Replacing a potentially expensive query (#17605)

Prior to this commit, if we didn't have an instance of `Article` we
likely had the class `Article`; we would then run a potentially VERY
expensive query (`SELECT user_id FROM articles;`) to provide an
answer; namely if all of the articles are written by the same user then
yes this user is the author.

With this commit, when you're authorizing the `Article` class, let's
just say "Nope, this user isn't the author".

Closes forem/forem#17604
This commit is contained in:
Jeremy Friesen 2022-05-11 08:17:51 -04:00 committed by GitHub
parent d6c15a3fc6
commit f4d4889a07
No known key found for this signature in database
GPG key ID: 4AEE18F83AFDEB23

View file

@ -200,11 +200,10 @@ class ArticlePolicy < ApplicationPolicy
private
def user_author?
if record.instance_of?(Article)
record.user_id == user.id
else
record.pluck(:user_id).uniq == [user.id]
end
# We might have the Article class (instead of the Article instance), so let's short circuit
return false unless record.respond_to?(:user_id)
record.user_id == user.id
end
def user_org_admin?