Pull Request resolves #46832 .

• I read the Generative AI policy and my contribution is either not created with the help of AI or is compatible with the policy and GNU/GPL 2 or later.

Summary of Changes

Validates the rules field in the Users Access Levels API to ensure only existing user group IDs are accepted. Previously, invalid values were silently stored

Testing Instructions

follow #46832

Actual result BEFORE applying this Pull Request

Invalid values were accepted and written to the database, for eg invalid { "rules": [99999] } gets 200 ok
{
"links": {
"self": "http://localhost/joomla-cms/api/index.php/v1/users/levels/7"
},
"data": {
"type": "levels",
"id": "7",
"attributes": {
"id": 7,
"title": "API Test Level",
"rules": [
99999
]
}
}
}

Expected result AFTER applying this Pull Request

Invalid input is rejected with a validation error and only valid existing group ids are accepted, and the database remains consistent, for eg invalid invalid { "rules": [99999] } gets 400 bad request,
{
"errors": [
{
"title": "Invalid Group"
}
]
}

Link to documentations

Please select:

• Documentation link for guide.joomla.org:

• No documentation changes for guide.joomla.org needed

• Pull Request link for manual.joomla.org:

• No documentation changes for manual.joomla.org needed