From ca89fbcec30810e4c4bd6409700676048edbee07 Mon Sep 17 00:00:00 2001
From: Joshua Wehner <joshua@forem.com>
Date: Mon, 3 Apr 2023 14:45:00 +0200
Subject: [PATCH] Clear trusted cache in rolify callback (#19275)

---
 app/models/user.rb                                  | 8 +++++++-
 app/policies/authorizer.rb                          | 4 ++++
 app/services/moderator/manage_activity_and_roles.rb | 6 ------
 app/services/tag_moderators/add_trusted_role.rb     | 1 -
 4 files changed, 11 insertions(+), 8 deletions(-)

diff --git a/app/models/user.rb b/app/models/user.rb
index f566ba8ff..bc22e25e2 100644
--- a/app/models/user.rb
+++ b/app/models/user.rb
@@ -1,6 +1,6 @@
 class User < ApplicationRecord
   resourcify
-  rolify
+  rolify after_add: :update_user_roles_cache, after_remove: :update_user_roles_cache
 
   include CloudinaryHelper
 
@@ -633,4 +633,10 @@ class User < ApplicationRecord
   def confirmation_required?
     ForemInstance.smtp_enabled?
   end
+
+  def update_user_roles_cache(...)
+    authorizer.clear_cache
+    Rails.cache.delete("user-#{id}/has_trusted_role")
+    trusted?
+  end
 end
diff --git a/app/policies/authorizer.rb b/app/policies/authorizer.rb
index d0f909503..5c6e0281d 100644
--- a/app/policies/authorizer.rb
+++ b/app/policies/authorizer.rb
@@ -165,6 +165,10 @@ module Authorizer
       has_any_role?(:workshop_pass)
     end
 
+    def clear_cache
+      remove_instance_variable(:@trusted) if defined? @trusted
+    end
+
     private
 
     def has_role?(*args)
diff --git a/app/services/moderator/manage_activity_and_roles.rb b/app/services/moderator/manage_activity_and_roles.rb
index bd50e119b..4058d3ea0 100644
--- a/app/services/moderator/manage_activity_and_roles.rb
+++ b/app/services/moderator/manage_activity_and_roles.rb
@@ -133,14 +133,8 @@ module Moderator
       user.remove_role(:comment_suspended) if user.comment_suspended?
     end
 
-    def update_trusted_cache
-      Rails.cache.delete("user-#{@user.id}/has_trusted_role")
-      @user.trusted?
-    end
-
     def update_roles
       handle_user_status(user_params[:user_status], user_params[:note_for_current_role])
-      update_trusted_cache
     end
   end
 end
diff --git a/app/services/tag_moderators/add_trusted_role.rb b/app/services/tag_moderators/add_trusted_role.rb
index 59a9f1fa6..02bfd541f 100644
--- a/app/services/tag_moderators/add_trusted_role.rb
+++ b/app/services/tag_moderators/add_trusted_role.rb
@@ -5,7 +5,6 @@ module TagModerators
 
       user.add_role(:trusted)
       user.notification_setting.update(email_community_mod_newsletter: true)
-      Rails.cache.delete("user-#{user.id}/has_trusted_role")
       NotifyMailer.with(user: user).trusted_role_email.deliver_now
       return unless community_mod_newsletter_enabled?