collavre 0.20.1 → 0.20.3

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 85ccc8b054af6b7b505ec32e773367299bc72d4cc3dd0d13fc345048b358470b
-  data.tar.gz: 1ebb968d3a1db4f5fe72bb67afca30154d705a0c0e682cbc2aea1a830e092c4f
+  metadata.gz: 9faf02fa6fe0e0512402d22782e9341e8d78b906c0220961f19758f55cb18251
+  data.tar.gz: a87e2eea061fa0a5b527084196a34713d837b793d5e7fab4c87333be804cafb8
 SHA512:
-  metadata.gz: a6a9b9f7068b3f9f14eb680ee758e35031fef2e406994b462ce0ca22609bb59a6f96d956d51c0e28041f9ee46205a4b8360145fba434942103b819d50e63e9f2
-  data.tar.gz: 6354dc440494f9f7c1753de7909ce7d04ec24dc7d2d9557f0180dfdd09deaa6171af0c1c96e9d5abb21a4164c55ab7e3efa0293e3a4d6a280c54e479b6ed8cdd
+  metadata.gz: fdcf64acf4b287d3fef53472b172601aaea44f0dccdb137d9db271c91402a52adf0a518fd654f8fffd3398da331d3eedd9efd421f6b60138ed0bd6c538abdf60
+  data.tar.gz: a1c6330363dea5703eeee7f23039c9a4d58f8300a29d586d709b14f50e37bf46ac34a0a20546dff4009c2ebf1ea84a3172d6d48f528407609a5354aeb896b02d

data/app/controllers/collavre/concerns/slide_viewable.rb

@@ -21,16 +21,161 @@ module Collavre
 
       private
 
-      def build_slide_ids(node)
-        return unless node.has_permission?(Current.user, :read)
-
-        @slide_ids << node.id
-        children = node.children.order(:sequence)
-        if node.origin_id.present?
-          linked_children = node.linked_children
-          children = (children + linked_children).uniq.sort_by(&:sequence)
+      # Builds @slide_ids by performing an in-order DFS traversal of the
+      # creative tree rooted at +root+, including any "linked children"
+      # (children of the node's origin when the node is a linked creative).
+      #
+      # Performance: a naive recursion issues one query per node for both
+      # +children+ and +linked_children+ (O(N) queries for an N-node tree).
+      # This implementation walks the tree level-by-level via batched queries,
+      # so total DB round-trips scale with tree depth rather than node count.
+      def build_slide_ids(root)
+        user = Current.user
+        return unless root.has_permission?(user, :read)
+
+        children_by_parent = {}
+        permission_cache = { root.id => true }
+
+        # BFS over the creative tree, batching DB lookups one level at a time.
+        # Only nodes the user may read are expanded, matching the original
+        # recursion which short-circuits on permission denial.
+        frontier = [ root ]
+        until frontier.empty?
+          # 1) Load own children for every node in the current level in one query.
+          parent_ids = frontier.map(&:id)
+          own_children_by_parent = Creative
+            .where(parent_id: parent_ids)
+            .order(:sequence)
+            .group_by(&:parent_id)
+
+          # 2) For nodes with an origin, load linked children (origin's children
+          #    visible to the user) in a single batched query.
+          linked_nodes = frontier.select { |n| n.origin_id.present? }
+          linked_children_by_node = preload_linked_children(linked_nodes, user)
+
+          next_frontier = []
+          frontier.each do |node|
+            own = own_children_by_parent[node.id] || []
+            merged = if node.origin_id.present?
+              linked = linked_children_by_node[node.id] || []
+              (own + linked).uniq.sort_by(&:sequence)
+            else
+              own
+            end
+            children_by_parent[node.id] = merged
+            next_frontier.concat(merged)
+          end
+
+          # 3) Bulk permission check for the next level (uniqued by id).
+          next_unique = next_frontier.uniq(&:id)
+          uncached = next_unique.reject { |c| permission_cache.key?(c.id) }
+          uncached.each do |child|
+            permission_cache[child.id] = child.has_permission?(user, :read)
+          end
+
+          # Only descend into permitted nodes — matches the recursive version's
+          # short-circuit. Iterating in node order keeps duplicates collapsed
+          # while preserving discovery order.
+          frontier = next_unique.select { |c| permission_cache[c.id] }
         end
-        children.each { |child| build_slide_ids(child) }
+
+        # 4) DFS in memory using the prebuilt maps to populate @slide_ids in
+        #    the same order the recursive version would have produced.
+        stack = [ root ]
+        until stack.empty?
+          node = stack.pop
+          next unless permission_cache[node.id]
+
+          @slide_ids << node.id
+          children = children_by_parent[node.id] || []
+          # Push in reverse so DFS visits in ascending sequence order.
+          children.reverse_each { |child| stack.push(child) }
+        end
+      end
+
+      # Returns a hash of +node.id => Array(linked_children)+ for the given
+      # nodes (each of which must have +origin_id+ present). Equivalent in
+      # result to calling +node.linked_children+ on each node, but executes a
+      # bounded number of queries regardless of how many nodes are passed in.
+      def preload_linked_children(nodes, user)
+        return {} if nodes.empty?
+
+        # Resolve each node's effective origin (follows linked chains).
+        # effective_origin walks the chain by reading the origin association;
+        # repeated calls within a request hit ActiveRecord's identity per
+        # instance, so this is bounded by the linked-chain depth.
+        origin_for_node = {}
+        nodes.each do |node|
+          origin = node.effective_origin(Set.new)
+          origin_for_node[node.id] = origin if origin
+        end
+
+        unique_origin_ids = origin_for_node.values.map(&:id).uniq
+        return {} if unique_origin_ids.empty?
+
+        # Single batched query for all candidate children across all origins.
+        candidate_children = Creative
+          .where(parent_id: unique_origin_ids)
+          .order(:sequence)
+          .to_a
+        candidates_by_origin = candidate_children.group_by(&:parent_id)
+        candidate_ids = candidate_children.map(&:id)
+
+        accessible_ids = accessible_child_ids(candidate_ids, candidate_children, user)
+
+        result = {}
+        nodes.each do |node|
+          origin = origin_for_node[node.id]
+          next unless origin
+
+          children = candidates_by_origin[origin.id] || []
+          result[node.id] = children.select { |c| accessible_ids.include?(c.id) }
+        end
+        result
+      end
+
+      # Mirrors the access check in Creative#children_with_permission, but
+      # operates on a pre-fetched set of candidate children so the work
+      # collapses to a fixed number of queries instead of one per parent.
+      def accessible_child_ids(candidate_ids, candidate_children, user)
+        return Set.new if candidate_ids.empty?
+
+        min_rank = CreativeShare.permissions["read"]
+        accessible = Set.new
+
+        if user
+          user_entries = CreativeSharesCache
+            .where(creative_id: candidate_ids, user_id: user.id)
+            .pluck(:creative_id, :permission)
+
+          user_has_entry = Set.new
+          user_entries.each do |cid, perm|
+            user_has_entry << cid
+            perm_rank = CreativeSharesCache.permissions[perm]
+            if perm_rank && perm_rank >= min_rank && perm_rank != CreativeSharesCache.permissions[:no_access]
+              accessible << cid
+            end
+          end
+
+          public_accessible = CreativeSharesCache
+            .where(creative_id: candidate_ids, user_id: nil)
+            .where("permission >= ?", min_rank)
+            .where.not(permission: :no_access)
+            .pluck(:creative_id)
+          accessible.merge(public_accessible.reject { |cid| user_has_entry.include?(cid) })
+
+          owned_ids = candidate_children.select { |c| c.user_id == user.id }.map(&:id)
+          accessible.merge(owned_ids)
+        else
+          public_accessible = CreativeSharesCache
+            .where(creative_id: candidate_ids, user_id: nil)
+            .where("permission >= ?", min_rank)
+            .where.not(permission: :no_access)
+            .pluck(:creative_id)
+          accessible.merge(public_accessible)
+        end
+
+        accessible
       end
     end
   end

data/app/controllers/collavre/creative_invitations_controller.rb

@@ -3,7 +3,6 @@
 module Collavre
   class CreativeInvitationsController < ApplicationController
     before_action :set_invitation
-    before_action :authorize_admin!
 
     def update
       if @invitation.update(permission: params[:permission])
@@ -29,18 +28,16 @@ module Collavre
 
     private
 
+    # Scoped lookup: only returns the invitation if Current.user has admin
+    # permission on its creative. Raises ActiveRecord::RecordNotFound otherwise
+    # so that record existence is not leaked to unauthorized users.
     def set_invitation
-      @invitation = Invitation.find(params[:id])
-      @creative = @invitation.creative
-    end
-
-    def authorize_admin!
-      return if @creative.has_permission?(Current.user, :admin)
+      invitation = Invitation.find_by(id: params[:id])
+      creative = invitation&.creative
+      raise ActiveRecord::RecordNotFound unless creative&.has_permission?(Current.user, :admin)
 
-      respond_to do |format|
-        format.html { redirect_back fallback_location: main_app.root_path, alert: t("collavre.creatives.errors.no_permission") }
-        format.json { render json: { error: t("collavre.creatives.errors.no_permission") }, status: :forbidden }
-      end
+      @invitation = invitation
+      @creative = creative
     end
   end
 end

data/app/controllers/collavre/creative_shares_controller.rb

@@ -107,14 +107,7 @@ module Collavre
     end
 
     def update
-      @creative_share = CreativeShare.find(params[:id])
-      unless @creative_share.creative.has_permission?(Current.user, :admin)
-        respond_to do |format|
-          format.html { redirect_back fallback_location: main_app.root_path, alert: t("collavre.creatives.errors.no_permission") }
-          format.json { render json: { error: t("collavre.creatives.errors.no_permission") }, status: :forbidden }
-        end
-        return
-      end
+      @creative_share = find_admin_creative_share(params[:id])
 
       if @creative_share.update(permission: params[:permission])
         respond_to do |format|
@@ -130,14 +123,7 @@ module Collavre
     end
 
     def destroy
-      @creative_share = CreativeShare.find(params[:id])
-      unless @creative_share.creative.has_permission?(Current.user, :admin)
-        respond_to do |format|
-          format.html { redirect_back fallback_location: main_app.root_path, alert: t("collavre.creatives.errors.no_permission") }
-          format.json { render json: { error: t("collavre.creatives.errors.no_permission") }, status: :forbidden }
-        end
-        return
-      end
+      @creative_share = find_admin_creative_share(params[:id])
 
       @creative_share.destroy
       # remove linked creative if it exists
@@ -151,6 +137,16 @@ module Collavre
 
     private
 
+      # Scoped lookup: only returns the share if Current.user has admin permission
+      # on its creative. Raises ActiveRecord::RecordNotFound otherwise so that
+      # record existence is not leaked via 403 vs 404 distinction.
+      def find_admin_creative_share(id)
+        share = CreativeShare.find_by(id: id)
+        raise ActiveRecord::RecordNotFound unless share&.creative&.has_permission?(Current.user, :admin)
+
+        share
+      end
+
       def all_descendants(creative)
         creative.children.flat_map { |child| [ child ] + all_descendants(child) }
       end

data/app/controllers/collavre/passwords_controller.rb

@@ -20,6 +20,7 @@ module Collavre
 
     def update
       if @user.update(params.permit(:password, :password_confirmation))
+        @user.update_column(:email_verified_at, Time.current) unless @user.email_verified?
         redirect_to new_session_path, notice: "Password has been reset."
       else
         redirect_to edit_password_path(params[:token]), alert: "Passwords did not match."

data/lib/collavre/version.rb

@@ -1,3 +1,3 @@
 module Collavre
-  VERSION = "0.20.1"
+  VERSION = "0.20.3"
 end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: collavre
 version: !ruby/object:Gem::Version
-  version: 0.20.1
+  version: 0.20.3
 platform: ruby
 authors:
 - Collavre