## Summary When sending a PUT request to update merge request assignees with duplicate IDs in the `assignee_ids` array, the API silently rejects the update without returning an error. ## Steps to reproduce 1. Send a PUT request to `/api/v4/projects/:id/merge_requests/:mr_iid` with: ```json { "assignee_ids": [123, 456, 123] } ``` ## Current behavior The request returns HTTP 200 with no error message. The assignees are not updated. The duplicate ID is silently ignored. ## Expected behavior The API should either: - Accept the request and deduplicate the IDs automatically, or - Return HTTP 400 with a clear error message explaining that duplicate IDs are not allowed ## Relevant code The issue is in `app/services/merge_requests/update_assignees_service.rb` at line 16: ```ruby return merge_request if new_ids.size != update_attrs[:assignee_ids].size ``` This check compares the size of deduplicated `new_ids` against the input `update_attrs[:assignee_ids]`. If they differ, it returns early without updating or reporting an error. ## Possible fixes 1. **Auto-deduplicate:** Remove the size check and let the deduplicated IDs be applied 2. **Return error:** Add validation to reject requests with duplicate IDs and return HTTP 400 3. **Document behavior:** If silent rejection is intentional, document it clearly in the API docs