collavre 0.20.0 → 0.20.2

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 723a44399902885c80dbfb709086fc0c27e422d767847af131a23b05b56c1efe
-  data.tar.gz: f2530a94041105e5ce4ef63309e630eab2d3f1172a8ccdf223f2782cb5dfcc71
+  metadata.gz: '0294ed9e986fd4e238465f357c6849572439574d448be0ecfaf49962849a77c7'
+  data.tar.gz: d8b98afc357d7033e3688dd795532b62fc2cbc053203585c22fca999544dd421
 SHA512:
-  metadata.gz: 57f023f98547877c0f62ed2dd7d54860577b87602d47f62f53b0009e3e8dc9c5776ed44933bf7214f46970522867d23fa1c3c12719489af2b96dec672a1ebc98
-  data.tar.gz: f4c8f7180925e650bd12df67732aa4a68ac6f1543e24a2deac87a3bbe30dacac769a0a5e3450365c432492d17607b092a87f0c5be935cd4d5ac5446330344906
+  metadata.gz: 8fc88c14930db1637fb547cbc06390d75c9c18b70814646b3c2d35a8fc7503779b8d272c3d45780ce6ff1cd24b36e964a2e7e0f83fd5d24d72d905a08f6c00df
+  data.tar.gz: ffaffdd0c03bef7d6ed95737eff2e765f2612e24a350feddddae91bbd16bdc86651487e43848cdbffb3d31402ce6f4219c2905223c1ebb4cf02f506cbebb6b18

data/app/controllers/collavre/concerns/slide_viewable.rb

@@ -21,16 +21,161 @@ module Collavre
 
       private
 
-      def build_slide_ids(node)
-        return unless node.has_permission?(Current.user, :read)
-
-        @slide_ids << node.id
-        children = node.children.order(:sequence)
-        if node.origin_id.present?
-          linked_children = node.linked_children
-          children = (children + linked_children).uniq.sort_by(&:sequence)
+      # Builds @slide_ids by performing an in-order DFS traversal of the
+      # creative tree rooted at +root+, including any "linked children"
+      # (children of the node's origin when the node is a linked creative).
+      #
+      # Performance: a naive recursion issues one query per node for both
+      # +children+ and +linked_children+ (O(N) queries for an N-node tree).
+      # This implementation walks the tree level-by-level via batched queries,
+      # so total DB round-trips scale with tree depth rather than node count.
+      def build_slide_ids(root)
+        user = Current.user
+        return unless root.has_permission?(user, :read)
+
+        children_by_parent = {}
+        permission_cache = { root.id => true }
+
+        # BFS over the creative tree, batching DB lookups one level at a time.
+        # Only nodes the user may read are expanded, matching the original
+        # recursion which short-circuits on permission denial.
+        frontier = [ root ]
+        until frontier.empty?
+          # 1) Load own children for every node in the current level in one query.
+          parent_ids = frontier.map(&:id)
+          own_children_by_parent = Creative
+            .where(parent_id: parent_ids)
+            .order(:sequence)
+            .group_by(&:parent_id)
+
+          # 2) For nodes with an origin, load linked children (origin's children
+          #    visible to the user) in a single batched query.
+          linked_nodes = frontier.select { |n| n.origin_id.present? }
+          linked_children_by_node = preload_linked_children(linked_nodes, user)
+
+          next_frontier = []
+          frontier.each do |node|
+            own = own_children_by_parent[node.id] || []
+            merged = if node.origin_id.present?
+              linked = linked_children_by_node[node.id] || []
+              (own + linked).uniq.sort_by(&:sequence)
+            else
+              own
+            end
+            children_by_parent[node.id] = merged
+            next_frontier.concat(merged)
+          end
+
+          # 3) Bulk permission check for the next level (uniqued by id).
+          next_unique = next_frontier.uniq(&:id)
+          uncached = next_unique.reject { |c| permission_cache.key?(c.id) }
+          uncached.each do |child|
+            permission_cache[child.id] = child.has_permission?(user, :read)
+          end
+
+          # Only descend into permitted nodes — matches the recursive version's
+          # short-circuit. Iterating in node order keeps duplicates collapsed
+          # while preserving discovery order.
+          frontier = next_unique.select { |c| permission_cache[c.id] }
         end
-        children.each { |child| build_slide_ids(child) }
+
+        # 4) DFS in memory using the prebuilt maps to populate @slide_ids in
+        #    the same order the recursive version would have produced.
+        stack = [ root ]
+        until stack.empty?
+          node = stack.pop
+          next unless permission_cache[node.id]
+
+          @slide_ids << node.id
+          children = children_by_parent[node.id] || []
+          # Push in reverse so DFS visits in ascending sequence order.
+          children.reverse_each { |child| stack.push(child) }
+        end
+      end
+
+      # Returns a hash of +node.id => Array(linked_children)+ for the given
+      # nodes (each of which must have +origin_id+ present). Equivalent in
+      # result to calling +node.linked_children+ on each node, but executes a
+      # bounded number of queries regardless of how many nodes are passed in.
+      def preload_linked_children(nodes, user)
+        return {} if nodes.empty?
+
+        # Resolve each node's effective origin (follows linked chains).
+        # effective_origin walks the chain by reading the origin association;
+        # repeated calls within a request hit ActiveRecord's identity per
+        # instance, so this is bounded by the linked-chain depth.
+        origin_for_node = {}
+        nodes.each do |node|
+          origin = node.effective_origin(Set.new)
+          origin_for_node[node.id] = origin if origin
+        end
+
+        unique_origin_ids = origin_for_node.values.map(&:id).uniq
+        return {} if unique_origin_ids.empty?
+
+        # Single batched query for all candidate children across all origins.
+        candidate_children = Creative
+          .where(parent_id: unique_origin_ids)
+          .order(:sequence)
+          .to_a
+        candidates_by_origin = candidate_children.group_by(&:parent_id)
+        candidate_ids = candidate_children.map(&:id)
+
+        accessible_ids = accessible_child_ids(candidate_ids, candidate_children, user)
+
+        result = {}
+        nodes.each do |node|
+          origin = origin_for_node[node.id]
+          next unless origin
+
+          children = candidates_by_origin[origin.id] || []
+          result[node.id] = children.select { |c| accessible_ids.include?(c.id) }
+        end
+        result
+      end
+
+      # Mirrors the access check in Creative#children_with_permission, but
+      # operates on a pre-fetched set of candidate children so the work
+      # collapses to a fixed number of queries instead of one per parent.
+      def accessible_child_ids(candidate_ids, candidate_children, user)
+        return Set.new if candidate_ids.empty?
+
+        min_rank = CreativeShare.permissions["read"]
+        accessible = Set.new
+
+        if user
+          user_entries = CreativeSharesCache
+            .where(creative_id: candidate_ids, user_id: user.id)
+            .pluck(:creative_id, :permission)
+
+          user_has_entry = Set.new
+          user_entries.each do |cid, perm|
+            user_has_entry << cid
+            perm_rank = CreativeSharesCache.permissions[perm]
+            if perm_rank && perm_rank >= min_rank && perm_rank != CreativeSharesCache.permissions[:no_access]
+              accessible << cid
+            end
+          end
+
+          public_accessible = CreativeSharesCache
+            .where(creative_id: candidate_ids, user_id: nil)
+            .where("permission >= ?", min_rank)
+            .where.not(permission: :no_access)
+            .pluck(:creative_id)
+          accessible.merge(public_accessible.reject { |cid| user_has_entry.include?(cid) })
+
+          owned_ids = candidate_children.select { |c| c.user_id == user.id }.map(&:id)
+          accessible.merge(owned_ids)
+        else
+          public_accessible = CreativeSharesCache
+            .where(creative_id: candidate_ids, user_id: nil)
+            .where("permission >= ?", min_rank)
+            .where.not(permission: :no_access)
+            .pluck(:creative_id)
+          accessible.merge(public_accessible)
+        end
+
+        accessible
       end
     end
   end

data/app/controllers/collavre/creative_invitations_controller.rb

@@ -3,7 +3,6 @@
 module Collavre
   class CreativeInvitationsController < ApplicationController
     before_action :set_invitation
-    before_action :authorize_admin!
 
     def update
       if @invitation.update(permission: params[:permission])
@@ -29,18 +28,16 @@ module Collavre
 
     private
 
+    # Scoped lookup: only returns the invitation if Current.user has admin
+    # permission on its creative. Raises ActiveRecord::RecordNotFound otherwise
+    # so that record existence is not leaked to unauthorized users.
     def set_invitation
-      @invitation = Invitation.find(params[:id])
-      @creative = @invitation.creative
-    end
-
-    def authorize_admin!
-      return if @creative.has_permission?(Current.user, :admin)
+      invitation = Invitation.find_by(id: params[:id])
+      creative = invitation&.creative
+      raise ActiveRecord::RecordNotFound unless creative&.has_permission?(Current.user, :admin)
 
-      respond_to do |format|
-        format.html { redirect_back fallback_location: main_app.root_path, alert: t("collavre.creatives.errors.no_permission") }
-        format.json { render json: { error: t("collavre.creatives.errors.no_permission") }, status: :forbidden }
-      end
+      @invitation = invitation
+      @creative = creative
     end
   end
 end

data/app/controllers/collavre/creative_shares_controller.rb

@@ -107,14 +107,7 @@ module Collavre
     end
 
     def update
-      @creative_share = CreativeShare.find(params[:id])
-      unless @creative_share.creative.has_permission?(Current.user, :admin)
-        respond_to do |format|
-          format.html { redirect_back fallback_location: main_app.root_path, alert: t("collavre.creatives.errors.no_permission") }
-          format.json { render json: { error: t("collavre.creatives.errors.no_permission") }, status: :forbidden }
-        end
-        return
-      end
+      @creative_share = find_admin_creative_share(params[:id])
 
       if @creative_share.update(permission: params[:permission])
         respond_to do |format|
@@ -130,14 +123,7 @@ module Collavre
     end
 
     def destroy
-      @creative_share = CreativeShare.find(params[:id])
-      unless @creative_share.creative.has_permission?(Current.user, :admin)
-        respond_to do |format|
-          format.html { redirect_back fallback_location: main_app.root_path, alert: t("collavre.creatives.errors.no_permission") }
-          format.json { render json: { error: t("collavre.creatives.errors.no_permission") }, status: :forbidden }
-        end
-        return
-      end
+      @creative_share = find_admin_creative_share(params[:id])
 
       @creative_share.destroy
       # remove linked creative if it exists
@@ -151,6 +137,16 @@ module Collavre
 
     private
 
+      # Scoped lookup: only returns the share if Current.user has admin permission
+      # on its creative. Raises ActiveRecord::RecordNotFound otherwise so that
+      # record existence is not leaked via 403 vs 404 distinction.
+      def find_admin_creative_share(id)
+        share = CreativeShare.find_by(id: id)
+        raise ActiveRecord::RecordNotFound unless share&.creative&.has_permission?(Current.user, :admin)
+
+        share
+      end
+
       def all_descendants(creative)
         creative.children.flat_map { |child| [ child ] + all_descendants(child) }
       end

data/db/migrate/20260415094811_add_task_id_to_comments.rb

@@ -0,0 +1,6 @@
+class AddTaskIdToComments < ActiveRecord::Migration[8.1]
+  def change
+    add_column :comments, :task_id, :integer
+    add_index :comments, :task_id
+  end
+end

data/lib/collavre/version.rb

@@ -1,3 +1,3 @@
 module Collavre
-  VERSION = "0.20.0"
+  VERSION = "0.20.2"
 end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: collavre
 version: !ruby/object:Gem::Version
-  version: 0.20.0
+  version: 0.20.2
 platform: ruby
 authors:
 - Collavre
@@ -708,6 +708,7 @@ files:
 - db/migrate/20260401120000_remove_emoji_prefix_from_inbox_creatives.rb
 - db/migrate/20260409000000_add_source_topic_id_to_topics.rb
 - db/migrate/20260415000000_create_main_topics_for_existing_creatives.rb
+- db/migrate/20260415094811_add_task_id_to_comments.rb
 - lib/collavre.rb
 - lib/collavre/configuration.rb
 - lib/collavre/engine.rb