collavre 0.22.0 → 0.24.0

data/app/services/collavre/creatives/creative_tree_serializer.rb

@@ -0,0 +1,122 @@
+module Collavre
+module Creatives
+  # Serializes a flat collection of creatives into the lightweight JSON payload
+  # consumed by the picker popup (simple mode) and the plain browse list.
+  #
+  # Extracted from CreativesController#index so the controller action stays thin.
+  # Depends only on the acting user and the request params (read-only), never on
+  # view_context, so the whole responsibility lives outside the controller.
+  class CreativeTreeSerializer
+    def initialize(user:, params:)
+      @user = user
+      @params = params
+    end
+
+    def serialize(collection)
+      if params[:simple].present?
+        serialize_simple(collection)
+      else
+        collection.map { |c| { id: c.id, description: c.effective_description, progress: c.progress } }
+      end
+    end
+
+    private
+
+    attr_reader :user, :params
+
+    def serialize_simple(collection)
+      # Preload origins so effective_origin (used per linked-shell row in both
+      # children_presence_set and the origin_id mapping below) resolves from
+      # memory instead of firing a query per shell. Only browse can hold shells;
+      # search is scoped to origin_id: nil, so this is a no-op there.
+      ActiveRecord::Associations::Preloader.new(records: collection.to_a, associations: :origin).call
+      children_ids = children_presence_set(collection)
+      searching = params[:search].present?
+      breadcrumbs = searching ? BreadcrumbResolver.new(collection.map(&:id), user: user, include_archived: params[:show_archived].present?).call : {}
+      # For hits routed through a linked shell, the path to expand in the
+      # user's own tree (local folders -> shell) so a breadcrumb jump can
+      # reach a shell nested under a collapsed folder.
+      reveal_paths = searching ? RevealPathResolver.new(collection.map(&:id), user: user, include_archived: params[:show_archived].present?).call : {}
+      collection.map do |c|
+        item = {
+          id: c.id,
+          description: c.effective_description(nil, false),
+          progress: c.progress,
+          has_children: children_ids.include?(c.id)
+        }
+        reveal = reveal_paths[c.id]
+        path = breadcrumbs[c.id]
+        if path.present?
+          item[:path] = mask_unreachable_crumbs(path, reveal)
+        end
+        item[:reveal_path] = reveal if reveal.present?
+        # For linked shells, expose the effective origin id so the picker can
+        # map a search breadcrumb (origin ids) back to the rendered shell node.
+        item[:origin_id] = c.effective_origin.id if c.origin_id
+        item
+      end
+    end
+
+    # A breadcrumb jump expands the tree from a rendered root (or, for a shared
+    # subtree, a linked shell) down to the clicked crumb. If an ancestor above a
+    # crumb is itself unrenderable (unreadable, or archived while archived rows
+    # aren't shown) and no linked shell re-roots the path at/below it, the
+    # descendant can't be expanded either — so mask it too. BreadcrumbResolver
+    # masks the unrenderable ancestor itself; this masks everything downstream of
+    # it on the plain origin chain, matching exactly what the tree can render.
+    #
+    # `reveal` is RevealPathResolver's per-origin map: a crumb whose origin id is
+    # a key re-roots navigation through its own shell (the client anchors at the
+    # nearest reveal entry at/above the clicked crumb), so it clears the block for
+    # itself and its descendants regardless of an archived/unreadable origin
+    # above it.
+    def mask_unreachable_crumbs(path, reveal)
+      blocked = false
+      path.map do |crumb|
+        if reveal&.key?(crumb[:id])
+          blocked = false
+          crumb
+        elsif crumb[:restricted]
+          blocked = true
+          crumb
+        elsif blocked
+          crumb.merge(restricted: true, description: nil)
+        else
+          crumb
+        end
+      end
+    end
+
+    # Batched "does this node have a child the user can actually browse to?"
+    # lookup so the picker tree renders expand toggles without an N+1.
+    #
+    # Must match exactly what expanding the node shows (IndexQuery#handle_id_query
+    # -> children_with_permission, minus archived unless show_archived), or the
+    # toggle either hides a reachable subtree or opens to an empty branch (and
+    # leaks that hidden children exist). Two alignments are needed:
+    #   1. Linked shells (origin_id set) store children under the effective
+    #      origin (redirect_parent_to_origin + children->origin migration), so
+    #      resolve each row to its effective origin before the lookup.
+    #   2. Apply the same archived + read-permission filters as the browse path.
+    def children_presence_set(collection)
+      return Set.new if collection.empty?
+
+      origin_id_by_id = collection.to_h { |c| [ c.id, c.effective_origin.id ] }
+
+      candidates = Creative.where(parent_id: origin_id_by_id.values.uniq)
+      candidates = candidates.where(archived_at: nil) unless params[:show_archived]
+      child_rows = candidates.pluck(:id, :parent_id) # [child_id, origin_id]
+      return Set.new if child_rows.empty?
+
+      readable = PermissionFilter
+        .new(user: user).readable_ids(child_rows.map(&:first)).to_set
+      origins_with_visible_children = child_rows
+        .each_with_object(Set.new) { |(child_id, origin_id), set| set << origin_id if readable.include?(child_id) }
+
+      collection.each_with_object(Set.new) do |c, set|
+        set << c.id if origins_with_visible_children.include?(origin_id_by_id[c.id])
+      end
+    end
+  end
+end
+end

data/app/services/collavre/creatives/effective_creative_resolution.rb

@@ -0,0 +1,37 @@
+module Collavre
+module Creatives
+  # Single source of truth for "which creative's cache/ownership actually
+  # governs permission for this creative?".
+  #
+  # A linked creative (origin_id present) borrows its origin's permission: it
+  # has no cache entries of its own and its ownership is the origin's ownership.
+  # PermissionChecker (single-item) and PermissionFilter (batch) MUST resolve
+  # the effective creative through this module so a single check and a batch
+  # filter can never diverge for the same user + linked creative.
+  module EffectiveCreativeResolution
+    module_function
+
+    # For a single loaded creative: returns the creative whose cache/ownership
+    # governs permission. Non-linked creatives resolve to themselves.
+    def effective_creative(creative)
+      creative.origin_id.nil? ? creative : creative.origin
+    end
+
+    # For a batch of creative ids: returns { original_id => effective_id }.
+    # Linked creatives map to their origin_id; every other id (including ids
+    # not found in the table) maps to itself. This mirrors
+    # +effective_creative+ so the batch reader resolves origin identically.
+    def effective_creative_ids(ids)
+      # Coerce to Integer: origin_by_id is keyed by integer ids from pluck, so a
+      # string id (e.g. sourced from request params) would miss origin lookup
+      # and later miss the integer-keyed readable Set. Non-numeric ids can't
+      # identify a Creative, so drop them.
+      ids = ids.to_a.filter_map { |id| Integer(id, exception: false) }.uniq
+      return {} if ids.empty?
+
+      origin_by_id = Creative.where(id: ids).pluck(:id, :origin_id).to_h
+      ids.index_with { |id| origin_by_id[id] || id }
+    end
+  end
+end
+end

data/app/services/collavre/creatives/index_query.rb

@@ -10,6 +10,11 @@ module Creatives
     # than its entire match set.
     PERMISSION_FILTER_BATCH = 200
 
+    # Page size for the top-nav "Chats" feed (the comment filter). The list is
+    # unbounded by nature (it grows with every commented creative), so it is
+    # paginated instead of materialized whole.
+    COMMENT_CHATS_PER_PAGE = 30
+
     Result = Struct.new(
       :creatives,
       :parent_creative,
@@ -18,6 +23,7 @@ module Creatives
       :overall_progress,
       :allowed_creative_ids,
       :progress_map,
+      :pagination,
       keyword_init: true
     )
 
@@ -38,7 +44,8 @@ module Creatives
         shared_list: shared_list,
         overall_progress: result[:overall_progress] || 0,
         allowed_creative_ids: result[:allowed_ids],
-        progress_map: result[:progress_map]
+        progress_map: result[:progress_map],
+        pagination: result[:pagination]
       )
     end
 
@@ -83,29 +90,46 @@ module Creatives
 
       result = pipeline.call
 
-      return empty_result if result.matched_ids.empty?
+      # The comment ("Chats") path still returns a pagination object on an empty
+      # match so the client gets consistent metadata; other filters short-circuit.
+      return empty_result if result.matched_ids.empty? && params[:comment] != "true"
 
       # For search/comment filters, return matched items directly (flat results sorted by relevance)
       # Unless search_mode=tree is specified, which returns tree structure instead
       # For other filters (tags, progress), return tree start nodes
       if (params[:search].present? || params[:comment] == "true") && params[:search_mode] != "tree"
-        matched_creatives = Creative.where(id: result.matched_ids.to_a)
-          .order(:sequence)
-          .select { |c| readable?(c) }
+        parent = params[:id] ? Creative.find_by(id: params[:id]) : nil
 
-        # Sort by comment updated_at for comment filter
         if params[:comment] == "true"
-          matched_creatives = matched_creatives.sort_by { |c| c.comments.maximum(:updated_at) || c.updated_at }.reverse
+          # Top-nav "Chats" list: one page of commented creatives, newest chat
+          # first. The matched set is permission-filtered in a single batch and
+          # the recency ordering is computed by the DB (LIMIT/OFFSET over a
+          # grouped MAX(comments.updated_at)), so response cost is a fixed page
+          # regardless of how many chats exist. This replaces an unbounded load
+          # that ran a per-row readable? query and a per-row MAX(updated_at)
+          # aggregate (two N+1s that grew with the chat count).
+          page = comment_chats_page(result.matched_ids)
+          {
+            creatives: page[:creatives],
+            parent: parent,
+            allowed_ids: result.allowed_ids,
+            overall_progress: result.overall_progress,
+            progress_map: result.progress_map,
+            pagination: page[:pagination]
+          }
+        else
+          matched_creatives = Creative.where(id: result.matched_ids.to_a)
+            .order(:sequence)
+            .select { |c| readable?(c) }
+
+          {
+            creatives: matched_creatives,
+            parent: parent,
+            allowed_ids: result.allowed_ids,
+            overall_progress: result.overall_progress,
+            progress_map: result.progress_map
+          }
         end
-
-        parent = params[:id] ? Creative.find_by(id: params[:id]) : nil
-        {
-          creatives: matched_creatives,
-          parent: parent,
-          allowed_ids: result.allowed_ids,
-          overall_progress: result.overall_progress,
-          progress_map: result.progress_map
-        }
       else
         start_nodes = determine_start_nodes(result.allowed_ids)
         parent = params[:id] ? Creative.find_by(id: params[:id]) : nil
@@ -119,6 +143,51 @@ module Creatives
       end
     end
 
+    # One page of the "Chats" feed from the comment-matched id set, ordered by
+    # most-recent comment. Permission filtering is batched (PermissionFilter does
+    # a handful of IN queries, not one per row) and the recency sort + windowing
+    # happen in SQL, so neither cost scales with the total number of chats.
+    def comment_chats_page(matched_ids)
+      per_page = comment_chats_per_page
+      page = comment_chats_page_number
+      offset = (page - 1) * per_page
+
+      readable_ids = PermissionFilter.new(user: user).readable_ids(matched_ids.to_a)
+      return { creatives: [], pagination: pagination_meta(page, false) } if readable_ids.empty?
+
+      # Fetch one extra row to detect whether a further page exists. id is the
+      # tiebreaker so the order is total and stable across page boundaries.
+      page_ids = Creative.where(id: readable_ids)
+        .joins(:comments)
+        .group("creatives.id")
+        .order(Arel.sql("MAX(comments.updated_at) DESC, creatives.id DESC"))
+        .offset(offset)
+        .limit(per_page + 1)
+        .pluck("creatives.id")
+
+      has_more = page_ids.size > per_page
+      page_ids = page_ids.first(per_page)
+
+      by_id = Creative.where(id: page_ids).index_by(&:id)
+      creatives = page_ids.filter_map { |id| by_id[id] }
+
+      { creatives: creatives, pagination: pagination_meta(page, has_more) }
+    end
+
+    def comment_chats_per_page
+      per = params[:per_page].presence&.to_i || COMMENT_CHATS_PER_PAGE
+      per <= 0 || per > 100 ? COMMENT_CHATS_PER_PAGE : per
+    end
+
+    def comment_chats_page_number
+      page = params[:page].presence&.to_i || 1
+      page < 1 ? 1 : page
+    end
+
+    def pagination_meta(page, has_more)
+      { page: page, next_page: has_more ? page + 1 : nil, has_more: has_more }
+    end
+
     def simple_search?
       params[:search].present? && params[:simple].present? &&
         params[:search_mode] != "tree" && params[:comment] != "true"

data/app/services/collavre/creatives/permission_checker.rb

@@ -7,7 +7,7 @@ module Collavre
       end
 
       def allowed?(required_permission = :read)
-        base = creative.origin_id.nil? ? creative : creative.origin
+        base = EffectiveCreativeResolution.effective_creative(creative)
 
         # Owner always has admin permission (fallback for fixtures and missing cache entries)
         return true if base.user_id == user&.id

data/app/services/collavre/creatives/permission_filter.rb

@@ -5,46 +5,173 @@ module Creatives
   # has_children presence check can apply the exact same permission posture as
   # the browse endpoint (children_with_permission) without re-deriving it.
   #
-  # no_access wins over a public share, so user-level denials are subtracted
-  # from the public set. Owned creatives are always readable.
+  # A user-specific cache entry is authoritative over a public share: it grants
+  # only when its own rank meets the requested threshold and otherwise suppresses
+  # the public share (so a no_access — or any below-threshold user entry — wins
+  # over a more permissive public share). Owned creatives are always readable.
   class PermissionFilter
+    # An owner always resolves to admin, the top rank, so it satisfies any
+    # min_permission threshold. This is the canonical owner rank the read-path
+    # callers (TreeBuilder, SlideViewable) inherit via #ranks_for / #readable_ids.
+    OWNER_RANK = CreativeShare.permissions[:admin]
+
     def initialize(user:)
       @user = user
     end
 
-    # Returns the subset of `ids` the user may read, as an Array.
-    def readable_ids(ids)
-      ids = ids.to_a
+    # Returns the subset of `ids` the user may access at `min_permission` or
+    # higher, as an Array. `min_permission:` defaults to `:read`, so the no-arg
+    # form is unchanged; pass `:write` (etc.) to share the one batch filter with
+    # write-posture sites instead of re-deriving the rank comparison.
+    #
+    # Each id is resolved to its effective (origin) creative via the SAME
+    # logic PermissionChecker uses, so a linked creative yields identical
+    # permission whether checked one-by-one or filtered in a batch.
+    def readable_ids(ids, min_permission: :read)
+      # Normalize to Integer so the final select (and owned-shell lookup) compare
+      # against pluck-derived integer ids rather than string inputs; keeps the
+      # canonical batch filter robust to param-sourced ids. Non-numeric ids drop.
+      ids = ids.to_a.filter_map { |id| Integer(id, exception: false) }.uniq
       return [] if ids.empty?
 
+      min_rank = rank_for(min_permission)
+      effective_by_id = EffectiveCreativeResolution.effective_creative_ids(ids)
+      readable_effective = readable_effective_ids(effective_by_id.values.uniq, min_rank)
+
+      # A linked creative borrows its ORIGIN's permission, but the shell row
+      # itself represents a specific PLACEMENT of that link inside a tree.
+      # Returning a shell solely because its origin is readable would leak other
+      # users' private shell placements into search/filter results — a batch can
+      # be fed foreign shells (e.g. FilterPipeline#resolve_ancestors pulls every
+      # Creative.where(origin_id: ...) regardless of owner). So a shell is gated
+      # on the viewer being able to SEE its placement at the requested rank, in
+      # ADDITION to origin readability: either the viewer owns the shell, or the
+      # shell sits in a subtree shared with the viewer AT >= min_permission (a
+      # propagated CreativeSharesCache entry on the shell row itself — e.g. a
+      # public help doc's linked child). The placement is checked at min_rank
+      # (not always :read) because higher-privilege callers share this batch —
+      # children_with_permission(user, :admin), used by DestroyService's
+      # recursive delete, must not reach a shell the viewer only has read on. A
+      # shell in a foreign PRIVATE tree (no viewer entry) stays hidden. Non-shell
+      # ids keep origin-readability-only behaviour.
+      visible_shells = visible_shell_ids(effective_by_id, min_rank)
+
+      ids.select do |id|
+        next false unless readable_effective.include?(effective_by_id[id])
+
+        effective_by_id[id] == id || visible_shells.include?(id)
+      end
+    end
+
+    # Returns { input_id => effective_permission_rank } for the ids the user has
+    # ANY relationship to, mirroring single-item PermissionChecker: owner wins
+    # (admin rank), else the user's own cache entry (INCLUDING a no_access deny,
+    # which is rank 0 and beats a public share), else the public entry. Ids with
+    # no owner/entry/public share are ABSENT from the hash (distinct from rank 0).
+    #
+    # The rank is the raw CreativeShare.permissions integer, so callers compare
+    # `rank >= rank_for(:write)` themselves. Unlike readable_ids this does NOT
+    # apply the shell-ownership anti-leak gate — it is for tree_builder /
+    # slide_viewable which rank creatives already inside the viewer's own tree,
+    # exactly as PermissionChecker#allowed? would resolve them one by one.
+    def ranks_for(ids)
+      ids = ids.to_a.filter_map { |id| Integer(id, exception: false) }.uniq
+      return {} if ids.empty?
+
+      effective_by_id = EffectiveCreativeResolution.effective_creative_ids(ids)
+      effective_ids = effective_by_id.values.uniq
+
+      owner_by_effective = Creative.where(id: effective_ids).pluck(:id, :user_id).to_h
+
+      user_entries = if user
+        CreativeSharesCache.where(creative_id: effective_ids, user_id: user.id)
+          .pluck(:creative_id, :permission).to_h
+      else
+        {}
+      end
+
+      needs_public = effective_ids - user_entries.keys
+      public_entries = if needs_public.any?
+        CreativeSharesCache.where(creative_id: needs_public, user_id: nil)
+          .pluck(:creative_id, :permission).to_h
+      else
+        {}
+      end
+
+      ranks = {}
+      ids.each do |id|
+        effective = effective_by_id[id]
+        if user && owner_by_effective[effective] == user.id
+          ranks[id] = OWNER_RANK
+        else
+          permission = user_entries[effective] || public_entries[effective]
+          ranks[id] = CreativeShare.permissions[permission] if permission
+        end
+      end
+      ranks
+    end
+
+    private
+
+    attr_reader :user
+
+    def rank_for(permission)
+      CreativeShare.permissions.fetch(permission.to_s)
+    end
+
+    # The subset of shell ids (effective != self) whose PLACEMENT the viewer can
+    # see AT `min_rank`: shells the viewer owns, plus shells sitting in a subtree
+    # shared with the viewer at >= min_rank. A shell inside a shared/public tree
+    # inherits a propagated CreativeSharesCache entry keyed on its own id
+    # (PermissionCacheBuilder#propagate_share walks [creative] + descendants,
+    # which includes placed shells), so readability of the shell id itself
+    # captures exactly "the viewer may act on this link here at this rank". The
+    # placement is checked at the caller's min_rank rather than always :read
+    # because higher-privilege callers share this batch — e.g.
+    # children_with_permission(user, :admin) drives DestroyService's recursive
+    # delete, which must not reach a placement the viewer only has read on. A
+    # shell in a foreign private tree has no entry and is excluded, preserving
+    # the anti-leak guarantee against FilterPipeline#resolve_ancestors' owner-
+    # agnostic pull.
+    def visible_shell_ids(effective_by_id, min_rank = rank_for(:read))
+      shell_ids = effective_by_id.filter_map { |id, effective| id if effective != id }
+      return Set.new if shell_ids.empty?
+
+      readable_effective_ids(shell_ids, min_rank)
+    end
+
+    # Returns the subset of already-origin-resolved ids the user may access at
+    # `min_rank` or higher, as a Set. A user-specific entry is authoritative:
+    # it grants only when its own rank meets the threshold and otherwise
+    # suppresses the public share entirely (so a user no_access — or any
+    # below-threshold user entry — wins over a more permissive public share).
+    # Owned creatives are always accessible (owner has admin).
+    def readable_effective_ids(ids, min_rank = rank_for(:read))
+      return Set.new if ids.empty?
+
       accessible_ids = Set.new
 
       if user
-        user_accessible = []
-        user_denied = Set.new
+        user_has_entry = Set.new
         CreativeSharesCache.where(creative_id: ids, user_id: user.id)
           .pluck(:creative_id, :permission).each do |cid, perm|
-            perm == "no_access" ? user_denied << cid : user_accessible << cid
+            user_has_entry << cid
+            accessible_ids << cid if CreativeShare.permissions[perm] >= min_rank
           end
-        accessible_ids.merge(user_accessible)
 
         public_ids = CreativeSharesCache.where(creative_id: ids, user_id: nil)
-          .where.not(permission: :no_access).pluck(:creative_id)
-        accessible_ids.merge(public_ids - user_denied.to_a)
+          .where("permission >= ?", min_rank).pluck(:creative_id)
+        accessible_ids.merge(public_ids.reject { |cid| user_has_entry.include?(cid) })
 
         owned_ids = Creative.where(id: ids, user_id: user.id).pluck(:id)
         accessible_ids.merge(owned_ids)
       else
         accessible_ids = CreativeSharesCache.where(creative_id: ids, user_id: nil)
-          .where.not(permission: :no_access).pluck(:creative_id).to_set
+          .where("permission >= ?", min_rank).pluck(:creative_id).to_set
       end
 
-      accessible_ids.to_a
+      accessible_ids
     end
-
-    private
-
-    attr_reader :user
   end
 end
 end