void testCreateLibraryCardDaaAssociationInvalid() {
     User user = createUser();
     LibraryCard card = createLibraryCard(user);
     Integer userId = user.getUserId();
-    Integer dacId = dacDAO.createDac(RandomStringUtils.randomAlphabetic(5), RandomStringUtils.randomAlphabetic(5), "",  new Date());
+    Integer dacId = dacDAO.createDac(randomAlphabetic(5), randomAlphabetic(5), "",  new Date());
     Integer daaId1 = daaDAO.createDaa(userId, new Date().toInstant(), userId, new Date().toInstant(), dacId);
 
     try {
@@ -338,8 +325,8 @@ void testDeleteLibraryCardDaaAssociation() {
     LibraryCard card = createLibraryCard(user);
     LibraryCard card2 = createLibraryCard(user2);
     Integer userId = user.getUserId();
-    Integer dacId = dacDAO.createDac(RandomStringUtils.randomAlphabetic(5), RandomStringUtils.randomAlphabetic(5), "",  new Date());
-    Integer dacId2 = dacDAO.createDac(RandomStringUtils.randomAlphabetic(5), RandomStringUtils.randomAlphabetic(5), "", new Date());
+    Integer dacId = dacDAO.createDac(randomAlphabetic(5), randomAlphabetic(5), "",  new Date());
+    Integer dacId2 = dacDAO.createDac(randomAlphabetic(5), randomAlphabetic(5), "", new Date());
     Integer daaId1 = daaDAO.createDaa(userId, new Date().toInstant(), userId, new Date().toInstant(), dacId);
     Integer daaId2 = daaDAO.createDaa(userId, new Date().toInstant(), userId, new Date().toInstant(), dacId2);
     libraryCardDAO.createLibraryCardDaaRelation(card.getId(), daaId1);
diff --git a/src/test/java/org/broadinstitute/consent/http/db/UserDAOTest.java b/src/test/java/org/broadinstitute/consent/http/db/UserDAOTest.java
index 35dc4631e3..85b76c1160 100644
--- a/src/test/java/org/broadinstitute/consent/http/db/UserDAOTest.java
+++ b/src/test/java/org/broadinstitute/consent/http/db/UserDAOTest.java
@@ -203,11 +203,9 @@ void testFindUsersWithLCsAndInstitution() {
         .toList();
     assertEquals(2, users.size());
     assertNotNull(users.get(0).getInstitution());
-    assertNotNull(users.get(0).getLibraryCards());
-    assertEquals(1, users.get(0).getLibraryCards().size());
+    assertNotNull(users.get(0).getLibraryCard());
     assertNotNull(users.get(1).getInstitution());
-    assertNotNull(users.get(1).getLibraryCards());
-    assertEquals(1, users.get(1).getLibraryCards().size());
+    assertNotNull(users.get(1).getLibraryCard());
   }
 
   @Test
@@ -342,7 +340,7 @@ void testGetUsersFromInstitutionWithCards() {
     User returnedUser = users.get(0);
     assertEquals(userId, returnedUser.getUserId());
 
-    LibraryCard returnedCard = returnedUser.getLibraryCards().get(0);
+    LibraryCard returnedCard = returnedUser.getLibraryCard();
     assertEquals(card.getId(), returnedCard.getId());
     assertEquals(userId, returnedCard.getUserId());
   }
@@ -365,7 +363,7 @@ void testGetUsersWithCardsByDaaId() {
     assertEquals(1, users2.size());
     User returnedUser = users.get(0);
 
-    LibraryCard returnedCard = returnedUser.getLibraryCards().get(0);
+    LibraryCard returnedCard = returnedUser.getLibraryCard();
     assertEquals(card.getId(), returnedCard.getId());
     assertEquals(returnedCard.getDaaIds(), List.of(daaId));
     assertEquals(userId, returnedCard.getUserId());
diff --git a/src/test/java/org/broadinstitute/consent/http/resources/DaaResourceTest.java b/src/test/java/org/broadinstitute/consent/http/resources/DaaResourceTest.java
index 56b3d3bc4d..d64d0e4a4c 100644
--- a/src/test/java/org/broadinstitute/consent/http/resources/DaaResourceTest.java
+++ b/src/test/java/org/broadinstitute/consent/http/resources/DaaResourceTest.java
@@ -21,8 +21,8 @@
 import java.util.List;
 import org.apache.commons.io.IOUtils;
 import org.apache.commons.lang3.RandomStringUtils;
-import org.apache.commons.lang3.RandomUtils;
 import org.apache.http.HttpStatus;
+import org.broadinstitute.consent.http.AbstractTestHelper;
 import org.broadinstitute.consent.http.enumeration.UserRoles;
 import org.broadinstitute.consent.http.models.AuthUser;
 import org.broadinstitute.consent.http.models.Dac;
@@ -42,7 +42,7 @@
 import org.mockito.junit.jupiter.MockitoExtension;
 
 @ExtendWith(MockitoExtension.class)
-class DaaResourceTest {
+class DaaResourceTest extends AbstractTestHelper {
 
   @Mock
   private DaaService daaService;
@@ -64,7 +64,7 @@ void testCreateDaaForDac_AdminCase() {
     when(info.getBaseUriBuilder()).thenReturn(builder);
     when(builder.replacePath(any())).thenReturn(builder);
     Dac dac = new Dac();
-    dac.setDacId(RandomUtils.nextInt(10, 100));
+    dac.setDacId(randomInt(10, 100));
     User admin = new User();
     admin.setAdminRole();
     FormDataContentDisposition fileDetail = mock(FormDataContentDisposition.class);
@@ -87,7 +87,7 @@ void testCreateDaaForDac_ChairCase() {
     when(info.getBaseUriBuilder()).thenReturn(builder);
     when(builder.replacePath(any())).thenReturn(builder);
     Dac dac = new Dac();
-    dac.setDacId(RandomUtils.nextInt(10, 100));
+    dac.setDacId(randomInt(10, 100));
     User admin = new User();
     admin.setChairpersonRoleWithDAC(dac.getDacId());
     FormDataContentDisposition fileDetail = mock(FormDataContentDisposition.class);
@@ -105,7 +105,7 @@ void testCreateDaaForDac_ChairCase() {
   void testCreateDaaForDac_InvalidChairCase() {
     UriInfo info = mock(UriInfo.class);
     Dac dac = new Dac();
-    dac.setDacId(RandomUtils.nextInt(10, 100));
+    dac.setDacId(randomInt(10, 100));
     User admin = new User();
     admin.setChairpersonRoleWithDAC(1);
     FormDataContentDisposition fileDetail = mock(FormDataContentDisposition.class);
@@ -123,7 +123,7 @@ void testCreateDaaForDac_InvalidFile() {
     UriInfo info = mock(UriInfo.class);
     UriBuilder builder = mock(UriBuilder.class);
     Dac dac = new Dac();
-    dac.setDacId(RandomUtils.nextInt(10, 100));
+    dac.setDacId(randomInt(10, 100));
     User admin = new User();
     admin.setAdminRole();
     FormDataContentDisposition fileDetail = mock(FormDataContentDisposition.class);
@@ -140,7 +140,7 @@ void testCreateDaaForDac_InvalidFile() {
   void testCreateDaaForDac_UserWithoutInstitution() {
     UriInfo info = mock(UriInfo.class);
     Dac dac = new Dac();
-    dac.setDacId(RandomUtils.nextInt(10, 100));
+    dac.setDacId(randomInt(10, 100));
     User admin = new User();
     admin.setAdminRole();
     FormDataContentDisposition fileDetail = mock(FormDataContentDisposition.class);
@@ -192,7 +192,7 @@ public void testFindAllMultipleDaas() {
 
  @Test
   void testFindDaaByDaaId() {
-    int expectedDaaId = RandomUtils.nextInt(10, 100);
+    int expectedDaaId = randomInt(10, 100);
     DataAccessAgreement expectedDaa = new DataAccessAgreement();
     expectedDaa.setDaaId(expectedDaaId);
     when(daaService.findById(expectedDaaId)).thenReturn(expectedDaa);
@@ -206,7 +206,7 @@ void testFindDaaByDaaId() {
 
   @Test
   void testFindDaaByDaaIdInvalidId() {
-    int invalidId = RandomUtils.nextInt(10, 100);
+    int invalidId = randomInt(10, 100);
     when(daaService.findById(invalidId)).thenThrow(new NotFoundException());
     resource = new DaaResource(daaService, dacService, userService, libraryCardService);
 
@@ -216,7 +216,7 @@ void testFindDaaByDaaIdInvalidId() {
 
   @Test
   void testFindDaaFileByDaaId() throws IOException {
-    int expectedDaaId = RandomUtils.nextInt(10, 100);
+    int expectedDaaId = randomInt(10, 100);
     DataAccessAgreement expectedDaa = new DataAccessAgreement();
     expectedDaa.setDaaId(expectedDaaId);
     String fileName = RandomStringUtils.randomAlphanumeric(10) + ".txt";
@@ -239,7 +239,7 @@ void testFindDaaFileByDaaId() throws IOException {
 
   @Test
   void testFindDaaFileByDaaIdInvalid() {
-    int invalidId = RandomUtils.nextInt(10, 100);
+    int invalidId = randomInt(10, 100);
     when(daaService.findFileById(invalidId)).thenThrow(new NotFoundException());
     resource = new DaaResource(daaService, dacService, userService, libraryCardService);
 
@@ -249,7 +249,7 @@ void testFindDaaFileByDaaIdInvalid() {
 
   @Test
   void testFindDaaFileByDaaIdDatabaseError() {
-    int expectedDaaId = RandomUtils.nextInt(10, 100);
+    int expectedDaaId = randomInt(10, 100);
     when(daaService.findFileById(expectedDaaId)).thenThrow(new RuntimeException());
     resource = new DaaResource(daaService, dacService, userService, libraryCardService);
 
@@ -264,7 +264,7 @@ void testCreateLibraryCardDaaRelation_AdminCase() {
     when(info.getBaseUriBuilder()).thenReturn(builder);
     when(builder.replacePath(any())).thenReturn(builder);
     Dac dac = new Dac();
-    dac.setDacId(RandomUtils.nextInt(10, 100));
+    dac.setDacId(randomInt(10, 100));
     User admin = new User();
     admin.setAdminRole();
     admin.setInstitutionId(1);
@@ -278,10 +278,10 @@ void testCreateLibraryCardDaaRelation_AdminCase() {
     daa.setDaaId(1);
     LibraryCard lc = new LibraryCard();
     lc.setId(1);
+    researcher.setLibraryCard(lc);
 
     when(userService.findUserByEmail(any())).thenReturn(admin);
     when(userService.findUserById(any())).thenReturn(researcher);
-    when(libraryCardService.findLibraryCardsByUserId(any())).thenReturn(Collections.singletonList(lc));
 
     resource = new DaaResource(daaService, dacService, userService, libraryCardService);
     Response response = resource.createLibraryCardDaaRelation(info, authUser, daa.getDaaId(),  admin.getUserId());
@@ -295,7 +295,7 @@ void testCreateLibraryCardDaaRelation_SigningOfficialCase() {
     when(info.getBaseUriBuilder()).thenReturn(builder);
     when(builder.replacePath(any())).thenReturn(builder);
     Dac dac = new Dac();
-    dac.setDacId(RandomUtils.nextInt(10, 100));
+    dac.setDacId(randomInt(10, 100));
     User admin = new User();
     admin.setSigningOfficialRole();
     admin.setInstitutionId(1);
@@ -308,10 +308,10 @@ void testCreateLibraryCardDaaRelation_SigningOfficialCase() {
     daa.setDaaId(1);
     LibraryCard lc = new LibraryCard();
     lc.setId(1);
+    researcher.setLibraryCard(lc);
 
     when(userService.findUserByEmail(any())).thenReturn(admin);
     when(userService.findUserById(any())).thenReturn(researcher);
-    when(libraryCardService.findLibraryCardsByUserId(any())).thenReturn(Collections.singletonList(lc));
 
     resource = new DaaResource(daaService, dacService, userService, libraryCardService);
     Response response = resource.createLibraryCardDaaRelation(info, authUser, daa.getDaaId(),  admin.getUserId());
@@ -323,7 +323,7 @@ void testCreateLibraryCardDaaRelation_InvalidInstitutionIdCase() {
     UriInfo info = mock(UriInfo.class);
     UriBuilder builder = mock(UriBuilder.class);
     Dac dac = new Dac();
-    dac.setDacId(RandomUtils.nextInt(10, 100));
+    dac.setDacId(randomInt(10, 100));
     User admin = new User();
     admin.setSigningOfficialRole();
     admin.setInstitutionId(2);
@@ -348,7 +348,7 @@ void testCreateLibraryCardDaaRelation_InvalidUserCase() {
     UriInfo info = mock(UriInfo.class);
     UriBuilder builder = mock(UriBuilder.class);
     Dac dac = new Dac();
-    dac.setDacId(RandomUtils.nextInt(10, 100));
+    dac.setDacId(randomInt(10, 100));
     User admin = new User();
     admin.setResearcherRole();
     admin.setInstitutionId(2);
@@ -372,7 +372,7 @@ void testCreateLibraryCardDaaRelation_InvalidUserCase() {
   void testCreateLibraryCardDaaRelation_InvalidDaaIdCase() {
     UriInfo info = mock(UriInfo.class);
     Dac dac = new Dac();
-    dac.setDacId(RandomUtils.nextInt(10, 100));
+    dac.setDacId(randomInt(10, 100));
     User admin = new User();
     admin.setSigningOfficialRole();
     admin.setInstitutionId(1);
@@ -383,11 +383,10 @@ void testCreateLibraryCardDaaRelation_InvalidDaaIdCase() {
     daa.setDaaId(1);
     LibraryCard lc = new LibraryCard();
     lc.setId(1);
+    researcher.setLibraryCard(lc);
 
     when(userService.findUserByEmail(any())).thenReturn(admin);
     when(userService.findUserById(any())).thenReturn(researcher);
-    when(libraryCardService.findLibraryCardsByUserId(any())).thenReturn(Collections.singletonList(lc));
-
 
     resource = new DaaResource(daaService, dacService, userService, libraryCardService);
     Response response = resource.createLibraryCardDaaRelation(info, authUser, daa.getDaaId(),  4);
@@ -401,7 +400,7 @@ void testCreateLibraryCardDaaRelation_NoMatchingLibraryCardsCase() {
     when(info.getBaseUriBuilder()).thenReturn(builder);
     when(builder.replacePath(any())).thenReturn(builder);
     Dac dac = new Dac();
-    dac.setDacId(RandomUtils.nextInt(10, 100));
+    dac.setDacId(randomInt(10, 100));
     User admin = new User();
     admin.setSigningOfficialRole();
     admin.setInstitutionId(1);
@@ -412,13 +411,11 @@ void testCreateLibraryCardDaaRelation_NoMatchingLibraryCardsCase() {
     daa.setDaaId(1);
     LibraryCard lc = new LibraryCard();
     lc.setId(1);
-    LibraryCard newLc = new LibraryCard();
-    newLc.setId(2);
+    researcher.setLibraryCard(lc);
 
 
     when(userService.findUserByEmail(any())).thenReturn(admin);
     when(userService.findUserById(any())).thenReturn(researcher);
-    when(libraryCardService.findLibraryCardsByUserId(any())).thenReturn(Collections.singletonList(lc));
 
     resource = new DaaResource(daaService, dacService, userService, libraryCardService);
     Response response = resource.createLibraryCardDaaRelation(info, authUser, daa.getDaaId(),  admin.getUserId());
@@ -432,7 +429,7 @@ void testCreateLibraryCardDaaRelation_NoLibraryCardsCase() {
     when(info.getBaseUriBuilder()).thenReturn(builder);
     when(builder.replacePath(any())).thenReturn(builder);
     Dac dac = new Dac();
-    dac.setDacId(RandomUtils.nextInt(10, 100));
+    dac.setDacId(randomInt(10, 100));
     User admin = new User();
     admin.setSigningOfficialRole();
     admin.setInstitutionId(1);
@@ -444,10 +441,8 @@ void testCreateLibraryCardDaaRelation_NoLibraryCardsCase() {
     LibraryCard newLc = new LibraryCard();
     newLc.setId(1);
 
-
     when(userService.findUserByEmail(any())).thenReturn(admin);
     when(userService.findUserById(any())).thenReturn(researcher);
-    when(libraryCardService.findLibraryCardsByUserId(any())).thenReturn(List.of());
     when(libraryCardService.createLibraryCardForSigningOfficial(any(), any())).thenReturn(newLc);
 
     resource = new DaaResource(daaService, dacService, userService, libraryCardService);
@@ -457,30 +452,29 @@ void testCreateLibraryCardDaaRelation_NoLibraryCardsCase() {
 
   @Test
   void testDeleteDaaValidUser() {
-    Integer daaId = RandomUtils.nextInt(10, 100);
+    Integer daaId = randomInt(10, 100);
 
     User user = new User();
+    user.setUserId(1);
     user.setAdminRole();
 
     LibraryCard libraryCard = new LibraryCard();
     libraryCard.setUserId(user.getUserId());
     libraryCard.setDaaIds(List.of(daaId));
+    user.setLibraryCard(libraryCard);
 
-    when(userService.findUserByEmail(any())).thenReturn(user);
-    when(libraryCardService.findLibraryCardsByUserId(any())).thenReturn(List.of(libraryCard));
+    when(userService.findUserById(any())).thenReturn(user);
     doNothing().when(libraryCardService).removeDaaFromLibraryCard(any(), any());
 
     resource = new DaaResource(daaService, dacService, userService, libraryCardService);
-    Response response = resource.deleteDaaForUser(authUser, daaId, RandomUtils.nextInt(10, 100));
+    Response response = resource.deleteDaaForUser(authUser, daaId, randomInt(10, 100));
     assert response.getStatus() == HttpStatus.SC_OK;
   }
 
   @Test
   void testDeleteDaaForInvalidUser() {
-    when(userService.findUserByEmail(any())).thenThrow(new RuntimeException("Internal server error"));
-
     resource = new DaaResource(daaService, dacService, userService, libraryCardService);
-    Response response = resource.deleteDaaForUser(authUser, RandomUtils.nextInt(10, 100), RandomUtils.nextInt(10, 100));
+    Response response = resource.deleteDaaForUser(authUser, randomInt(10, 100), randomInt(10, 100));
     assert response.getStatus() == HttpStatus.SC_INTERNAL_SERVER_ERROR;
   }
 
@@ -489,13 +483,13 @@ void testSendDaaRequestMessage() throws Exception {
     User user = new User();
     LibraryCard lc = new LibraryCard();
     user.setResearcherRole();
-    user.setInstitutionId(RandomUtils.nextInt(0,10));
-    user.addLibraryCard(lc);
+    user.setInstitutionId(randomInt(0,10));
+    user.setLibraryCard(lc);
     when(userService.findUserByEmail(any())).thenReturn(user);
     doNothing().when(daaService).sendDaaRequestEmails(any(), any());
 
     resource = new DaaResource(daaService, dacService, userService, libraryCardService);
-    Response response = resource.sendDaaRequestMessage(authUser, RandomUtils.nextInt(10, 100));
+    Response response = resource.sendDaaRequestMessage(authUser, randomInt(10, 100));
     assert response.getStatus() == HttpStatus.SC_OK;
   }
 
@@ -506,7 +500,7 @@ void testSendDaaRequestMessageUserNotFound() {
     when(userService.findUserByEmail(any())).thenThrow(new NotFoundException());
 
     resource = new DaaResource(daaService, dacService, userService, libraryCardService);
-    Response response = resource.sendDaaRequestMessage(authUser, RandomUtils.nextInt(10, 100));
+    Response response = resource.sendDaaRequestMessage(authUser, randomInt(10, 100));
     assert response.getStatus() == HttpStatus.SC_NOT_FOUND;
   }
 
@@ -515,13 +509,13 @@ void testSendDaaRequestMessageDaaNotFound() throws Exception {
     User user = new User();
     LibraryCard lc = new LibraryCard();
     user.setResearcherRole();
-    user.setInstitutionId(RandomUtils.nextInt(0,10));
-    user.addLibraryCard(lc);
+    user.setInstitutionId(randomInt(0,10));
+    user.setLibraryCard(lc);
     when(userService.findUserByEmail(any())).thenReturn(user);
     doThrow(new NotFoundException()).when(daaService).sendDaaRequestEmails(any(), any());
 
     resource = new DaaResource(daaService, dacService, userService, libraryCardService);
-    Response response = resource.sendDaaRequestMessage(authUser, RandomUtils.nextInt(10, 100));
+    Response response = resource.sendDaaRequestMessage(authUser, randomInt(10, 100));
     assert response.getStatus() == HttpStatus.SC_NOT_FOUND;
   }
 
@@ -530,24 +524,24 @@ void testSendDaaRequestMessageEmailError() throws Exception {
     User user = new User();
     LibraryCard lc = new LibraryCard();
     user.setResearcherRole();
-    user.setInstitutionId(RandomUtils.nextInt(0,10));
-    user.addLibraryCard(lc);
+    user.setInstitutionId(randomInt(0,10));
+    user.setLibraryCard(lc);
     when(userService.findUserByEmail(any())).thenReturn(user);
     doThrow(new Exception()).when(daaService).sendDaaRequestEmails(any(), any());
 
     resource = new DaaResource(daaService, dacService, userService, libraryCardService);
-    Response response = resource.sendDaaRequestMessage(authUser, RandomUtils.nextInt(10, 100));
+    Response response = resource.sendDaaRequestMessage(authUser, randomInt(10, 100));
     assert response.getStatus() == HttpStatus.SC_INTERNAL_SERVER_ERROR;
   }
 
   @Test
   void testSendDaaRequestMessageAssociationAlreadyExists() throws Exception {
     User user = new User();
-    int daaId = RandomUtils.nextInt(10, 100);
+    int daaId = randomInt(10, 100);
     LibraryCard lc = new LibraryCard();
     lc.setDaaIds(List.of(daaId));
     user.setResearcherRole();
-    user.setLibraryCards(List.of(lc));
+    user.setLibraryCard(lc);
     when(userService.findUserByEmail(any())).thenReturn(user);
 
     resource = new DaaResource(daaService, dacService, userService, libraryCardService);
@@ -558,76 +552,76 @@ void testSendDaaRequestMessageAssociationAlreadyExists() throws Exception {
   @Test
   void testSendNewDAAMessage() throws Exception {
     User user = new User();
-    int dacId = RandomUtils.nextInt(10,20);
+    int dacId = randomInt(10,20);
     Dac dac = new Dac();
     dac.setDacId(dacId);
-    dac.setName(RandomStringUtils.randomAlphabetic(10));
+    dac.setName(randomAlphabetic(10));
     user.setChairpersonRoleWithDAC(dacId);
     when(userService.findUserByEmail(any())).thenReturn(user);
     when(dacService.findById(any())).thenReturn(dac);
     doNothing().when(daaService).sendNewDaaEmails(any(), any(), any(), any());
 
     resource = new DaaResource(daaService, dacService, userService, libraryCardService);
-    Response response = resource.sendNewDaaMessage(authUser, dacId,  RandomUtils.nextInt(10, 100), RandomStringUtils.randomAlphabetic(10));
+    Response response = resource.sendNewDaaMessage(authUser, dacId,  randomInt(10, 100), randomAlphabetic(10));
     assert response.getStatus() == HttpStatus.SC_OK;
   }
 
   @Test
   void testSendNewDAAMessageUserNotFound() {
     User user = new User();
-    int dacId = RandomUtils.nextInt(10,20);
+    int dacId = randomInt(10,20);
     user.setChairpersonRoleWithDAC(dacId);
     when(userService.findUserByEmail(any())).thenThrow(new NotFoundException());
 
     resource = new DaaResource(daaService, dacService, userService, libraryCardService);
-    Response response = resource.sendNewDaaMessage(authUser, dacId,  RandomUtils.nextInt(10, 100), RandomStringUtils.randomAlphabetic(10));
+    Response response = resource.sendNewDaaMessage(authUser, dacId,  randomInt(10, 100), randomAlphabetic(10));
     assert response.getStatus() == HttpStatus.SC_NOT_FOUND;
   }
 
   @Test
   void testSendNewDAAMessageDacNotFound() {
     User user = new User();
-    int dacId = RandomUtils.nextInt(10,20);
+    int dacId = randomInt(10,20);
     user.setChairpersonRoleWithDAC(dacId);
     when(userService.findUserByEmail(any())).thenReturn(user);
     when(dacService.findById(dacId)).thenThrow(new NotFoundException());
 
     resource = new DaaResource(daaService, dacService, userService, libraryCardService);
-    Response response = resource.sendNewDaaMessage(authUser, dacId, RandomUtils.nextInt(10, 100), RandomStringUtils.randomAlphabetic(10));
+    Response response = resource.sendNewDaaMessage(authUser, dacId, randomInt(10, 100), randomAlphabetic(10));
     assert response.getStatus() == HttpStatus.SC_NOT_FOUND;
   }
 
   @Test
   void testSendNewDAAMessageDaaNotFound() throws Exception {
     User user = new User();
-    int dacId = RandomUtils.nextInt(10,20);
+    int dacId = randomInt(10,20);
     Dac dac = new Dac();
     dac.setDacId(dacId);
-    dac.setName(RandomStringUtils.randomAlphabetic(10));
+    dac.setName(randomAlphabetic(10));
     user.setChairpersonRoleWithDAC(dacId);
     when(userService.findUserByEmail(any())).thenReturn(user);
     when(dacService.findById(dacId)).thenReturn(dac);
     doThrow(new NotFoundException()).when(daaService).sendNewDaaEmails(any(), any(), any(), any());
 
     resource = new DaaResource(daaService, dacService, userService, libraryCardService);
-    Response response = resource.sendNewDaaMessage(authUser, dacId, RandomUtils.nextInt(10, 100), RandomStringUtils.randomAlphabetic(10));
+    Response response = resource.sendNewDaaMessage(authUser, dacId, randomInt(10, 100), randomAlphabetic(10));
     assert response.getStatus() == HttpStatus.SC_NOT_FOUND;
   }
 
   @Test
   void testSendNewDAAMessageEmailError() throws Exception {
     User user = new User();
-    int dacId = RandomUtils.nextInt(10,20);
+    int dacId = randomInt(10,20);
     Dac dac = new Dac();
     dac.setDacId(dacId);
-    dac.setName(RandomStringUtils.randomAlphabetic(10));
+    dac.setName(randomAlphabetic(10));
     user.setChairpersonRoleWithDAC(dacId);
     when(userService.findUserByEmail(any())).thenReturn(user);
     when(dacService.findById(dacId)).thenReturn(dac);
     doThrow(new Exception()).when(daaService).sendNewDaaEmails(any(), any(), any(), any());
 
     resource = new DaaResource(daaService, dacService, userService, libraryCardService);
-    Response response = resource.sendNewDaaMessage(authUser, dacId, RandomUtils.nextInt(10, 100), RandomStringUtils.randomAlphabetic(10));
+    Response response = resource.sendNewDaaMessage(authUser, dacId, randomInt(10, 100), randomAlphabetic(10));
     assert response.getStatus() == HttpStatus.SC_INTERNAL_SERVER_ERROR;
   }
 
@@ -657,7 +651,7 @@ void testBulkAddUsersToDaa() {
     when(userService.findUserByEmail(any())).thenReturn(authedUser);
     when(userService.findUsersInJsonArray(any(), any())).thenReturn(users);
     when(daaService.findById(daaId)).thenReturn(new DataAccessAgreement());
-    when(libraryCardService.addDaaToUserLibraryCardByInstitution(any(), any(), any())).thenReturn(List.of());
+    when(libraryCardService.addDaaToUserLibraryCardByInstitution(any(), any(), any())).thenReturn(null);
 
     resource = new DaaResource(daaService, dacService, userService, libraryCardService);
 
@@ -756,7 +750,7 @@ void testBulkRemoveUsersFromDaa() {
     when(userService.findUserByEmail(any())).thenReturn(authedUser);
     when(userService.findUsersInJsonArray(any(), any())).thenReturn(users);
     when(daaService.findById(daaId)).thenReturn(new DataAccessAgreement());
-    when(libraryCardService.removeDaaFromUserLibraryCards(any(), any())).thenReturn(List.of());
+    when(libraryCardService.removeDaaFromUserLibraryCard(any(), any())).thenReturn(null);
 
     resource = new DaaResource(daaService, dacService, userService, libraryCardService);
 
@@ -782,7 +776,7 @@ public void testBulkRemoveUsersWithAdminAndSO() {
     when(userService.findUserByEmail(any())).thenReturn(authedUser);
     when(userService.findUsersInJsonArray(any(), any())).thenReturn(users);
     when(daaService.findById(daaId)).thenReturn(new DataAccessAgreement());
-    when(libraryCardService.removeDaaFromUserLibraryCards(any(), any())).thenReturn(List.of());
+    when(libraryCardService.removeDaaFromUserLibraryCard(any(), any())).thenReturn(null);
 
     resource = new DaaResource(daaService, dacService, userService, libraryCardService);
 
@@ -864,7 +858,7 @@ void testBulkAddDAAsToUserAsSigningOfficial() {
     when(userService.findUserByEmail(any())).thenReturn(authedUser);
     when(userService.findUserById(userId)).thenReturn(researcher);
     when(daaService.findDAAsInJsonArray(any(), any())).thenReturn(agreements);
-    when(libraryCardService.addDaaToUserLibraryCardByInstitution(any(), any(), any())).thenReturn(List.of());
+    when(libraryCardService.addDaaToUserLibraryCardByInstitution(any(), any(), any())).thenReturn(null);
 
     resource = new DaaResource(daaService, dacService, userService, libraryCardService);
 
@@ -891,7 +885,7 @@ void testBulkAddDAAsToUserAsAdmin() {
     when(userService.findUserByEmail(any())).thenReturn(authedUser);
     when(userService.findUserById(userId)).thenReturn(researcher);
     when(daaService.findDAAsInJsonArray(any(), any())).thenReturn(agreements);
-    when(libraryCardService.addDaaToUserLibraryCardByInstitution(any(), any(), any())).thenReturn(List.of());
+    when(libraryCardService.addDaaToUserLibraryCardByInstitution(any(), any(), any())).thenReturn(null);
 
     resource = new DaaResource(daaService, dacService, userService, libraryCardService);
 
@@ -956,7 +950,7 @@ void testBulkRemoveDAAsFromUserAsSigningOfficial() {
     when(userService.findUserByEmail(any())).thenReturn(authedUser);
     when(userService.findUserById(userId)).thenReturn(researcher);
     when(daaService.findDAAsInJsonArray(any(), any())).thenReturn(agreements);
-    when(libraryCardService.removeDaaFromUserLibraryCards(any(), any())).thenReturn(List.of());
+    when(libraryCardService.removeDaaFromUserLibraryCard(any(), any())).thenReturn(null);
 
     resource = new DaaResource(daaService, dacService, userService, libraryCardService);
 
@@ -983,7 +977,7 @@ void testBulkRemoveDAAsFromUserAsAdmin() {
     when(userService.findUserByEmail(any())).thenReturn(authedUser);
     when(userService.findUserById(userId)).thenReturn(researcher);
     when(daaService.findDAAsInJsonArray(any(), any())).thenReturn(agreements);
-    when(libraryCardService.removeDaaFromUserLibraryCards(any(), any())).thenReturn(List.of());
+    when(libraryCardService.removeDaaFromUserLibraryCard(any(), any())).thenReturn(null);
 
     resource = new DaaResource(daaService, dacService, userService, libraryCardService);
 
@@ -1031,11 +1025,11 @@ void testBulkRemoveDAAsFromUserNotFound() {
 
   @Test
   void testAddDacToDaaAdmin() {
-    int daaId = RandomUtils.nextInt(10, 100);
+    int daaId = randomInt(10, 100);
     DataAccessAgreement daa = new DataAccessAgreement();
     daa.setDaaId(daaId);
     Dac dac = new Dac();
-    dac.setDacId(RandomUtils.nextInt(10, 100));
+    dac.setDacId(randomInt(10, 100));
 
     User admin = new User();
     admin.setAdminRole();
@@ -1051,11 +1045,11 @@ void testAddDacToDaaAdmin() {
 
   @Test
   void testAddDacToDaaChairperson() {
-    int daaId = RandomUtils.nextInt(10, 100);
+    int daaId = randomInt(10, 100);
     DataAccessAgreement daa = new DataAccessAgreement();
     daa.setDaaId(daaId);
     Dac dac = new Dac();
-    dac.setDacId(RandomUtils.nextInt(10, 100));
+    dac.setDacId(randomInt(10, 100));
 
     User chairperson = new User();
     chairperson.setChairpersonRoleWithDAC(dac.getDacId());
@@ -1071,13 +1065,13 @@ void testAddDacToDaaChairperson() {
 
   @Test
   void testAddDacToDaaChairpersonNoMatchingDac() {
-    int daaId = RandomUtils.nextInt(10, 100);
+    int daaId = randomInt(10, 100);
     DataAccessAgreement daa = new DataAccessAgreement();
     Dac dac = new Dac();
-    dac.setDacId(RandomUtils.nextInt(10, 100));
+    dac.setDacId(randomInt(10, 100));
 
     User chairperson = new User();
-    chairperson.setChairpersonRoleWithDAC(RandomUtils.nextInt(100,200));
+    chairperson.setChairpersonRoleWithDAC(randomInt(100,200));
 
     when(userService.findUserByEmail(any())).thenReturn(chairperson);
 
@@ -1089,9 +1083,9 @@ void testAddDacToDaaChairpersonNoMatchingDac() {
 
   @Test
   void testAddDacToDaaFromUserForbidden() {
-    int daaId = RandomUtils.nextInt(10, 100);
+    int daaId = randomInt(10, 100);
     Dac dac = new Dac();
-    dac.setDacId(RandomUtils.nextInt(10, 100));
+    dac.setDacId(randomInt(10, 100));
 
     User researcher = new User();
     researcher.setResearcherRole();
@@ -1106,10 +1100,10 @@ void testAddDacToDaaFromUserForbidden() {
 
   @Test
   void testAddDacToDaaDaaNotFound() {
-    int daaId = RandomUtils.nextInt(10, 100);
+    int daaId = randomInt(10, 100);
     DataAccessAgreement daa = new DataAccessAgreement();
     Dac dac = new Dac();
-    dac.setDacId(RandomUtils.nextInt(10, 100));
+    dac.setDacId(randomInt(10, 100));
 
     User admin = new User();
     admin.setAdminRole();
@@ -1125,10 +1119,10 @@ void testAddDacToDaaDaaNotFound() {
 
   @Test
   void testAddDacToDaaDacNotFound() {
-    int daaId = RandomUtils.nextInt(10, 100);
+    int daaId = randomInt(10, 100);
     DataAccessAgreement daa = new DataAccessAgreement();
     Dac dac = new Dac();
-    dac.setDacId(RandomUtils.nextInt(10, 100));
+    dac.setDacId(randomInt(10, 100));
 
     User admin = new User();
     admin.setAdminRole();
@@ -1143,11 +1137,11 @@ void testAddDacToDaaDacNotFound() {
 
   @Test
   void testAddDacToDaaAlreadyExists() {
-    int daaId = RandomUtils.nextInt(10, 100);
+    int daaId = randomInt(10, 100);
     DataAccessAgreement daa = new DataAccessAgreement();
     daa.setDaaId(daaId);
     Dac dac = new Dac();
-    dac.setDacId(RandomUtils.nextInt(10, 100));
+    dac.setDacId(randomInt(10, 100));
 
     User admin = new User();
     admin.setAdminRole();
@@ -1163,17 +1157,17 @@ void testAddDacToDaaAlreadyExists() {
 
   @Test
   void testAddDacToDaaDaaWithDacs() {
-    int daaId = RandomUtils.nextInt(10, 100);
+    int daaId = randomInt(10, 100);
     DataAccessAgreement daa = new DataAccessAgreement();
     daa.setDaaId(daaId);
     Dac dac1 = new Dac();
-    dac1.setDacId(RandomUtils.nextInt(10, 100));
+    dac1.setDacId(randomInt(10, 100));
     Dac dac2 = new Dac();
-    dac2.setDacId(RandomUtils.nextInt(10, 100));
+    dac2.setDacId(randomInt(10, 100));
     daa.addDac(dac1);
     daa.addDac(dac2);
     Dac dac3 = new Dac();
-    dac3.setDacId(RandomUtils.nextInt(10, 100));
+    dac3.setDacId(randomInt(10, 100));
 
     User admin = new User();
     admin.setAdminRole();
@@ -1189,11 +1183,11 @@ void testAddDacToDaaDaaWithDacs() {
 
   @Test
   void testRemoveDacFromDaaAdmin() throws Exception {
-    int daaId = RandomUtils.nextInt(10, 100);
+    int daaId = randomInt(10, 100);
     DataAccessAgreement daa = new DataAccessAgreement();
     daa.setDaaId(daaId);
     Dac dac = new Dac();
-    dac.setDacId(RandomUtils.nextInt(10, 100));
+    dac.setDacId(randomInt(10, 100));
     daa.addDac(dac);
 
     User admin = new User();
@@ -1210,11 +1204,11 @@ void testRemoveDacFromDaaAdmin() throws Exception {
 
   @Test
   void testRemoveDacFromDaaChairperson() throws Exception {
-    int daaId = RandomUtils.nextInt(10, 100);
+    int daaId = randomInt(10, 100);
     DataAccessAgreement daa = new DataAccessAgreement();
     daa.setDaaId(daaId);
     Dac dac = new Dac();
-    dac.setDacId(RandomUtils.nextInt(10, 100));
+    dac.setDacId(randomInt(10, 100));
     daa.addDac(dac);
 
     User chairperson = new User();
@@ -1231,15 +1225,15 @@ void testRemoveDacFromDaaChairperson() throws Exception {
 
   @Test
   void testRemoveDacFromDaaChairpersonNoMatchingDac() {
-    int daaId = RandomUtils.nextInt(10, 100);
+    int daaId = randomInt(10, 100);
     DataAccessAgreement daa = new DataAccessAgreement();
     daa.setDaaId(daaId);
     Dac dac = new Dac();
-    dac.setDacId(RandomUtils.nextInt(10, 100));
+    dac.setDacId(randomInt(10, 100));
     daa.addDac(dac);
 
     User chairperson = new User();
-    chairperson.setChairpersonRoleWithDAC(RandomUtils.nextInt(100,200));
+    chairperson.setChairpersonRoleWithDAC(randomInt(100,200));
 
     when(userService.findUserByEmail(any())).thenReturn(chairperson);
 
@@ -1251,11 +1245,11 @@ void testRemoveDacFromDaaChairpersonNoMatchingDac() {
 
   @Test
   void testRemoveDacFromDaaFromUserForbidden() {
-    int daaId = RandomUtils.nextInt(10, 100);
+    int daaId = randomInt(10, 100);
     DataAccessAgreement daa = new DataAccessAgreement();
     daa.setDaaId(daaId);
     Dac dac = new Dac();
-    dac.setDacId(RandomUtils.nextInt(10, 100));
+    dac.setDacId(randomInt(10, 100));
     daa.addDac(dac);
 
     User researcher = new User();
@@ -1271,11 +1265,11 @@ void testRemoveDacFromDaaFromUserForbidden() {
 
   @Test
   void testRemoveDacFromDaaDaaNotFound() {
-    int daaId = RandomUtils.nextInt(10, 100);
+    int daaId = randomInt(10, 100);
     DataAccessAgreement daa = new DataAccessAgreement();
     daa.setDaaId(daaId);
     Dac dac = new Dac();
-    dac.setDacId(RandomUtils.nextInt(10, 100));
+    dac.setDacId(randomInt(10, 100));
     daa.addDac(dac);
 
     User admin = new User();
@@ -1292,11 +1286,11 @@ void testRemoveDacFromDaaDaaNotFound() {
 
   @Test
   void testRemoveDacFromDaaDacNotFound() {
-    int daaId = RandomUtils.nextInt(10, 100);
+    int daaId = randomInt(10, 100);
     DataAccessAgreement daa = new DataAccessAgreement();
     daa.setDaaId(daaId);
     Dac dac = new Dac();
-    dac.setDacId(RandomUtils.nextInt(10, 100));
+    dac.setDacId(randomInt(10, 100));
     daa.addDac(dac);
 
     User admin = new User();
@@ -1312,11 +1306,11 @@ void testRemoveDacFromDaaDacNotFound() {
 
   @Test
   void testRemoveDacFromDaaDoesNotExist() throws Exception {
-    int daaId = RandomUtils.nextInt(10, 100);
+    int daaId = randomInt(10, 100);
     DataAccessAgreement daa = new DataAccessAgreement();
     daa.setDaaId(daaId);
     Dac dac = new Dac();
-    dac.setDacId(RandomUtils.nextInt(10, 100));
+    dac.setDacId(randomInt(10, 100));
 
     User admin = new User();
     admin.setAdminRole();
@@ -1332,7 +1326,7 @@ void testRemoveDacFromDaaDoesNotExist() throws Exception {
 
   @Test
   void testDeleteDaaAdmin() {
-    int daaId = RandomUtils.nextInt(10, 100);
+    int daaId = randomInt(10, 100);
 
     User admin = new User();
     admin.setAdminRole();
@@ -1351,7 +1345,7 @@ void testDeleteDaaAdmin() {
 
   @Test
   void testDeleteDaaDaaNotFound() {
-    int daaId = RandomUtils.nextInt(10, 100);
+    int daaId = randomInt(10, 100);
 
     User admin = new User();
     admin.setAdminRole();
@@ -1368,7 +1362,7 @@ void testDeleteDaaDaaNotFound() {
 
   @Test
   void testDeleteDaaForbiddenUser() {
-    int daaId = RandomUtils.nextInt(10, 100);
+    int daaId = randomInt(10, 100);
 
     User researcher = new User();
     researcher.setResearcherRole();
diff --git a/src/test/java/org/broadinstitute/consent/http/resources/DataAccessRequestResourceTest.java b/src/test/java/org/broadinstitute/consent/http/resources/DataAccessRequestResourceTest.java
index 177a40b4f5..9669940cc1 100644
--- a/src/test/java/org/broadinstitute/consent/http/resources/DataAccessRequestResourceTest.java
+++ b/src/test/java/org/broadinstitute/consent/http/resources/DataAccessRequestResourceTest.java
@@ -117,7 +117,7 @@ class DataAccessRequestResourceTest extends AbstractTestHelper {
 
   @BeforeEach
   void initResource() {
-    user.setLibraryCards(List.of(new LibraryCard()));
+    user.setLibraryCard(new LibraryCard());
     try {
       resource =
           new DataAccessRequestResource(daaService,
@@ -132,7 +132,7 @@ void initResource() {
   void testCreateDataAccessRequest() {
     try {
       User userWithCards = new User(1, authUser.getEmail(), "Display Name", new Date(), roles);
-      userWithCards.setLibraryCards(List.of(new LibraryCard()));
+      userWithCards.setLibraryCard(new LibraryCard());
       when(userService.findUserByEmail(any())).thenReturn(userWithCards);
       DataAccessRequest dar = new DataAccessRequest();
       dar.setReferenceId(UUID.randomUUID().toString());
@@ -158,7 +158,7 @@ void testCreateDataAccessRequest() {
   @Test
   void testCreateDataAccessRequestWithSubmittedDAR() {
     User userWithCards = new User(1, authUser.getEmail(), "Display Name", new Date(), roles);
-    userWithCards.setLibraryCards(List.of(new LibraryCard()));
+    userWithCards.setLibraryCard(new LibraryCard());
     when(userService.findUserByEmail(any())).thenReturn(userWithCards);
     DataAccessRequest dar = new DataAccessRequest();
     dar.setReferenceId(UUID.randomUUID().toString());
@@ -180,7 +180,7 @@ void testCreateDataAccessRequestWithSubmittedDAR() {
   @Test
   void testCreateDataAccessRequestWithoutValidERACommons() {
     User userWithCards = new User(1, authUser.getEmail(), "Display Name", new Date(), roles);
-    userWithCards.setLibraryCards(List.of(new LibraryCard()));
+    userWithCards.setLibraryCard(new LibraryCard());
     when(userService.findUserByEmail(any())).thenReturn(userWithCards);
     doThrow(new BadRequestException()).when(dataAccessRequestService)
         .createDataAccessRequest(eq(user), any());
@@ -211,7 +211,7 @@ void testGetByReferenceIdForbidden() {
   @Test
   void testUpdateByReferenceId() {
     DataAccessRequest dar = generateDataAccessRequest();
-    user.setLibraryCards(List.of(new LibraryCard()));
+    user.setLibraryCard(new LibraryCard());
     try {
       when(userService.findUserByEmail(any())).thenReturn(user);
       when(dataAccessRequestService.findByReferenceId(any())).thenReturn(dar);
@@ -809,7 +809,7 @@ void getDraftDar_UserNotAllowed() {
   void testCreateDataAccessRequestWithDAARestrictions() {
     try {
       User userWithCards = new User(1, authUser.getEmail(), "Display Name", new Date(), roles);
-      userWithCards.setLibraryCards(List.of(new LibraryCard()));
+      userWithCards.setLibraryCard(new LibraryCard());
       when(userService.findUserByEmail(any())).thenReturn(userWithCards);
       DataAccessRequest dar = new DataAccessRequest();
       dar.setReferenceId(UUID.randomUUID().toString());
@@ -837,7 +837,7 @@ void testCreateDataAccessRequestWithDAARestrictions() {
   void testCreateDataAccessRequestWithDAARestrictionsFailure() {
     try {
       User userWithCards = new User(1, authUser.getEmail(), "Display Name", new Date(), roles);
-      userWithCards.setLibraryCards(List.of(new LibraryCard()));
+      userWithCards.setLibraryCard(new LibraryCard());
       when(userService.findUserByEmail(any())).thenReturn(userWithCards);
       DataAccessRequest dar = new DataAccessRequest();
       dar.setReferenceId(UUID.randomUUID().toString());
diff --git a/src/test/java/org/broadinstitute/consent/http/service/DataAccessRequestServiceTest.java b/src/test/java/org/broadinstitute/consent/http/service/DataAccessRequestServiceTest.java
index 56bc8047c9..93b3deaa18 100644
--- a/src/test/java/org/broadinstitute/consent/http/service/DataAccessRequestServiceTest.java
+++ b/src/test/java/org/broadinstitute/consent/http/service/DataAccessRequestServiceTest.java
@@ -223,7 +223,7 @@ void testCreateDataAccessRequest_FailsIfNoLibraryCard() {
     dar.setSortDate(new Timestamp(1000));
     dar.setReferenceId("id");
     User user = new User(1, "email@test.org", "Display Name", new Date());
-    user.setLibraryCards(List.of());
+    user.setLibraryCard(null);
     assertThrows(NIHComplianceRuleException.class,
         () -> service.createDataAccessRequest(user, dar));
   }
@@ -412,7 +412,7 @@ void validateDarNullData() {
   void validateDarNoLibraryCards() {
     DataAccessRequest dar = generateDataAccessRequest();
     User user = new User(1, "email@test.org", "Display Name", new Date());
-    user.setLibraryCards(Collections.emptyList());
+    user.setLibraryCard(null);
     assertThrows(NIHComplianceRuleException.class, () -> service.validateDar(user, dar));
   }
 
@@ -438,7 +438,7 @@ void testValidateInternalCollaboratorsValid() {
         roles);
     collaboratorUser.setInstitutionId(requestingUser.getInstitutionId());
     LibraryCard libraryCard = new LibraryCard();
-    collaboratorUser.setLibraryCards(List.of(libraryCard));
+    collaboratorUser.setLibraryCard(libraryCard);
     DataAccessRequest dar = createDataAccessRequest(List.of(validCollaborator));
     when(userDAO.findUserByEmail(validCollaborator.getEmail())).thenReturn(collaboratorUser);
 
@@ -464,7 +464,7 @@ void testValidateInternalCollaboratorsNoLibraryCard() {
     User collaboratorUser = new User(2, invalidCollaborator.getEmail(), "Collaborator", new Date(),
         roles);
     collaboratorUser.setInstitutionId(requestingUser.getInstitutionId());
-    collaboratorUser.setLibraryCards(Collections.emptyList());
+    collaboratorUser.setLibraryCard(null);
     DataAccessRequest dar = createDataAccessRequest(List.of(invalidCollaborator));
     when(userDAO.findUserByEmail(invalidCollaborator.getEmail())).thenReturn(collaboratorUser);
 
@@ -521,7 +521,7 @@ void testGetUsersApprovedForDataset() {
   void testInsertDraftDataAccessRequest() {
     User user = new User();
     user.setUserId(1);
-    user.setLibraryCards(List.of(new LibraryCard()));
+    user.setLibraryCard(new LibraryCard());
     DataAccessRequest draft = generateDataAccessRequest();
     doNothing()
         .when(dataAccessRequestDAO)
@@ -963,7 +963,7 @@ private User createUserWithPrerequisites() {
     Institution institution = new Institution();
     institution.setId(1);
     user.setInstitution(institution);
-    user.setLibraryCards(List.of(new LibraryCard()));
+    user.setLibraryCard(new LibraryCard());
     user.setEraCommonsId("eraCommonsId");
     return user;
   }
diff --git a/src/test/java/org/broadinstitute/consent/http/service/LibraryCardServiceTest.java b/src/test/java/org/broadinstitute/consent/http/service/LibraryCardServiceTest.java
index 802f7388d1..6320c352f0 100644
--- a/src/test/java/org/broadinstitute/consent/http/service/LibraryCardServiceTest.java
+++ b/src/test/java/org/broadinstitute/consent/http/service/LibraryCardServiceTest.java
@@ -3,7 +3,9 @@
 import static org.junit.jupiter.api.Assertions.assertDoesNotThrow;
 import static org.junit.jupiter.api.Assertions.assertEquals;
 import static org.junit.jupiter.api.Assertions.assertNotNull;
+import static org.junit.jupiter.api.Assertions.assertNull;
 import static org.junit.jupiter.api.Assertions.assertThrows;
+import static org.junit.jupiter.api.Assertions.assertTrue;
 import static org.mockito.ArgumentMatchers.any;
 import static org.mockito.ArgumentMatchers.anyInt;
 import static org.mockito.ArgumentMatchers.anyString;
@@ -14,9 +16,7 @@
 
 import jakarta.ws.rs.BadRequestException;
 import jakarta.ws.rs.NotFoundException;
-import java.util.Collections;
 import java.util.List;
-import org.apache.commons.lang3.RandomUtils;
 import org.broadinstitute.consent.http.AbstractTestHelper;
 import org.broadinstitute.consent.http.db.InstitutionDAO;
 import org.broadinstitute.consent.http.db.LibraryCardDAO;
@@ -65,7 +65,7 @@ void testCreateLibraryCardFullUserDetailsAsAdmin() {
     LibraryCard payload = testLibraryCard(user.getUserId());
     payload.setUserEmail(user.getEmail());
     payload.setUserName("username");
-    payload.setCreateUserId(RandomUtils.nextInt(1, 10));
+    payload.setCreateUserId(randomInt(1, 10));
 
     //last two calls in the function, no need to test within this service test file
     LibraryCard createdCard = new LibraryCard();
@@ -152,7 +152,7 @@ void testCreateLibraryCardPartialUserDetailsId() {
     User adminUser = createUserWithRole(UserRoles.ADMIN.getRoleId(), UserRoles.ADMIN.getRoleName());
 
     when(userDAO.findUserById(user.getUserId())).thenReturn(user);
-    when(libraryCardDAO.findLibraryCardsByUserId(user.getUserId())).thenReturn(List.of());
+    when(libraryCardDAO.findLibraryCardByUserId(user.getUserId())).thenReturn(null);
 
     LibraryCard payload = testLibraryCard(user.getUserId());
     int cardId = 1;
@@ -171,7 +171,7 @@ void stubTest() {
     user.setEmail("testemail");
     when(userDAO.findUserById(user.getUserId())).thenReturn(user);
     LibraryCard libraryCard = testLibraryCard(user.getUserId());
-    libraryCard.setCreateUserId(RandomUtils.nextInt(1, 10));
+    libraryCard.setCreateUserId(randomInt(1, 10));
     when(libraryCardDAO.insertLibraryCard(eq(user.getUserId()), eq(null), eq(user.getEmail()),
         eq(libraryCard.getCreateUserId()), any())).thenReturn(123);
     service.createLibraryCard(libraryCard,
@@ -189,7 +189,7 @@ void testCreateLibraryCardAsSO() {
     when(userDAO.findUserById(anyInt())).thenReturn(soUser);
     when(institutionDAO.findInstitutionById(anyInt())).thenReturn(institution);
     when(institutionService.findInstitutionForEmail("testemail")).thenReturn(institution);
-    when(libraryCardDAO.findLibraryCardsByUserId(anyInt())).thenReturn(Collections.emptyList());
+    when(libraryCardDAO.findLibraryCardByUserId(anyInt())).thenReturn(null);
 
     // last two calls in the function, no need to test within this service test file
     when(libraryCardDAO.insertLibraryCard(anyInt(), eq(null), anyString(), eq(null), any())).thenReturn(1);
@@ -210,7 +210,7 @@ void testCreateLibraryCardIncorrectUserIdAndEmail() {
     user.setEmail("testemail");
 
     when(userDAO.findUserById(anyInt())).thenReturn(user);
-    when(libraryCardDAO.findLibraryCardsByUserId(anyInt())).thenReturn(Collections.emptyList());
+    when(libraryCardDAO.findLibraryCardByUserId(anyInt())).thenReturn(null);
 
     LibraryCard payload = testLibraryCard(user.getUserId());
     payload.setUserEmail("differentemail");
@@ -226,8 +226,7 @@ void testCreateLibraryCardAlreadyExistsOnUserId() {
     LibraryCard savedCard = testLibraryCard(user.getUserId());
     LibraryCard payload = savedCard;
 
-    when(libraryCardDAO.findLibraryCardsByUserId(anyInt())).thenReturn(
-        Collections.singletonList(savedCard));
+    when(libraryCardDAO.findLibraryCardByUserId(anyInt())).thenReturn(savedCard);
     assertThrows(ConsentConflictException.class, () -> service.createLibraryCard(payload, adminUser));
   }
 
@@ -243,8 +242,7 @@ void testCreateLibraryCardAlreadyExistsOnUserEmail() {
 
     LibraryCard payload = savedCard;
 
-    when(libraryCardDAO.findAllLibraryCardsByUserEmail(any())).thenReturn(
-        Collections.singletonList(savedCard));
+    when(libraryCardDAO.findLibraryCardByUserEmail(any())).thenReturn(savedCard);
     assertThrows(ConsentConflictException.class, () -> {
       service.createLibraryCard(payload, adminUser);
     });
@@ -361,8 +359,8 @@ void testFindLibraryCardDaaById_NotFound() {
   void testFindLibraryCardByIdDaa() {
     LibraryCard libraryCard = testLibraryCard(1);
     DataAccessAgreement daa1 = new DataAccessAgreement();
-    int daaId1 = RandomUtils.nextInt(1, 10);
-    int daaId2 = RandomUtils.nextInt(1, 10);
+    int daaId1 = randomInt(1, 10);
+    int daaId2 = randomInt(1, 10);
     daa1.setDaaId(daaId1);
     DataAccessAgreement daa2 = new DataAccessAgreement();
     daa2.setDaaId(daaId2);
@@ -401,15 +399,10 @@ void testAddDaaToUserLibraryCardByInstitution() {
     User signingOfficial = createUserWithRole(UserRoles.SIGNINGOFFICIAL.getRoleId(), UserRoles.SIGNINGOFFICIAL.getRoleName());
     signingOfficial.setInstitutionId(1);
     Integer userId = user.getUserId();
-    List<LibraryCard> libraryCards = List.of(
-        testLibraryCard(userId),
-        testLibraryCard(userId)
-    );
-    when(libraryCardDAO.findLibraryCardsByUserId(user.getUserId()))
-        .thenReturn(libraryCards);
+    when(libraryCardDAO.findLibraryCardByUserId(user.getUserId())).thenReturn(testLibraryCard(userId));
     doNothing().when(libraryCardDAO).createLibraryCardDaaRelation(any(), any());
-    List<LibraryCard> cards = service.addDaaToUserLibraryCardByInstitution(user, signingOfficial, 1);
-    assertEquals(2, cards.size());
+    LibraryCard card = service.addDaaToUserLibraryCardByInstitution(user, signingOfficial, 1);
+    assertNotNull(card);
   }
 
   @Test
@@ -432,10 +425,10 @@ void testAddDaaToUserLibraryCardWithNoLibraryCards() {
     LibraryCard payload = testLibraryCard(user.getUserId());
     payload.setUserEmail("testemail");
     // There are two calls to findLibraryCardsByUserId for checks before creation
-    when(libraryCardDAO.findLibraryCardsByUserId(userId))
-        .thenReturn(List.of())
-        .thenReturn(List.of())
-        .thenReturn(List.of(payload));
+    when(libraryCardDAO.findLibraryCardByUserId(userId))
+        .thenReturn(null)
+        .thenReturn(null)
+        .thenReturn(payload);
     when(institutionDAO.findInstitutionById(institution.getId())).thenReturn(institution);
     when(institutionService.findInstitutionForEmail(any())).thenReturn(institution);
     when(userDAO.findUserById(user.getUserId())).thenReturn(user);
@@ -443,8 +436,8 @@ void testAddDaaToUserLibraryCardWithNoLibraryCards() {
         .thenReturn(1);
     when(libraryCardDAO.findLibraryCardById(anyInt())).thenReturn(new LibraryCard());
 
-    List<LibraryCard> cards = service.addDaaToUserLibraryCardByInstitution(user, signingOfficial, 1);
-    assertEquals(1, cards.size());
+    LibraryCard card = service.addDaaToUserLibraryCardByInstitution(user, signingOfficial, 1);
+    assertNotNull(card);
   }
 
   @Test
@@ -460,34 +453,23 @@ void testAddDaaToUserLibraryCardByInstitutionSigningOfficialNoInstitution() {
   void testRemoveDaaFromUserLibraryCards() {
     User user = testUser(1);
     Integer userId = user.getUserId();
-    List<LibraryCard> libraryCards = List.of(
-        testLibraryCard(userId),
-        testLibraryCard(userId),
-        testLibraryCard(userId),
-        testLibraryCard(userId)
-    );
-    when(libraryCardDAO.findLibraryCardsByUserId(user.getUserId()))
-        .thenReturn(libraryCards);
+    when(libraryCardDAO.findLibraryCardByUserId(user.getUserId())).thenReturn(testLibraryCard(userId));
     doNothing().when(libraryCardDAO).deleteLibraryCardDaaRelation(any(), any());
-    List<LibraryCard> cards = service.removeDaaFromUserLibraryCards(user, 1);
+    LibraryCard card = service.removeDaaFromUserLibraryCard(user, 1);
     // The above deletion only affects the lc-daa join table and does not remove library cards
-    assertEquals(libraryCards.size(), cards.size());
+    assertNotNull(card);
+    assertTrue(card.getDaaIds().isEmpty());
   }
 
   @Test
   void testRemoveDaaFromUserLibraryCardsNoMatchingInstitutions() {
     User user = testUser(1);
     Integer userId = user.getUserId();
-    List<LibraryCard> libraryCards = List.of(
-        testLibraryCard(userId),
-        testLibraryCard(userId),
-        testLibraryCard(userId),
-        testLibraryCard(userId)
-    );
-    when(libraryCardDAO.findLibraryCardsByUserId(user.getUserId())).thenReturn(libraryCards);
-    List<LibraryCard> cards = service.removeDaaFromUserLibraryCards(user, 1);
+    when(libraryCardDAO.findLibraryCardByUserId(user.getUserId())).thenReturn(testLibraryCard(userId));
+    LibraryCard card = service.removeDaaFromUserLibraryCard(user, 1);
     // DAA removal should not delete library cards
-    assertEquals(libraryCards.size(), cards.size());
+    assertNotNull(card);
+    assertTrue(card.getDaaIds().isEmpty());
   }
 
   @Test
@@ -504,7 +486,7 @@ void testCreateLibraryCardForSigningOfficial() {
     when(userDAO.findUserById(anyInt())).thenReturn(user);
     when(institutionDAO.findInstitutionById(anyInt())).thenReturn(institution);
     when(institutionService.findInstitutionForEmail(user.getEmail())).thenReturn(institution);
-    when(libraryCardDAO.findLibraryCardsByUserId(anyInt())).thenReturn(Collections.emptyList());
+    when(libraryCardDAO.findLibraryCardByUserId(anyInt())).thenReturn(null);
 
     when(libraryCardDAO.insertLibraryCard(anyInt(), any(), any(), anyInt(),
         any())).thenReturn(1);
@@ -519,22 +501,21 @@ void testCreateLibraryCardForSigningOfficial() {
   void testRemoveDaaFromUserLibraryCardByInstitutionNoLibraryCards() {
     User user = testUser(1);
     Integer userId = user.getUserId();
-    when(libraryCardDAO.findLibraryCardsByUserId(userId))
-        .thenReturn(Collections.emptyList());
-    List<LibraryCard> cards = service.removeDaaFromUserLibraryCards(user,1);
-    assertEquals(0, cards.size());
+    when(libraryCardDAO.findLibraryCardByUserId(userId)).thenReturn(null);
+    LibraryCard card = service.removeDaaFromUserLibraryCard(user,1);
+    assertNull(card);
   }
 
   private User testUser(Integer institutionId) {
     User user = new User();
-    user.setUserId(RandomUtils.nextInt(1, 10));
+    user.setUserId(randomInt(1, 10));
     user.setInstitutionId(institutionId);
     return user;
   }
 
   private LibraryCard testLibraryCard(Integer userId) {
     LibraryCard libraryCard = new LibraryCard();
-    libraryCard.setId(RandomUtils.nextInt(1, 10));
+    libraryCard.setId(randomInt(1, 10));
     libraryCard.setUserId(userId);
 
     return libraryCard;
@@ -542,7 +523,7 @@ private LibraryCard testLibraryCard(Integer userId) {
 
   private Institution testInstitution() {
     Institution institution = new Institution();
-    institution.setId(RandomUtils.nextInt(1, 10));
+    institution.setId(randomInt(1, 10));
     institution.setName("Test Institution");
 
     return institution;
diff --git a/src/test/java/org/broadinstitute/consent/http/service/UserServiceTest.java b/src/test/java/org/broadinstitute/consent/http/service/UserServiceTest.java
index 150dcffae6..dfa0a2498f 100644
--- a/src/test/java/org/broadinstitute/consent/http/service/UserServiceTest.java
+++ b/src/test/java/org/broadinstitute/consent/http/service/UserServiceTest.java
@@ -7,6 +7,7 @@
 import static org.junit.jupiter.api.Assertions.assertFalse;
 import static org.junit.jupiter.api.Assertions.assertNotNull;
 import static org.junit.jupiter.api.Assertions.assertNull;
+import static org.junit.jupiter.api.Assertions.assertSame;
 import static org.junit.jupiter.api.Assertions.assertThrows;
 import static org.junit.jupiter.api.Assertions.assertTrue;
 import static org.junit.jupiter.api.Assertions.fail;
@@ -101,9 +102,6 @@ class UserServiceTest extends AbstractTestHelper {
   @Mock
   private DaaDAO daaDAO;
 
-  @Mock
-  private EmailService emailService;
-
   @Mock
   private DraftServiceDAO draftServiceDAO;
 
@@ -165,7 +163,7 @@ void createUserTest() {
     List<UserRole> roles = List.of(generateRole(UserRoles.RESEARCHER.getRoleId()));
     u.setRoles(roles);
     when(userDAO.findUserById(any())).thenReturn(u);
-    when(libraryCardDAO.findAllLibraryCardsByUserEmail(any())).thenReturn(Collections.emptyList());
+    when(libraryCardDAO.findLibraryCardByUserEmail(u.getEmail())).thenReturn(null);
     try {
       service.createUser(u);
     } catch (Exception e) {
@@ -180,8 +178,7 @@ void createUserWithLibraryCardTest() {
     Institution institution = new Institution();
     List<UserRole> roles = List.of(generateRole(UserRoles.RESEARCHER.getRoleId()));
     u.setRoles(roles);
-    when(libraryCardDAO.findAllLibraryCardsByUserEmail(u.getEmail())).thenReturn(
-        List.of(lc));
+    when(libraryCardDAO.findLibraryCardByUserEmail(u.getEmail())).thenReturn(lc);
     when(institutionService.findInstitutionForEmail(u.getEmail())).thenReturn(institution);
 
     service.createUser(u);
@@ -218,7 +215,7 @@ void testHasValidERACommonsCredentials() {
     User u = generateUser();
     u.setEraCommonsId(randomAlphabetic(10));
     LibraryCard lc = generateLibraryCard(u.getEmail());
-    u.addLibraryCard(lc);
+    u.setLibraryCard(lc);
     UserProperty eraStatus = new UserProperty(1, u.getUserId(), ERA_STATUS.getValue(), "true");
     //standard practice is that these expire in 30 days.
     Timestamp eraExpirationTime = new Timestamp(
@@ -247,8 +244,6 @@ void testValidateERACommonsCredentialsMissingLibraryCards() {
     userProperties.add(eraStatus);
     userProperties.add(eraExpirationDate);
     u.setProperties(userProperties);
-    when(userPropertyDAO.findUserPropertiesByUserIdAndPropertyKeys(u.getUserId(),
-        UserFields.getValues())).thenReturn(u.getProperties());
     assertThrows(LibraryCardRequiredException.class,
         () -> service.hasValidActiveERACredentials(u));
   }
@@ -258,7 +253,7 @@ void testValidateERACommonsCredentialsMissingERACommonsId() {
     User u = generateUser();
     u.setEraCommonsId(null);
     LibraryCard lc = generateLibraryCard(u.getEmail());
-    u.addLibraryCard(lc);
+    u.setLibraryCard(lc);
     UserProperty eraStatus = new UserProperty(1, u.getUserId(), ERA_STATUS.getValue(), "true");
     //standard practice is that these expire in 30 days.
     Timestamp eraExpirationTime = new Timestamp(
@@ -269,8 +264,6 @@ void testValidateERACommonsCredentialsMissingERACommonsId() {
     userProperties.add(eraStatus);
     userProperties.add(eraExpirationDate);
     u.setProperties(userProperties);
-    when(userPropertyDAO.findUserPropertiesByUserIdAndPropertyKeys(u.getUserId(),
-        UserFields.getValues())).thenReturn(u.getProperties());
     assertThrows(BadRequestException.class,
         () -> service.hasValidActiveERACredentials(u));
   }
@@ -279,7 +272,7 @@ void testValidateERACommonsCredentialsMissingERACommonsId() {
   void testValidateRACommonsCredentialsMissingERAStatusShouldFail() {
     User u = generateUser();
     LibraryCard lc = generateLibraryCard(u.getEmail());
-    u.addLibraryCard(lc);
+    u.setLibraryCard(lc);
     //standard practice is that these expire in 30 days.
     Timestamp eraExpirationTime = new Timestamp(
         System.currentTimeMillis() + TimeUnit.DAYS.toMillis(30));
@@ -298,7 +291,7 @@ void testValidateRACommonsCredentialsMissingERAStatusShouldFail() {
   void testValidateERACommonsCredentialsMissingERAStatusAndExpirationShouldFail() {
     User u = generateUser();
     LibraryCard lc = generateLibraryCard(u.getEmail());
-    u.addLibraryCard(lc);
+    u.setLibraryCard(lc);
     List<UserProperty> userProperties = new ArrayList<>();
     u.setProperties(userProperties);
     when(userPropertyDAO.findUserPropertiesByUserIdAndPropertyKeys(u.getUserId(),
@@ -311,7 +304,7 @@ void testValidateERACommonsCredentialsMissingERAStatusAndExpirationShouldFail()
   void testValidateERACommonsCredentialsWithExpiredERAExpirationDateShouldFail() {
     User u = generateUser();
     LibraryCard lc = generateLibraryCard(u.getEmail());
-    u.addLibraryCard(lc);
+    u.setLibraryCard(lc);
     UserProperty eraStatus = new UserProperty(1, u.getUserId(), ERA_STATUS.getValue(), "true");
     // set expiration date to 30 days ago!
     Timestamp eraExpirationTime = new Timestamp(
@@ -366,17 +359,14 @@ void testCreateUserNoEmail() {
   void testFindUserById_HasLibraryCards() {
     User u = generateUser();
     LibraryCard one = generateLibraryCard(u);
-    LibraryCard two = generateLibraryCard(u);
-    List<LibraryCard> cards = List.of(one, two);
+    u.setLibraryCard(one);
     when(userDAO.findUserById(any())).thenReturn(u);
-    when(libraryCardDAO.findLibraryCardsByUserId(any())).thenReturn(cards);
+    when(libraryCardDAO.findLibraryCardByUserId(any())).thenReturn(one);
 
     User user = service.findUserById(u.getUserId());
     assertNotNull(user);
-    assertNotNull(user.getLibraryCards());
-    assertEquals(2, user.getLibraryCards().size());
-    assertEquals(one.getId(), user.getLibraryCards().get(0).getId());
-    assertEquals(two.getId(), user.getLibraryCards().get(1).getId());
+    assertNotNull(user.getLibraryCard());
+    assertSame(one, user.getLibraryCard());
   }
 
   @Test
@@ -517,13 +507,13 @@ void testGetUsersByUserRole_SO() {
     User u = generateUser();
     u.setInstitutionId(1);
     LibraryCard lc = generateLibraryCard(u);
-    u.setLibraryCards(List.of(lc));
+    u.setLibraryCard(lc);
     when(userDAO.getUsersFromInstitutionWithCards(anyInt())).thenReturn(List.of(u, new User()));
 
     List<User> users = service.getUsersAsRole(u, UserRoles.SIGNINGOFFICIAL.getRoleName());
     assertNotNull(users);
     assertEquals(2, users.size());
-    assertEquals(List.of(lc), users.get(0).getLibraryCards());
+    assertSame(lc, users.get(0).getLibraryCard());
   }
 
   @Test
@@ -548,13 +538,13 @@ void testGetUsersAsRoleAdmin() {
       returnedUsers.add(u3);
     }
     LibraryCard lc = generateLibraryCard(u1);
-    u1.setLibraryCards(List.of(lc));
+    u1.setLibraryCard(lc);
     when(userDAO.findUsersWithLCsAndInstitution()).thenReturn(returnedUsers);
     List<User> users = service.getUsersAsRole(u1, UserRoles.ADMIN.getRoleName());
     assertNotNull(users);
     assertEquals(returnedUsers.size(), users.size());
-    assertEquals(List.of(lc), users.get(0).getLibraryCards());
-    assertTrue(users.get(1).getLibraryCards().isEmpty());
+    assertEquals(lc, users.get(0).getLibraryCard());
+    assertNull(users.get(1).getLibraryCard());
   }
 
   @Test
@@ -677,7 +667,7 @@ void testFindUserWithPropertiesAsJsonObjectById() {
     AuthUser authUser = new AuthUser().setEmail(user.getEmail())
         .setAuthToken(randomAlphabetic(30)).setUserStatusInfo(info);
     when(userDAO.findUserById(anyInt())).thenReturn(user);
-    when(libraryCardDAO.findLibraryCardsByUserId(anyInt())).thenReturn(List.of(new LibraryCard()));
+    when(libraryCardDAO.findLibraryCardByUserId(anyInt())).thenReturn(new LibraryCard());
     when(userPropertyDAO.findUserPropertiesByUserIdAndPropertyKeys(anyInt(), any())).thenReturn(
         List.of(new UserProperty()));
 
@@ -698,7 +688,7 @@ void testFindUserWithPropertiesAsJsonObjectByIdNonAuthUser() {
     AuthUser authUser = new AuthUser().setEmail("not the user's email address")
         .setAuthToken(randomAlphabetic(30)).setUserStatusInfo(info);
     when(userDAO.findUserById(anyInt())).thenReturn(user);
-    when(libraryCardDAO.findLibraryCardsByUserId(anyInt())).thenReturn(List.of(new LibraryCard()));
+    when(libraryCardDAO.findLibraryCardByUserId(anyInt())).thenReturn(new LibraryCard());
     when(userPropertyDAO.findUserPropertiesByUserIdAndPropertyKeys(anyInt(), any())).thenReturn(
         List.of(new UserProperty()));
 
@@ -754,7 +744,7 @@ void testFindOrCreateUserNewUser() throws Exception {
     User newUser = service.findOrCreateUser(authUser);
     assertEquals(user.getEmail(), newUser.getEmail());
     verify(userRoleDAO).insertUserRoles(any(), any());
-    verify(libraryCardDAO).findAllLibraryCardsByUserEmail(any());
+    verify(libraryCardDAO).findLibraryCardByUserEmail(any());
   }
 
   @Test
diff --git a/src/test/java/org/broadinstitute/consent/http/service/dao/NihServiceDAOTest.java b/src/test/java/org/broadinstitute/consent/http/service/dao/NihServiceDAOTest.java
index b22e552b5e..79fee981d9 100644
--- a/src/test/java/org/broadinstitute/consent/http/service/dao/NihServiceDAOTest.java
+++ b/src/test/java/org/broadinstitute/consent/http/service/dao/NihServiceDAOTest.java
@@ -1,7 +1,8 @@
 package org.broadinstitute.consent.http.service.dao;
 
 import static org.junit.jupiter.api.Assertions.assertEquals;
-import static org.junit.jupiter.api.Assertions.assertFalse;
+import static org.junit.jupiter.api.Assertions.assertNotNull;
+import static org.junit.jupiter.api.Assertions.assertNull;
 import static org.junit.jupiter.api.Assertions.assertThrows;
 import static org.junit.jupiter.api.Assertions.assertTrue;
 import static org.mockito.Mockito.any;
@@ -89,8 +90,8 @@ void testUpdateUserNihStatus_existing() {
     User updatedUser = userDAO.findUserById(user.getUserId());
     assertEquals(updatedUser.getEraCommonsId(), userAccount.getNihUsername());
 
-    List<LibraryCard> cards = libraryCardDAO.findLibraryCardsByUserId(user.getUserId());
-    assertFalse(cards.isEmpty());
+    LibraryCard card = libraryCardDAO.findLibraryCardByUserId(user.getUserId());
+    assertNotNull(card);
   }
 
   @Test
@@ -133,8 +134,8 @@ void testUpdateUserNihStatus_new() {
     assertEquals(updatedUser.getEraCommonsId(), userAccount.getNihUsername());
 
     // ensure that we did not make any LC updates
-    List<LibraryCard> cards = libraryCardDAO.findLibraryCardsByUserId(user.getUserId());
-    assertTrue(cards.isEmpty());
+    LibraryCard card = libraryCardDAO.findLibraryCardByUserId(user.getUserId());
+    assertNull(card);
   }
 
   @Test

From fd1b491d7761c3bd491751fa331845cce7fe3f3d Mon Sep 17 00:00:00 2001
From: rushtong <grushton@broadinstitute.org>
Date: Thu, 22 May 2025 18:30:15 -0400
Subject: [PATCH 02/26] revert

---
 .idea/codeStyles/Project.xml | 1 -
 1 file changed, 1 deletion(-)

diff --git a/.idea/codeStyles/Project.xml b/.idea/codeStyles/Project.xml
index 9672c273ac..b6c57434e5 100644
--- a/.idea/codeStyles/Project.xml
+++ b/.idea/codeStyles/Project.xml
@@ -49,7 +49,6 @@
       </option>
       <option name="IMPORT_LAYOUT_TABLE">
         <value>
-          <package name="" withSubpackages="true" static="false" module="true" />
           <package name="" withSubpackages="true" static="true" />
           <emptyLine />
           <package name="" withSubpackages="true" static="false" />

From b4a7a3a4825876084c686c518ea9398e11f9ad6b Mon Sep 17 00:00:00 2001
From: rushtong <grushton@broadinstitute.org>
Date: Thu, 22 May 2025 18:48:12 -0400
Subject: [PATCH 03/26] unused import

---
 .../org/broadinstitute/consent/http/db/LibraryCardDAOTest.java   | 1 -
 1 file changed, 1 deletion(-)

diff --git a/src/test/java/org/broadinstitute/consent/http/db/LibraryCardDAOTest.java b/src/test/java/org/broadinstitute/consent/http/db/LibraryCardDAOTest.java
index 847a7a9d06..61f59cb7d2 100644
--- a/src/test/java/org/broadinstitute/consent/http/db/LibraryCardDAOTest.java
+++ b/src/test/java/org/broadinstitute/consent/http/db/LibraryCardDAOTest.java
@@ -3,7 +3,6 @@
 import static org.junit.jupiter.api.Assertions.assertEquals;
 import static org.junit.jupiter.api.Assertions.assertNotNull;
 import static org.junit.jupiter.api.Assertions.assertNull;
-import static org.junit.jupiter.api.Assertions.assertSame;
 import static org.junit.jupiter.api.Assertions.assertTrue;
 
 import java.time.Instant;

From 5a5009df8a0b5ea01beec0ff0760c54b6fd77293 Mon Sep 17 00:00:00 2001
From: rushtong <grushton@broadinstitute.org>
Date: Thu, 22 May 2025 18:48:28 -0400
Subject: [PATCH 04/26] reduce log level

---
 .../consent/http/db/mapper/UserWithRolesReducer.java        | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/src/main/java/org/broadinstitute/consent/http/db/mapper/UserWithRolesReducer.java b/src/main/java/org/broadinstitute/consent/http/db/mapper/UserWithRolesReducer.java
index ae9b889cfd..78ebdb3f7b 100644
--- a/src/main/java/org/broadinstitute/consent/http/db/mapper/UserWithRolesReducer.java
+++ b/src/main/java/org/broadinstitute/consent/http/db/mapper/UserWithRolesReducer.java
@@ -48,7 +48,7 @@ public void accumulate(Map<Integer, User> map, RowView rowView) {
         }
       }
     } catch (MappingException e) {
-      logWarn("Error adding Institution to User", e);
+      logDebug("Error adding Institution to User: %s".formatted(e.getMessage()));
     }
     //user role join can cause duplication of data if done in tandem with joins on other tables
     //ex) The same LC can end up being repeated multiple times
@@ -62,7 +62,7 @@ public void accumulate(Map<Integer, User> map, RowView rowView) {
         user.setLibraryCard(lc);
       }
     } catch (MappingException e) {
-      logWarn("Error adding Library Card to User", e);
+      logDebug("Error adding Library Card to User: %s".formatted(e.getMessage()));
     }
     try {
       if (Objects.nonNull(rowView.getColumn("up_property_id", Integer.class))) {
@@ -70,7 +70,7 @@ public void accumulate(Map<Integer, User> map, RowView rowView) {
         user.addProperty(p);
       }
     } catch (MappingException e) {
-      logWarn("Error adding User Property to User", e);
+      logDebug("Error adding User Property to User: %s".formatted(e.getMessage()));
     }
   }
 

From ad471eba76847accfbb820f3a56f2454044b9911 Mon Sep 17 00:00:00 2001
From: rushtong <grushton@broadinstitute.org>
Date: Thu, 22 May 2025 18:48:38 -0400
Subject: [PATCH 05/26] formatting

---
 src/main/java/org/broadinstitute/consent/http/db/UserDAO.java | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/src/main/java/org/broadinstitute/consent/http/db/UserDAO.java b/src/main/java/org/broadinstitute/consent/http/db/UserDAO.java
index a20d86f52a..987e0c1ad3 100644
--- a/src/main/java/org/broadinstitute/consent/http/db/UserDAO.java
+++ b/src/main/java/org/broadinstitute/consent/http/db/UserDAO.java
@@ -30,7 +30,7 @@ public interface UserDAO extends Transactional<UserDAO> {
   @RegisterBeanMapper(value = LibraryCard.class, prefix = "lc")
   @UseRowReducer(UserWithRolesReducer.class)
   @SqlQuery("""
-            SELECT
+      SELECT
           u.user_id as u_user_id,
           u.email as u_email,
           u.display_name as u_display_name,

From ffa0e2c0dc060bac6d7eda1e18c89cad6c1e6e6b Mon Sep 17 00:00:00 2001
From: rushtong <grushton@broadinstitute.org>
Date: Thu, 22 May 2025 19:00:53 -0400
Subject: [PATCH 06/26] test fix

---
 .../consent/http/service/UserService.java        | 16 +++++++++-------
 .../consent/http/service/UserServiceTest.java    |  2 +-
 2 files changed, 10 insertions(+), 8 deletions(-)

diff --git a/src/main/java/org/broadinstitute/consent/http/service/UserService.java b/src/main/java/org/broadinstitute/consent/http/service/UserService.java
index e2d598ff49..c1a9ea8fb5 100644
--- a/src/main/java/org/broadinstitute/consent/http/service/UserService.java
+++ b/src/main/java/org/broadinstitute/consent/http/service/UserService.java
@@ -368,13 +368,15 @@ public void insertUserRoles(List<UserRole> roles, Integer userId) {
 
   private void addFloatingLibraryCardToUser(User user) {
     LibraryCard libraryCard = libraryCardDAO.findLibraryCardByUserEmail(user.getEmail());
-    libraryCardDAO.updateLibraryCardById(
-        libraryCard.getId(),
-        user.getUserId(),
-        user.getDisplayName(),
-        user.getEmail(),
-        user.getUserId(),
-        new Date());
+    if (libraryCard != null) {
+      libraryCardDAO.updateLibraryCardById(
+          libraryCard.getId(),
+          user.getUserId(),
+          user.getDisplayName(),
+          user.getEmail(),
+          user.getUserId(),
+          new Date());
+    }
   }
 
   public User findOrCreateUser(AuthUser authUser) throws Exception {
diff --git a/src/test/java/org/broadinstitute/consent/http/service/UserServiceTest.java b/src/test/java/org/broadinstitute/consent/http/service/UserServiceTest.java
index dfa0a2498f..84b88605f4 100644
--- a/src/test/java/org/broadinstitute/consent/http/service/UserServiceTest.java
+++ b/src/test/java/org/broadinstitute/consent/http/service/UserServiceTest.java
@@ -162,7 +162,7 @@ void createUserTest() {
     User u = generateUser();
     List<UserRole> roles = List.of(generateRole(UserRoles.RESEARCHER.getRoleId()));
     u.setRoles(roles);
-    when(userDAO.findUserById(any())).thenReturn(u);
+    when(userDAO.findUserByEmail(u.getEmail())).thenReturn(null);
     when(libraryCardDAO.findLibraryCardByUserEmail(u.getEmail())).thenReturn(null);
     try {
       service.createUser(u);

From 18b1dacbeac03bf006c827b9b4d0260dbc7fd118 Mon Sep 17 00:00:00 2001
From: rushtong <grushton@broadinstitute.org>
Date: Thu, 22 May 2025 19:02:54 -0400
Subject: [PATCH 07/26] test fix

---
 .../broadinstitute/consent/http/service/UserServiceTest.java  | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/src/test/java/org/broadinstitute/consent/http/service/UserServiceTest.java b/src/test/java/org/broadinstitute/consent/http/service/UserServiceTest.java
index 84b88605f4..5b938f09fe 100644
--- a/src/test/java/org/broadinstitute/consent/http/service/UserServiceTest.java
+++ b/src/test/java/org/broadinstitute/consent/http/service/UserServiceTest.java
@@ -683,19 +683,19 @@ void testFindUserWithPropertiesAsJsonObjectById() {
   @Test
   void testFindUserWithPropertiesAsJsonObjectByIdNonAuthUser() {
     User user = generateUser();
+    user.setLibraryCard(new LibraryCard());
     UserStatusInfo info = new UserStatusInfo().setUserEmail(user.getEmail()).setEnabled(true)
         .setUserSubjectId("subjectId");
     AuthUser authUser = new AuthUser().setEmail("not the user's email address")
         .setAuthToken(randomAlphabetic(30)).setUserStatusInfo(info);
     when(userDAO.findUserById(anyInt())).thenReturn(user);
-    when(libraryCardDAO.findLibraryCardByUserId(anyInt())).thenReturn(new LibraryCard());
     when(userPropertyDAO.findUserPropertiesByUserIdAndPropertyKeys(anyInt(), any())).thenReturn(
         List.of(new UserProperty()));
 
     JsonObject userJson = service.findUserWithPropertiesByIdAsJsonObject(authUser,
         user.getUserId());
     assertNotNull(userJson);
-    assertTrue(userJson.get(UserService.LIBRARY_CARDS_FIELD).getAsJsonArray().isJsonArray());
+    assertTrue(userJson.get(UserService.LIBRARY_CARDS_FIELD).getAsJsonObject().isJsonObject());
     assertTrue(
         userJson.get(UserService.USER_PROPERTIES_FIELD).getAsJsonArray().isJsonArray());
     assertNull(userJson.get(UserService.USER_STATUS_INFO_FIELD));

From cbf0a45cf1acd61a66e2c5f1d84ad041be19f58b Mon Sep 17 00:00:00 2001
From: rushtong <grushton@broadinstitute.org>
Date: Thu, 22 May 2025 19:09:05 -0400
Subject: [PATCH 08/26] test fix

---
 .../org/broadinstitute/consent/http/service/UserServiceTest.java | 1 +
 1 file changed, 1 insertion(+)

diff --git a/src/test/java/org/broadinstitute/consent/http/service/UserServiceTest.java b/src/test/java/org/broadinstitute/consent/http/service/UserServiceTest.java
index 5b938f09fe..77c3e4cbdb 100644
--- a/src/test/java/org/broadinstitute/consent/http/service/UserServiceTest.java
+++ b/src/test/java/org/broadinstitute/consent/http/service/UserServiceTest.java
@@ -175,6 +175,7 @@ void createUserTest() {
   void createUserWithLibraryCardTest() {
     User u = generateUser();
     LibraryCard lc = generateLibraryCard(u.getEmail());
+    lc.setUserName(u.getDisplayName());
     Institution institution = new Institution();
     List<UserRole> roles = List.of(generateRole(UserRoles.RESEARCHER.getRoleId()));
     u.setRoles(roles);

From c3dce9378821b53a5958b590b0e37cf107fe1e7a Mon Sep 17 00:00:00 2001
From: rushtong <grushton@broadinstitute.org>
Date: Fri, 23 May 2025 07:23:09 -0400
Subject: [PATCH 09/26] test fix

---
 .../broadinstitute/consent/http/service/UserServiceTest.java   | 3 +--
 1 file changed, 1 insertion(+), 2 deletions(-)

diff --git a/src/test/java/org/broadinstitute/consent/http/service/UserServiceTest.java b/src/test/java/org/broadinstitute/consent/http/service/UserServiceTest.java
index 77c3e4cbdb..32179508d4 100644
--- a/src/test/java/org/broadinstitute/consent/http/service/UserServiceTest.java
+++ b/src/test/java/org/broadinstitute/consent/http/service/UserServiceTest.java
@@ -362,12 +362,11 @@ void testFindUserById_HasLibraryCards() {
     LibraryCard one = generateLibraryCard(u);
     u.setLibraryCard(one);
     when(userDAO.findUserById(any())).thenReturn(u);
-    when(libraryCardDAO.findLibraryCardByUserId(any())).thenReturn(one);
 
     User user = service.findUserById(u.getUserId());
     assertNotNull(user);
     assertNotNull(user.getLibraryCard());
-    assertSame(one, user.getLibraryCard());
+    assertEquals(one, user.getLibraryCard());
   }
 
   @Test

From 0d3a35e388af616588bd9ca4145773f917292a0e Mon Sep 17 00:00:00 2001
From: rushtong <grushton@broadinstitute.org>
Date: Fri, 23 May 2025 07:24:51 -0400
Subject: [PATCH 10/26] test fix

---
 .../broadinstitute/consent/http/service/UserServiceTest.java  | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/src/test/java/org/broadinstitute/consent/http/service/UserServiceTest.java b/src/test/java/org/broadinstitute/consent/http/service/UserServiceTest.java
index 32179508d4..de07264ca1 100644
--- a/src/test/java/org/broadinstitute/consent/http/service/UserServiceTest.java
+++ b/src/test/java/org/broadinstitute/consent/http/service/UserServiceTest.java
@@ -662,19 +662,19 @@ void testFindUsersWithNoInstitution() {
   @Test
   void testFindUserWithPropertiesAsJsonObjectById() {
     User user = generateUser();
+    user.setLibraryCard(new LibraryCard());
     UserStatusInfo info = new UserStatusInfo().setUserEmail(user.getEmail()).setEnabled(true)
         .setUserSubjectId("subjectId");
     AuthUser authUser = new AuthUser().setEmail(user.getEmail())
         .setAuthToken(randomAlphabetic(30)).setUserStatusInfo(info);
     when(userDAO.findUserById(anyInt())).thenReturn(user);
-    when(libraryCardDAO.findLibraryCardByUserId(anyInt())).thenReturn(new LibraryCard());
     when(userPropertyDAO.findUserPropertiesByUserIdAndPropertyKeys(anyInt(), any())).thenReturn(
         List.of(new UserProperty()));
 
     JsonObject userJson = service.findUserWithPropertiesByIdAsJsonObject(authUser,
         user.getUserId());
     assertNotNull(userJson);
-    assertTrue(userJson.get(UserService.LIBRARY_CARDS_FIELD).getAsJsonArray().isJsonArray());
+    assertTrue(userJson.get(UserService.LIBRARY_CARDS_FIELD).getAsJsonObject().isJsonObject());
     assertTrue(
         userJson.get(UserService.USER_PROPERTIES_FIELD).getAsJsonArray().isJsonArray());
     assertTrue(userJson.get(UserService.USER_STATUS_INFO_FIELD).getAsJsonObject().isJsonObject());

From e62bc4ecad21ade564853862d3f612e4d5cc10b1 Mon Sep 17 00:00:00 2001
From: rushtong <grushton@broadinstitute.org>
Date: Fri, 23 May 2025 07:51:39 -0400
Subject: [PATCH 11/26] enforce in db

---
 src/main/resources/changelog-master.xml                   | 2 ++
 .../changelog-consent-2025-23-unique-lc-user.xml          | 8 ++++++++
 2 files changed, 10 insertions(+)
 create mode 100644 src/main/resources/changesets/changelog-consent-2025-23-unique-lc-user.xml

diff --git a/src/main/resources/changelog-master.xml b/src/main/resources/changelog-master.xml
index d8e39ce834..39db0358d6 100644
--- a/src/main/resources/changelog-master.xml
+++ b/src/main/resources/changelog-master.xml
@@ -180,4 +180,6 @@
     relativeToChangelogFile="true" />
   <include file="changesets/changelog-consent-2025-05-16-disallow-pr-siblings.xml"
     relativeToChangelogFile="true" />
+  <include file="changesets/changelog-consent-2025-23-unique-lc-user.xml"
+    relativeToChangelogFile="true" />
 </databaseChangeLog>
diff --git a/src/main/resources/changesets/changelog-consent-2025-23-unique-lc-user.xml b/src/main/resources/changesets/changelog-consent-2025-23-unique-lc-user.xml
new file mode 100644
index 0000000000..e7def78168
--- /dev/null
+++ b/src/main/resources/changesets/changelog-consent-2025-23-unique-lc-user.xml
@@ -0,0 +1,8 @@
+<databaseChangeLog xmlns="http://www.liquibase.org/xml/ns/dbchangelog"
+  xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:schemaLocation="http://www.liquibase.org/xml/ns/dbchangelog
+         http://www.liquibase.org/xml/ns/dbchangelog/dbchangelog-3.1.xsd">
+  <changeSet id="changelog-consent-2025-23-unique-lc-user" author="grushton">
+    <addUniqueConstraint tableName="library_card" columnNames="user_id"
+                         constraintName="uk_lc_user_id" />
+  </changeSet>
+</databaseChangeLog>

From 31b496f34ff04381cfbb3de4411ca4dea8805e51 Mon Sep 17 00:00:00 2001
From: rushtong <grushton@broadinstitute.org>
Date: Fri, 23 May 2025 07:52:00 -0400
Subject: [PATCH 12/26] swagger model update

---
 src/main/resources/assets/schemas/User.yaml | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/src/main/resources/assets/schemas/User.yaml b/src/main/resources/assets/schemas/User.yaml
index 584114f970..a5dfb8241d 100644
--- a/src/main/resources/assets/schemas/User.yaml
+++ b/src/main/resources/assets/schemas/User.yaml
@@ -22,7 +22,10 @@ properties:
       $ref: './UserRole.yaml'
   properties:
     $ref: './UserProperties.yaml'
+  libraryCard:
+    $ref: './LibraryCard.yaml'
   libraryCards:
+    deprecated: true
     type: array
     items:
       $ref: './LibraryCard.yaml'

From e1b102cb605254fb924be7429164f38bc610c978 Mon Sep 17 00:00:00 2001
From: rushtong <grushton@broadinstitute.org>
Date: Fri, 23 May 2025 07:52:26 -0400
Subject: [PATCH 13/26] populate both for temporary compatibility

---
 .../consent/http/service/UserService.java              | 10 ++++++++--
 .../consent/http/service/UserServiceTest.java          |  6 ++++--
 2 files changed, 12 insertions(+), 4 deletions(-)

diff --git a/src/main/java/org/broadinstitute/consent/http/service/UserService.java b/src/main/java/org/broadinstitute/consent/http/service/UserService.java
index c1a9ea8fb5..f33652f56f 100644
--- a/src/main/java/org/broadinstitute/consent/http/service/UserService.java
+++ b/src/main/java/org/broadinstitute/consent/http/service/UserService.java
@@ -50,7 +50,8 @@
 
 public class UserService implements ConsentLogger {
 
-  public static final String LIBRARY_CARDS_FIELD = "libraryCard";
+  public static final String LIBRARY_CARD_FIELD = "libraryCard";
+  public static final String LIBRARY_CARDS_FIELD = "libraryCards";
   public static final String USER_PROPERTIES_FIELD = "properties";
   public static final String USER_STATUS_INFO_FIELD = "userStatusInfo";
 
@@ -329,7 +330,12 @@ public JsonObject findUserWithPropertiesByIdAsJsonObject(AuthUser authUser, Inte
     JsonObject userJson = gson.toJsonTree(user).getAsJsonObject();
     JsonArray propsJson = gson.toJsonTree(props).getAsJsonArray();
     userJson.add(USER_PROPERTIES_FIELD, propsJson);
-    userJson.add(LIBRARY_CARDS_FIELD, gson.toJsonTree(user.getLibraryCard()));
+    if (user.getLibraryCard() != null) {
+      JsonObject libraryCardJson = gson.toJsonTree(user.getLibraryCard()).getAsJsonObject();
+      userJson.add(LIBRARY_CARD_FIELD, libraryCardJson);
+      // Note that this is provided for backwards compatibility with the UI and will be removed
+      userJson.add(LIBRARY_CARDS_FIELD, gson.toJsonTree(List.of(libraryCardJson)));
+    }
     if (authUser.getEmail().equalsIgnoreCase(user.getEmail()) && Objects.nonNull(
         authUser.getUserStatusInfo())) {
       JsonObject userStatusInfoJson = gson.toJsonTree(authUser.getUserStatusInfo())
diff --git a/src/test/java/org/broadinstitute/consent/http/service/UserServiceTest.java b/src/test/java/org/broadinstitute/consent/http/service/UserServiceTest.java
index de07264ca1..83b703319a 100644
--- a/src/test/java/org/broadinstitute/consent/http/service/UserServiceTest.java
+++ b/src/test/java/org/broadinstitute/consent/http/service/UserServiceTest.java
@@ -674,7 +674,8 @@ void testFindUserWithPropertiesAsJsonObjectById() {
     JsonObject userJson = service.findUserWithPropertiesByIdAsJsonObject(authUser,
         user.getUserId());
     assertNotNull(userJson);
-    assertTrue(userJson.get(UserService.LIBRARY_CARDS_FIELD).getAsJsonObject().isJsonObject());
+    assertTrue(userJson.get(UserService.LIBRARY_CARD_FIELD).getAsJsonObject().isJsonObject());
+    assertTrue(userJson.get(UserService.LIBRARY_CARDS_FIELD).getAsJsonArray().isJsonArray());
     assertTrue(
         userJson.get(UserService.USER_PROPERTIES_FIELD).getAsJsonArray().isJsonArray());
     assertTrue(userJson.get(UserService.USER_STATUS_INFO_FIELD).getAsJsonObject().isJsonObject());
@@ -695,7 +696,8 @@ void testFindUserWithPropertiesAsJsonObjectByIdNonAuthUser() {
     JsonObject userJson = service.findUserWithPropertiesByIdAsJsonObject(authUser,
         user.getUserId());
     assertNotNull(userJson);
-    assertTrue(userJson.get(UserService.LIBRARY_CARDS_FIELD).getAsJsonObject().isJsonObject());
+    assertTrue(userJson.get(UserService.LIBRARY_CARD_FIELD).getAsJsonObject().isJsonObject());
+    assertTrue(userJson.get(UserService.LIBRARY_CARDS_FIELD).getAsJsonArray().isJsonArray());
     assertTrue(
         userJson.get(UserService.USER_PROPERTIES_FIELD).getAsJsonArray().isJsonArray());
     assertNull(userJson.get(UserService.USER_STATUS_INFO_FIELD));

From 0dbb51ea318a26399694ec327222c25e65214d75 Mon Sep 17 00:00:00 2001
From: rushtong <grushton@broadinstitute.org>
Date: Fri, 23 May 2025 08:16:11 -0400
Subject: [PATCH 14/26] fix test for unique violation

---
 .../org/broadinstitute/consent/http/db/LibraryCardDAOTest.java  | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/src/test/java/org/broadinstitute/consent/http/db/LibraryCardDAOTest.java b/src/test/java/org/broadinstitute/consent/http/db/LibraryCardDAOTest.java
index 61f59cb7d2..03965fa2f1 100644
--- a/src/test/java/org/broadinstitute/consent/http/db/LibraryCardDAOTest.java
+++ b/src/test/java/org/broadinstitute/consent/http/db/LibraryCardDAOTest.java
@@ -50,7 +50,7 @@ void testInsertLibraryCardNegative() {
       libraryCardDAO.insertLibraryCard(userId, stringValue, stringValue,
           0, new Date());
     } catch (Exception e) {
-      assertEquals(PSQLState.FOREIGN_KEY_VIOLATION.getState(),
+      assertEquals(PSQLState.UNIQUE_VIOLATION.getState(),
           ((PSQLException) e.getCause()).getSQLState());
     }
   }

From 52715149a03a678e73059da270dd2533a20cc618 Mon Sep 17 00:00:00 2001
From: rushtong <grushton@broadinstitute.org>
Date: Fri, 23 May 2025 08:56:14 -0400
Subject: [PATCH 15/26] new tests for updated user queries

---
 .../consent/http/db/UserDAOTest.java          | 24 +++++++++++++++----
 1 file changed, 19 insertions(+), 5 deletions(-)

diff --git a/src/test/java/org/broadinstitute/consent/http/db/UserDAOTest.java b/src/test/java/org/broadinstitute/consent/http/db/UserDAOTest.java
index 85b76c1160..945c381f57 100644
--- a/src/test/java/org/broadinstitute/consent/http/db/UserDAOTest.java
+++ b/src/test/java/org/broadinstitute/consent/http/db/UserDAOTest.java
@@ -36,7 +36,7 @@
 class UserDAOTest extends DAOTestHelper {
 
   @Test
-  void testFindDACUserById() {
+  void testFindUserById() {
     User user = createUserWithRole(UserRoles.ALUMNI.getRoleId());
     assertNotNull(user);
     assertFalse(user.getRoles().isEmpty());
@@ -64,6 +64,22 @@ void testFindDACUserById() {
     assert (queriedUser3.getInstitution().getId()).equals(user3.getInstitution().getId());
   }
 
+  @Test
+  void testFindUserByIdWithLibraryCard() {
+    LibraryCard libraryCard = createLibraryCard();
+    User user = userDAO.findUserById(libraryCard.getUserId());
+    assertNotNull(user);
+    assertEquals(libraryCard, user.getLibraryCard());
+  }
+
+  @Test
+  void testFindUserByEmailWithLibraryCard() {
+    LibraryCard libraryCard = createLibraryCard();
+    User user = userDAO.findUserByEmail(libraryCard.getUserEmail());
+    assertNotNull(user);
+    assertEquals(libraryCard, user.getLibraryCard());
+  }
+
   @Test
   void testFindUsers_withIdCollection() {
     User user = createUser();
@@ -477,10 +493,8 @@ private void createDatasetProperties(Integer datasetId) {
 
   private LibraryCard createLibraryCard() {
     User user = createUserWithInstitution();
-    Integer userId = user.getUserId();
-    String stringValue = "value";
-    Integer id = libraryCardDAO.insertLibraryCard(userId, stringValue,
-        stringValue, userId, new Date());
+    Integer id = libraryCardDAO.insertLibraryCard(user.getUserId(), user.getDisplayName(),
+        user.getEmail(), user.getUserId(), new Date());
     return libraryCardDAO.findLibraryCardById(id);
   }
 }

From 5490d015e68458f0b989c1e13bd5d44cc4a92958 Mon Sep 17 00:00:00 2001
From: rushtong <grushton@broadinstitute.org>
Date: Fri, 23 May 2025 08:57:28 -0400
Subject: [PATCH 16/26] retain comment for helper method

---
 .../consent/http/db/mapper/UserWithRolesReducer.java             | 1 +
 1 file changed, 1 insertion(+)

diff --git a/src/main/java/org/broadinstitute/consent/http/db/mapper/UserWithRolesReducer.java b/src/main/java/org/broadinstitute/consent/http/db/mapper/UserWithRolesReducer.java
index 78ebdb3f7b..a8684862a9 100644
--- a/src/main/java/org/broadinstitute/consent/http/db/mapper/UserWithRolesReducer.java
+++ b/src/main/java/org/broadinstitute/consent/http/db/mapper/UserWithRolesReducer.java
@@ -74,6 +74,7 @@ public void accumulate(Map<Integer, User> map, RowView rowView) {
     }
   }
 
+  // Some queries look for `user_role_id` while those that use a prefix look for `u_user_role_id`
   private UserRole mapUserRoleFromRowView(RowView rowView, Integer userId) {
     Integer userRoleId;
     Integer roleId;

From 098ee34e2b6932c6faf51332803c27e30f2cc357 Mon Sep 17 00:00:00 2001
From: rushtong <grushton@broadinstitute.org>
Date: Fri, 23 May 2025 09:29:20 -0400
Subject: [PATCH 17/26] rm query only used in test

---
 .../org/broadinstitute/consent/http/db/UserDAO.java | 13 -------------
 .../broadinstitute/consent/http/db/UserDAOTest.java | 10 ----------
 2 files changed, 23 deletions(-)

diff --git a/src/main/java/org/broadinstitute/consent/http/db/UserDAO.java b/src/main/java/org/broadinstitute/consent/http/db/UserDAO.java
index 987e0c1ad3..444d887638 100644
--- a/src/main/java/org/broadinstitute/consent/http/db/UserDAO.java
+++ b/src/main/java/org/broadinstitute/consent/http/db/UserDAO.java
@@ -218,19 +218,6 @@ Integer insertUser(@Bind("email") String email,
   List<User> describeUsersByRoleAndEmailPreference(@Bind("roleName") String roleName,
       @Bind("emailPreference") Boolean emailPreference);
 
-  @RegisterBeanMapper(value = User.class, prefix = "u")
-  @RegisterBeanMapper(value = UserRole.class)
-  @UseRowReducer(UserWithRolesReducer.class)
-  @SqlQuery("SELECT "
-      + User.QUERY_FIELDS_WITH_U_PREFIX + QUERY_FIELD_SEPARATOR
-      + "     ur.user_role_id, ur.user_id, ur.role_id, ur.dac_id, r.name "
-      + " FROM users u "
-      + " LEFT JOIN user_role ur ON ur.user_id = u.user_id "
-      + " LEFT JOIN roles r ON r.role_id = ur.role_id "
-      + " WHERE LOWER(u.email) = LOWER(:email) "
-      + " AND r.role_id = :roleId")
-  User findUserByEmailAndRoleId(@Bind("email") String email, @Bind("roleId") Integer roleId);
-
   @UseRowMapper(UserWithRolesMapper.class)
   @SqlQuery("select du.*, r.role_id, r.name, ur.user_role_id, ur.user_id, ur.role_id, ur.dac_id " +
       " from users du " +
diff --git a/src/test/java/org/broadinstitute/consent/http/db/UserDAOTest.java b/src/test/java/org/broadinstitute/consent/http/db/UserDAOTest.java
index 945c381f57..fd3e1ccc4e 100644
--- a/src/test/java/org/broadinstitute/consent/http/db/UserDAOTest.java
+++ b/src/test/java/org/broadinstitute/consent/http/db/UserDAOTest.java
@@ -272,16 +272,6 @@ void testUpdateDisplayNameInvalidChars() {
         () -> userDAO.updateDisplayName(researcher.getUserId(), newName));
   }
 
-  @Test
-  void testFindUserByEmailAndRoleId() {
-    User chair = createUserWithRole(UserRoles.CHAIRPERSON.getRoleId());
-    User user = userDAO.findUserByEmailAndRoleId(chair.getEmail(),
-        UserRoles.CHAIRPERSON.getRoleId());
-    assertNotNull(user);
-    assertEquals(chair.getUserId(), user.getUserId());
-    assertEquals(chair.getDisplayName(), user.getDisplayName());
-  }
-
   @Test
   void testFindUsersForDatasetsByRole() {
     Dataset dataset = createDataset();

From c1f2a6140ad0675fb9aaf618e21bd5cec0fc1271 Mon Sep 17 00:00:00 2001
From: rushtong <grushton@broadinstitute.org>
Date: Fri, 23 May 2025 10:42:46 -0400
Subject: [PATCH 18/26] delete duplicates

---
 ...angelog-consent-2025-23-unique-lc-user.xml | 29 +++++++++++++++++++
 1 file changed, 29 insertions(+)

diff --git a/src/main/resources/changesets/changelog-consent-2025-23-unique-lc-user.xml b/src/main/resources/changesets/changelog-consent-2025-23-unique-lc-user.xml
index e7def78168..4ccc9da517 100644
--- a/src/main/resources/changesets/changelog-consent-2025-23-unique-lc-user.xml
+++ b/src/main/resources/changesets/changelog-consent-2025-23-unique-lc-user.xml
@@ -2,7 +2,36 @@
   xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:schemaLocation="http://www.liquibase.org/xml/ns/dbchangelog
          http://www.liquibase.org/xml/ns/dbchangelog/dbchangelog-3.1.xsd">
   <changeSet id="changelog-consent-2025-23-unique-lc-user" author="grushton">
+    <sql>
+      -- Remove DAA associations - these are not in use yet and cause FK problems
+      DELETE
+      FROM lc_daa;
+
+      -- Remove duplicate library cards based on user_id
+      DELETE
+      FROM library_card
+      WHERE id IN
+            (SELECT id
+             FROM (SELECT id,
+                          ROW_NUMBER() OVER( PARTITION BY user_id
+        ORDER BY  id ) AS row_num
+                   FROM library_card) t
+             WHERE t.row_num > 1);
+
+      -- Remove duplicate library cards based on user_email
+      DELETE
+      FROM library_card
+      WHERE id IN
+            (SELECT id
+             FROM (SELECT id,
+                          ROW_NUMBER() OVER( PARTITION BY user_email
+        ORDER BY  id ) AS row_num
+                   FROM library_card) t
+             WHERE t.row_num > 1);
+    </sql>
     <addUniqueConstraint tableName="library_card" columnNames="user_id"
                          constraintName="uk_lc_user_id" />
+    <addUniqueConstraint tableName="library_card" columnNames="user_email"
+                         constraintName="uk_lc_user_email" />
   </changeSet>
 </databaseChangeLog>

From 0cecb3bfe983dac0544c7a596536298ac646d3ca Mon Sep 17 00:00:00 2001
From: rushtong <grushton@broadinstitute.org>
Date: Fri, 23 May 2025 10:48:12 -0400
Subject: [PATCH 19/26] fixx test bug

---
 .../consent/http/db/UserDAOTest.java               | 14 +++++++-------
 1 file changed, 7 insertions(+), 7 deletions(-)

diff --git a/src/test/java/org/broadinstitute/consent/http/db/UserDAOTest.java b/src/test/java/org/broadinstitute/consent/http/db/UserDAOTest.java
index fd3e1ccc4e..4dc2b579fc 100644
--- a/src/test/java/org/broadinstitute/consent/http/db/UserDAOTest.java
+++ b/src/test/java/org/broadinstitute/consent/http/db/UserDAOTest.java
@@ -197,8 +197,8 @@ void testFindUserByEmails() {
   @Test
   void testFindUsersWithLCsAndInstitution() {
     User user = createUserWithInstitution();
-    int dacId = dacDAO.createDac(RandomStringUtils.randomAlphabetic(5),
-        RandomStringUtils.randomAlphabetic(5), new Date());
+    int dacId = dacDAO.createDac(randomAlphabetic(5),
+        randomAlphabetic(5), new Date());
     Instant now = Instant.now();
     int daaId = daaDAO.createDaa(user.getUserId(), now, user.getUserId(), now, dacId);
     int lcId1 = libraryCardDAO.insertLibraryCard(user.getUserId(),
@@ -207,7 +207,7 @@ void testFindUsersWithLCsAndInstitution() {
 
     User user2 = createUserWithInstitution();
     int lcId2 = libraryCardDAO.insertLibraryCard(user2.getUserId(),
-        user.getDisplayName(), user.getEmail(), user.getUserId(), new Date());
+        user2.getDisplayName(), user2.getEmail(), user2.getUserId(), new Date());
     libraryCardDAO.createLibraryCardDaaRelation(lcId2, daaId);
 
     List<User> users = userDAO.findUsersWithLCsAndInstitution();
@@ -333,8 +333,8 @@ void testGetSOsByInstitution() {
 
   @Test
   void testGetUsersFromInstitutionWithCards() {
-    int dacId = dacDAO.createDac(RandomStringUtils.randomAlphabetic(5),
-        RandomStringUtils.randomAlphabetic(5), new Date());
+    int dacId = dacDAO.createDac(randomAlphabetic(5),
+        randomAlphabetic(5), new Date());
     Instant now = Instant.now();
     LibraryCard card = createLibraryCard();
     int daaId = daaDAO.createDaa(card.getUserId(), now, card.getUserId(), now, dacId);
@@ -353,8 +353,8 @@ void testGetUsersFromInstitutionWithCards() {
 
   @Test
   void testGetUsersWithCardsByDaaId() {
-    int dacId = dacDAO.createDac(RandomStringUtils.randomAlphabetic(5),
-        RandomStringUtils.randomAlphabetic(5), new Date());
+    int dacId = dacDAO.createDac(randomAlphabetic(5),
+        randomAlphabetic(5), new Date());
     Instant now = Instant.now();
     LibraryCard card = createLibraryCard();
     int daaId = daaDAO.createDaa(card.getUserId(), now, card.getUserId(), now, dacId);

From e8f293bd3f7a28aebd5f8df0ed02243af0e74e10 Mon Sep 17 00:00:00 2001
From: rushtong <grushton@broadinstitute.org>
Date: Fri, 23 May 2025 11:14:36 -0400
Subject: [PATCH 20/26] test updates for unique constraints

---
 .../consent/http/db/LibraryCardDAOTest.java   | 40 +++++++++++++++----
 1 file changed, 32 insertions(+), 8 deletions(-)

diff --git a/src/test/java/org/broadinstitute/consent/http/db/LibraryCardDAOTest.java b/src/test/java/org/broadinstitute/consent/http/db/LibraryCardDAOTest.java
index 03965fa2f1..1093c7b3c9 100644
--- a/src/test/java/org/broadinstitute/consent/http/db/LibraryCardDAOTest.java
+++ b/src/test/java/org/broadinstitute/consent/http/db/LibraryCardDAOTest.java
@@ -4,6 +4,7 @@
 import static org.junit.jupiter.api.Assertions.assertNotNull;
 import static org.junit.jupiter.api.Assertions.assertNull;
 import static org.junit.jupiter.api.Assertions.assertTrue;
+import static org.junit.jupiter.api.Assertions.fail;
 
 import java.time.Instant;
 import java.util.Date;
@@ -29,26 +30,49 @@ void testInsertLibraryCard() {
   }
 
   @Test
-  void testInsertLibraryCardNegative() {
-    Integer userId = createUser().getUserId();
-    String stringValue = "value";
+  void testInsertLibraryCardFKConstraintErrors() {
+    User user = createUser();
+    // Test FK on library_card.user_id
     try {
-      libraryCardDAO.insertLibraryCard(0, stringValue, stringValue,
-          userId, new Date());
+      libraryCardDAO.insertLibraryCard(0, user.getDisplayName(), user.getEmail(),
+          user.getUserId(), new Date());
+      fail("Should have thrown an exception");
     } catch (Exception e) {
       assertEquals(PSQLState.FOREIGN_KEY_VIOLATION.getState(),
           ((PSQLException) e.getCause()).getSQLState());
     }
+    // Test FK on library_card.create_user_id
     try {
-      libraryCardDAO.insertLibraryCard(userId, stringValue, stringValue, userId,
+      libraryCardDAO.insertLibraryCard(user.getUserId(), user.getDisplayName(), user.getEmail(), 0,
           new Date());
+      fail("Should have thrown an exception");
     } catch (Exception e) {
       assertEquals(PSQLState.FOREIGN_KEY_VIOLATION.getState(),
           ((PSQLException) e.getCause()).getSQLState());
     }
+  }
+
+  @Test
+  void testInsertLibraryCardUniqueConstraintErrors() {
+    User user1 = createUser();
+    // Set up LC that will trigger the unique constraints on subsequent inserts
+    libraryCardDAO.insertLibraryCard(user1.getUserId(), user1.getDisplayName(), user1.getEmail(),
+        user1.getUserId(), new Date());
+    // Test Unique on library_card.user_id
+    try {
+      libraryCardDAO.insertLibraryCard(user1.getUserId(), user1.getDisplayName(), user1.getEmail(),
+          user1.getUserId(), new Date());
+      fail("Should have thrown an exception");
+    } catch (Exception e) {
+      assertEquals(PSQLState.UNIQUE_VIOLATION.getState(),
+          ((PSQLException) e.getCause()).getSQLState());
+    }
+    User user2 = createUser();
+    // Test Unique on library_card.user_email - note that we're using the same email as user1
     try {
-      libraryCardDAO.insertLibraryCard(userId, stringValue, stringValue,
-          0, new Date());
+      libraryCardDAO.insertLibraryCard(user2.getUserId(), user2.getDisplayName(), user1.getEmail(),
+          user2.getUserId(), new Date());
+      fail("Should have thrown an exception");
     } catch (Exception e) {
       assertEquals(PSQLState.UNIQUE_VIOLATION.getState(),
           ((PSQLException) e.getCause()).getSQLState());

From e0a9ba5a7ee03a094daecbf41e6f2bd7dafc239a Mon Sep 17 00:00:00 2001
From: rushtong <grushton@broadinstitute.org>
Date: Fri, 23 May 2025 11:40:33 -0400
Subject: [PATCH 21/26] test cleanup

---
 .../consent/http/service/DataAccessRequestServiceTest.java     | 3 ---
 1 file changed, 3 deletions(-)

diff --git a/src/test/java/org/broadinstitute/consent/http/service/DataAccessRequestServiceTest.java b/src/test/java/org/broadinstitute/consent/http/service/DataAccessRequestServiceTest.java
index 93b3deaa18..ac2d779608 100644
--- a/src/test/java/org/broadinstitute/consent/http/service/DataAccessRequestServiceTest.java
+++ b/src/test/java/org/broadinstitute/consent/http/service/DataAccessRequestServiceTest.java
@@ -223,7 +223,6 @@ void testCreateDataAccessRequest_FailsIfNoLibraryCard() {
     dar.setSortDate(new Timestamp(1000));
     dar.setReferenceId("id");
     User user = new User(1, "email@test.org", "Display Name", new Date());
-    user.setLibraryCard(null);
     assertThrows(NIHComplianceRuleException.class,
         () -> service.createDataAccessRequest(user, dar));
   }
@@ -412,7 +411,6 @@ void validateDarNullData() {
   void validateDarNoLibraryCards() {
     DataAccessRequest dar = generateDataAccessRequest();
     User user = new User(1, "email@test.org", "Display Name", new Date());
-    user.setLibraryCard(null);
     assertThrows(NIHComplianceRuleException.class, () -> service.validateDar(user, dar));
   }
 
@@ -464,7 +462,6 @@ void testValidateInternalCollaboratorsNoLibraryCard() {
     User collaboratorUser = new User(2, invalidCollaborator.getEmail(), "Collaborator", new Date(),
         roles);
     collaboratorUser.setInstitutionId(requestingUser.getInstitutionId());
-    collaboratorUser.setLibraryCard(null);
     DataAccessRequest dar = createDataAccessRequest(List.of(invalidCollaborator));
     when(userDAO.findUserByEmail(invalidCollaborator.getEmail())).thenReturn(collaboratorUser);
 

From a03a0f9aff4009b0e98e33fc9d4f1a14fb227b56 Mon Sep 17 00:00:00 2001
From: rushtong <grushton@broadinstitute.org>
Date: Fri, 23 May 2025 11:47:01 -0400
Subject: [PATCH 22/26] method rename; rm duplicate test

---
 .../consent/http/resources/DaaResource.java   |  4 ++--
 .../http/service/LibraryCardService.java      |  3 +--
 .../http/resources/DaaResourceTest.java       |  6 +++---
 .../http/service/LibraryCardServiceTest.java  | 19 +++++--------------
 4 files changed, 11 insertions(+), 21 deletions(-)

diff --git a/src/main/java/org/broadinstitute/consent/http/resources/DaaResource.java b/src/main/java/org/broadinstitute/consent/http/resources/DaaResource.java
index 1c0897886c..61aab0d499 100644
--- a/src/main/java/org/broadinstitute/consent/http/resources/DaaResource.java
+++ b/src/main/java/org/broadinstitute/consent/http/resources/DaaResource.java
@@ -252,7 +252,7 @@ public Response bulkAddUsersToDaa(
       }
       daaService.findById(daaId);
       for (User user : users) {
-        libraryCardService.addDaaToUserLibraryCardByInstitution(user, authedUser, daaId);
+        libraryCardService.addDaaToUserLibraryCard(user, authedUser, daaId);
       }
       return Response.ok().build();
     } catch (Exception e) {
@@ -304,7 +304,7 @@ public Response bulkAddDAAsToUser(
       }
       List<DataAccessAgreement> daaList = daaService.findDAAsInJsonArray(json, "daaList");
       for (DataAccessAgreement daa : daaList) {
-        libraryCardService.addDaaToUserLibraryCardByInstitution(user, authedUser, daa.getDaaId());
+        libraryCardService.addDaaToUserLibraryCard(user, authedUser, daa.getDaaId());
       }
       return Response.ok().build();
     } catch (Exception e) {
diff --git a/src/main/java/org/broadinstitute/consent/http/service/LibraryCardService.java b/src/main/java/org/broadinstitute/consent/http/service/LibraryCardService.java
index cd8b664f5c..88b479fbfd 100644
--- a/src/main/java/org/broadinstitute/consent/http/service/LibraryCardService.java
+++ b/src/main/java/org/broadinstitute/consent/http/service/LibraryCardService.java
@@ -88,7 +88,7 @@ public void removeDaaFromLibraryCard(Integer libraryCardId, Integer daaId) {
     libraryCardDAO.deleteLibraryCardDaaRelation(libraryCardId, daaId);
   }
 
-  public LibraryCard addDaaToUserLibraryCardByInstitution(User user, User signingOfficial, Integer daaId) {
+  public LibraryCard addDaaToUserLibraryCard(User user, User signingOfficial, Integer daaId) {
     if (signingOfficial.getInstitutionId() == null) {
       throw new BadRequestException("This signing official does not have an institution.");
     }
@@ -96,7 +96,6 @@ public LibraryCard addDaaToUserLibraryCardByInstitution(User user, User signingO
     if (libraryCard == null) {
       libraryCard = createLibraryCardForSigningOfficial(user, signingOfficial);
     }
-    // typically there should be one library card per user per institution
     addDaaToLibraryCard(libraryCard.getId(), daaId);
     return libraryCardDAO.findLibraryCardByUserId(user.getUserId());
   }
diff --git a/src/test/java/org/broadinstitute/consent/http/resources/DaaResourceTest.java b/src/test/java/org/broadinstitute/consent/http/resources/DaaResourceTest.java
index d64d0e4a4c..706398a8d1 100644
--- a/src/test/java/org/broadinstitute/consent/http/resources/DaaResourceTest.java
+++ b/src/test/java/org/broadinstitute/consent/http/resources/DaaResourceTest.java
@@ -651,7 +651,7 @@ void testBulkAddUsersToDaa() {
     when(userService.findUserByEmail(any())).thenReturn(authedUser);
     when(userService.findUsersInJsonArray(any(), any())).thenReturn(users);
     when(daaService.findById(daaId)).thenReturn(new DataAccessAgreement());
-    when(libraryCardService.addDaaToUserLibraryCardByInstitution(any(), any(), any())).thenReturn(null);
+    when(libraryCardService.addDaaToUserLibraryCard(any(), any(), any())).thenReturn(null);
 
     resource = new DaaResource(daaService, dacService, userService, libraryCardService);
 
@@ -858,7 +858,7 @@ void testBulkAddDAAsToUserAsSigningOfficial() {
     when(userService.findUserByEmail(any())).thenReturn(authedUser);
     when(userService.findUserById(userId)).thenReturn(researcher);
     when(daaService.findDAAsInJsonArray(any(), any())).thenReturn(agreements);
-    when(libraryCardService.addDaaToUserLibraryCardByInstitution(any(), any(), any())).thenReturn(null);
+    when(libraryCardService.addDaaToUserLibraryCard(any(), any(), any())).thenReturn(null);
 
     resource = new DaaResource(daaService, dacService, userService, libraryCardService);
 
@@ -885,7 +885,7 @@ void testBulkAddDAAsToUserAsAdmin() {
     when(userService.findUserByEmail(any())).thenReturn(authedUser);
     when(userService.findUserById(userId)).thenReturn(researcher);
     when(daaService.findDAAsInJsonArray(any(), any())).thenReturn(agreements);
-    when(libraryCardService.addDaaToUserLibraryCardByInstitution(any(), any(), any())).thenReturn(null);
+    when(libraryCardService.addDaaToUserLibraryCard(any(), any(), any())).thenReturn(null);
 
     resource = new DaaResource(daaService, dacService, userService, libraryCardService);
 
diff --git a/src/test/java/org/broadinstitute/consent/http/service/LibraryCardServiceTest.java b/src/test/java/org/broadinstitute/consent/http/service/LibraryCardServiceTest.java
index 931f505a17..8fcec7fa5d 100644
--- a/src/test/java/org/broadinstitute/consent/http/service/LibraryCardServiceTest.java
+++ b/src/test/java/org/broadinstitute/consent/http/service/LibraryCardServiceTest.java
@@ -367,7 +367,7 @@ void testRemoveDaaFromLibraryCard() {
   }
 
   @Test
-  void testAddDaaToUserLibraryCardByInstitution() {
+  void testAddDaaToUserLibraryCard() {
     User user = testUser(1);
     user.setRoles(List.of(new UserRole(UserRoles.RESEARCHER.getRoleId(), UserRoles.RESEARCHER.getRoleName())));
     User signingOfficial = createUserWithRole(UserRoles.SIGNINGOFFICIAL.getRoleId(), UserRoles.SIGNINGOFFICIAL.getRoleName());
@@ -375,17 +375,17 @@ void testAddDaaToUserLibraryCardByInstitution() {
     Integer userId = user.getUserId();
     when(libraryCardDAO.findLibraryCardByUserId(user.getUserId())).thenReturn(testLibraryCard(userId));
     doNothing().when(libraryCardDAO).createLibraryCardDaaRelation(any(), any());
-    LibraryCard card = service.addDaaToUserLibraryCardByInstitution(user, signingOfficial, 1);
+    LibraryCard card = service.addDaaToUserLibraryCard(user, signingOfficial, 1);
     assertNotNull(card);
   }
 
   @Test
-  void testAddDaaToUserLibraryCardByInstitutionNoMatchingInstitutions() {
+  void testAddDaaToUserLibraryCardNoMatchingInstitutions() {
     User user = testUser(1);
     user.setRoles(List.of(new UserRole(UserRoles.RESEARCHER.getRoleId(), UserRoles.RESEARCHER.getRoleName())));
     User signingOfficial = createUserWithRole(UserRoles.SIGNINGOFFICIAL.getRoleId(), UserRoles.SIGNINGOFFICIAL.getRoleName());
     signingOfficial.setInstitutionId(4);
-    assertThrows(BadRequestException.class, () -> service.addDaaToUserLibraryCardByInstitution(user, signingOfficial, 1));
+    assertThrows(BadRequestException.class, () -> service.addDaaToUserLibraryCard(user, signingOfficial, 1));
   }
 
   @Test
@@ -410,19 +410,10 @@ void testAddDaaToUserLibraryCardWithNoLibraryCards() {
         .thenReturn(1);
     when(libraryCardDAO.findLibraryCardById(anyInt())).thenReturn(new LibraryCard());
 
-    LibraryCard card = service.addDaaToUserLibraryCardByInstitution(user, signingOfficial, 1);
+    LibraryCard card = service.addDaaToUserLibraryCard(user, signingOfficial, 1);
     assertNotNull(card);
   }
 
-  @Test
-  void testAddDaaToUserLibraryCardByInstitutionSigningOfficialNoInstitution() {
-    User user = testUser(1);
-    user.setRoles(List.of(new UserRole(UserRoles.RESEARCHER.getRoleId(), UserRoles.RESEARCHER.getRoleName())));
-    User signingOfficial = new User();
-    signingOfficial.setRoles(List.of(new UserRole(UserRoles.SIGNINGOFFICIAL.getRoleId(), UserRoles.SIGNINGOFFICIAL.getRoleName())));
-    assertThrows(BadRequestException.class, () -> service.addDaaToUserLibraryCardByInstitution(user, signingOfficial, 1));
-  }
-
   @Test
   void testRemoveDaaFromUserLibraryCards() {
     User user = testUser(1);

From 89c17c53cf92d9fb36d7e6da34df95f703a9f024 Mon Sep 17 00:00:00 2001
From: rushtong <grushton@broadinstitute.org>
Date: Fri, 23 May 2025 12:06:48 -0400
Subject: [PATCH 23/26] restrict duplicate email rows to null user ids

---
 .../changesets/changelog-consent-2025-23-unique-lc-user.xml  | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/src/main/resources/changesets/changelog-consent-2025-23-unique-lc-user.xml b/src/main/resources/changesets/changelog-consent-2025-23-unique-lc-user.xml
index 4ccc9da517..e9a473153d 100644
--- a/src/main/resources/changesets/changelog-consent-2025-23-unique-lc-user.xml
+++ b/src/main/resources/changesets/changelog-consent-2025-23-unique-lc-user.xml
@@ -18,7 +18,7 @@
                    FROM library_card) t
              WHERE t.row_num > 1);
 
-      -- Remove duplicate library cards based on user_email
+      -- Remove duplicate library cards based on user_email where user_id is null
       DELETE
       FROM library_card
       WHERE id IN
@@ -26,7 +26,8 @@
              FROM (SELECT id,
                           ROW_NUMBER() OVER( PARTITION BY user_email
         ORDER BY  id ) AS row_num
-                   FROM library_card) t
+                   FROM library_card
+                   WHERE user_id IS NULL) t
              WHERE t.row_num > 1);
     </sql>
     <addUniqueConstraint tableName="library_card" columnNames="user_id"

From beacde087ee9ede32dee0ec08372bc07f8c392c0 Mon Sep 17 00:00:00 2001
From: rushtong <grushton@broadinstitute.org>
Date: Fri, 23 May 2025 13:55:06 -0400
Subject: [PATCH 24/26] further restrict duplicate user id deletes to non-null
 user id rows

---
 .../changesets/changelog-consent-2025-23-unique-lc-user.xml    | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/src/main/resources/changesets/changelog-consent-2025-23-unique-lc-user.xml b/src/main/resources/changesets/changelog-consent-2025-23-unique-lc-user.xml
index e9a473153d..2e68c1cbae 100644
--- a/src/main/resources/changesets/changelog-consent-2025-23-unique-lc-user.xml
+++ b/src/main/resources/changesets/changelog-consent-2025-23-unique-lc-user.xml
@@ -15,7 +15,8 @@
              FROM (SELECT id,
                           ROW_NUMBER() OVER( PARTITION BY user_id
         ORDER BY  id ) AS row_num
-                   FROM library_card) t
+                   FROM library_card
+                   WHERE user_id IS NOT NULL) t
              WHERE t.row_num > 1);
 
       -- Remove duplicate library cards based on user_email where user_id is null

From 6ae6055dacd91677c98173d41eb6a653ae4c5718 Mon Sep 17 00:00:00 2001
From: rushtong <grushton@broadinstitute.org>
Date: Fri, 23 May 2025 15:01:18 -0400
Subject: [PATCH 25/26] copilot feedback

---
 .../org/broadinstitute/consent/http/service/UserService.java  | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/src/main/java/org/broadinstitute/consent/http/service/UserService.java b/src/main/java/org/broadinstitute/consent/http/service/UserService.java
index f33652f56f..32c8f08cd3 100644
--- a/src/main/java/org/broadinstitute/consent/http/service/UserService.java
+++ b/src/main/java/org/broadinstitute/consent/http/service/UserService.java
@@ -181,7 +181,7 @@ public User createUser(User user) {
     Integer userId = userDAO.insertUser(user.getEmail(), user.getDisplayName(),
         user.getInstitutionId(), new Date());
     insertUserRoles(user.getRoles(), userId);
-    addFloatingLibraryCardToUser(user);
+    assignExistingLibraryCardToUser(user);
     return userDAO.findUserById(userId);
   }
 
@@ -372,7 +372,7 @@ public void insertUserRoles(List<UserRole> roles, Integer userId) {
     userRoleDAO.insertUserRoles(roles, userId);
   }
 
-  private void addFloatingLibraryCardToUser(User user) {
+  private void assignExistingLibraryCardToUser(User user) {
     LibraryCard libraryCard = libraryCardDAO.findLibraryCardByUserEmail(user.getEmail());
     if (libraryCard != null) {
       libraryCardDAO.updateLibraryCardById(

From a6f4815b121292915340fd56a777546424e605c3 Mon Sep 17 00:00:00 2001
From: rushtong <grushton@broadinstitute.org>
Date: Fri, 23 May 2025 15:08:00 -0400
Subject: [PATCH 26/26] copilot feedback - update test for clarity

---
 .../consent/http/db/UserDAOTest.java          | 34 ++++++++++---------
 1 file changed, 18 insertions(+), 16 deletions(-)

diff --git a/src/test/java/org/broadinstitute/consent/http/db/UserDAOTest.java b/src/test/java/org/broadinstitute/consent/http/db/UserDAOTest.java
index 4dc2b579fc..ec420b6ba5 100644
--- a/src/test/java/org/broadinstitute/consent/http/db/UserDAOTest.java
+++ b/src/test/java/org/broadinstitute/consent/http/db/UserDAOTest.java
@@ -353,27 +353,29 @@ void testGetUsersFromInstitutionWithCards() {
 
   @Test
   void testGetUsersWithCardsByDaaId() {
-    int dacId = dacDAO.createDac(randomAlphabetic(5),
-        randomAlphabetic(5), new Date());
+    int dacId = dacDAO.createDac(randomAlphabetic(5), randomAlphabetic(5), new Date());
     Instant now = Instant.now();
-    LibraryCard card = createLibraryCard();
-    int daaId = daaDAO.createDaa(card.getUserId(), now, card.getUserId(), now, dacId);
-    libraryCardDAO.createLibraryCardDaaRelation(card.getId(), daaId);
+    LibraryCard card1 = createLibraryCard();
+    int daaId1 = daaDAO.createDaa(card1.getUserId(), now, card1.getUserId(), now, dacId);
+    libraryCardDAO.createLibraryCardDaaRelation(card1.getId(), daaId1);
     LibraryCard card2 = createLibraryCard();
     int daaId2 = daaDAO.createDaa(card2.getUserId(), now, card2.getUserId(), now, dacId);
     libraryCardDAO.createLibraryCardDaaRelation(card2.getId(), daaId2);
-    Integer userId = card.getUserId();
-    List<User> users = userDAO.getUsersWithCardsByDaaId(daaId);
-    List<User> users2 = userDAO.getUsersWithCardsByDaaId(daaId2);
-    assertEquals(1, users.size());
-    assertEquals(1, users2.size());
-    User returnedUser = users.get(0);
 
-    LibraryCard returnedCard = returnedUser.getLibraryCard();
-    assertEquals(card.getId(), returnedCard.getId());
-    assertEquals(returnedCard.getDaaIds(), List.of(daaId));
-    assertEquals(userId, returnedCard.getUserId());
-    assertNotEquals(users, users2);
+    List<User> daa1UserList = userDAO.getUsersWithCardsByDaaId(daaId1);
+    assertEquals(1, daa1UserList.size());
+
+    List<User> daa2UserList = userDAO.getUsersWithCardsByDaaId(daaId2);
+    assertEquals(1, daa2UserList.size());
+    assertNotEquals(daa1UserList, daa2UserList);
+
+    User daa1User = daa1UserList.get(0);
+    assertEquals(card1, daa1User.getLibraryCard());
+    assertEquals(daa1User.getLibraryCard().getDaaIds(), List.of(daaId1));
+
+    User daa2User = daa2UserList.get(0);
+    assertEquals(card2, daa2User.getLibraryCard());
+    assertEquals(daa2User.getLibraryCard().getDaaIds(), List.of(daaId2));
   }
 
   @Test