forest_liana 9.22.11 → 9.22.12

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 345a74b2a7088f0c84717c3023f50fef3c0918db97d392e936047abfb57a3b48
-  data.tar.gz: 9abe4f90a54bddf3df9cf4cd73db258ef60962ec9bf5353904dd916676b15aac
+  metadata.gz: e9584149ffb7d20be9b8f4dacd36f5bf1d95c5276b1b34f35d86e750e0f696f2
+  data.tar.gz: 2d24e798d72ec62aabec3ebe9fdb070f857c8e511b02d4bbe8e8ce1880e03032
 SHA512:
-  metadata.gz: 1f096e618b492ecea05c88063f3deb647a8928deaf524c95b35572061db3c7094c34484c492134dfdcf18d52f0897d7fa9d9f1a645ff419cfbb18489681532c0
-  data.tar.gz: 2d818ad0f0e90d95f5574643a2b50d94615ec0f5601b9e10d8477f250ddd6e0ab9c34f6a23d0d9e470f69dbb76861fddf99b26a45b20449262a0251b08eaada6
+  metadata.gz: 87d06d138209e8ca03019c971e0aa24e0c55bb8f71f03df225cf8de312f2fcb7dbac04cd398308c8a2768f7226b9c36e06ccdbed6d63225a5abe5a0bc26cc448
+  data.tar.gz: 31a54daccf9d158680b28d5747f35a467943f94a779448f812f43dfe8f84ba9cd921297dc930a958d7b6bd1660f8d3becd15abb50480db9c516d8b7a21e98508

data/app/controllers/forest_liana/application_controller.rb

@@ -27,6 +27,8 @@ module ForestLiana
       Object.const_get('PaperTrail::Version').is_a?(Class) rescue false
     end
 
+    around_action :with_request_cache
+
     # NOTICE: Calling the method set_paper_trail_whodunnit loads the PaperTrail
     #         gem and Forest detects the PaperTrail::Version automatically. This
     #         method is used to set the whodunnit field automatically to track
@@ -131,6 +133,10 @@ module ForestLiana
 
     private
 
+    def with_request_cache(&block)
+      ForestLiana::RequestCache.with(&block)
+    end
+
     # NOTICE: What survives becomes(), which allocates a fresh instance and copies @attributes
     #         onto it and nothing else. Shared by both controllers' get_record, unlike the rest of
     #         their rendering, because getting it wrong is a correctness bug rather than a
@@ -256,11 +262,16 @@ module ForestLiana
           params_fields_hash = params_fields.to_hash
         end
 
+        forest_collection = nil
+        smart_relations = nil
         params_fields_hash.inject({}) do |fields, param_field|
           relation_name = param_field[0]
           relation_fields = param_field[1]
-          forest_collection = ForestLiana.apimap.find { |collection| collection.name.to_s == model.to_s.gsub('::', '__') }
-          smart_relations = forest_collection.fields_smart_belongs_to
+          forest_collection ||= begin
+            collection_name = model.to_s.gsub('::', '__')
+            ForestLiana.apimap.find { |collection| collection.name.to_s == collection_name }
+          end
+          smart_relations ||= forest_collection.fields_smart_belongs_to
 
           if relation_name == ForestLiana.name_for(model)
             fields[relation_name] = relation_fields

data/app/helpers/forest_liana/decoration_helper.rb

@@ -2,7 +2,7 @@ module ForestLiana
   module DecorationHelper
     def self.detect_match_and_decorate record, index, field_name, value, search_value, match_fields
       begin
-        match = value.match(/#{search_value}/i)
+        match = value.match(search_value.is_a?(Regexp) ? search_value : compile_search_pattern(search_value))
         if match
           match_fields[index] = { id: record['id'], search: [] } if match_fields[index].nil?
           match_fields[index][:search] << field_name
@@ -12,6 +12,7 @@ module ForestLiana
     end
 
     def self.decorate_for_search(records_serialized, field_names, search_value)
+      search_pattern = compile_search_pattern(search_value)
       match_fields = {}
       records_serialized['data'].each_with_index do |record, index|
         unless record['attributes']
@@ -21,14 +22,19 @@ module ForestLiana
         field_names.each do |field_name|
           value = record['attributes'][field_name]
           if value
-            detect_match_and_decorate(record, index, field_name, value, search_value, match_fields)
+            detect_match_and_decorate(record, index, field_name, value, search_pattern, match_fields)
           end
         end
 
-        detect_match_and_decorate(record, index, 'id', record['id'], search_value, match_fields)
+        detect_match_and_decorate(record, index, 'id', record['id'], search_pattern, match_fields)
       end
       match_fields.empty? ? nil : match_fields
     end
 
+    # Literal, like the LIKE that found the records: a regex metacharacter in the search must not
+    # highlight what the query never matched, nor raise and highlight nothing.
+    def self.compile_search_pattern(search_value)
+      Regexp.new(Regexp.escape(search_value.to_s), Regexp::IGNORECASE)
+    end
   end
 end

data/app/helpers/forest_liana/query_helper.rb

@@ -1,16 +1,19 @@
 module ForestLiana
   module QueryHelper
     def self.get_one_associations(resource)
-      associations = SchemaUtils.one_associations(resource)
-        .select do |association|
-          if SchemaUtils.polymorphic?(association)
-            SchemaUtils.polymorphic_models(association).all? { |model| SchemaUtils.model_included?(model) }
-          else
-            SchemaUtils.model_included?(association.klass)
-          end
-        end
+      model = resource.is_a?(ActiveRecord::Relation) ? resource.klass : resource
+
+      LookupCache.fetch(:one_associations, model) { scan_one_associations(model).freeze }
+    end
 
-      associations
+    def self.scan_one_associations(resource)
+      SchemaUtils.one_associations(resource).select do |association|
+        if SchemaUtils.polymorphic?(association)
+          SchemaUtils.polymorphic_models(association).all? { |model| SchemaUtils.model_included?(model) }
+        else
+          SchemaUtils.model_included?(association.klass)
+        end
+      end
     end
 
     def self.get_one_association_names_symbol(resource)

data/app/serializers/forest_liana/serializer_factory.rb

@@ -2,6 +2,8 @@ require 'jsonapi-serializers'
 
 module ForestLiana
   class SerializerFactory
+    # Keyed by the fields array itself, which serialize builds anew on each call.
+    FIELD_SETS = ObjectSpace::WeakMap.new
 
     def self.define_serializer(active_record_class, serializer)
       serializer_name = self.build_serializer_name(active_record_class)
@@ -212,7 +214,7 @@ module ForestLiana
           return {} if self.class.to_one_associations.nil?
           data = {}
           self.class.to_one_associations.each do |attribute_name, attr_data|
-            relation = object.class.reflect_on_all_associations.find { |a| a.name == attribute_name }
+            relation = object.class.reflect_on_association(attribute_name)
             next if !should_include_attr?(attribute_name, attr_data)
 
             if relation && relation.belongs_to? && relation.polymorphic?.nil?
@@ -252,7 +254,7 @@ module ForestLiana
           collection = self.type
 
           unless @options.dig(:context, :unoptimized)
-            return false unless @options[:fields][collection]&.include?(attribute_name.to_sym)
+            return false unless field_set(collection)&.include?(attribute_name.to_sym)
           end
 
           # Allow "if: :show_title?" and "unless: :hide_title?" attribute options.
@@ -262,12 +264,19 @@ module ForestLiana
           show_attr = true
           show_attr &&= send(if_method_name) if if_method_name
           show_attr &&= !send(unless_method_name) if unless_method_name
-          show_attr &&= @_fields[type.to_s].include?(formatted_attribute_name) if @_fields[type.to_s]
+          show_attr &&= field_set(type.to_s).include?(formatted_attribute_name) if @_fields[type.to_s]
           show_attr
         end
 
         private
 
+        def field_set(collection)
+          fields = @_fields[collection]
+          return nil if fields.nil?
+
+          FIELD_SETS[fields] ||= Set.new(fields)
+        end
+
         def intercom_integration?
           ForestLiana.integrations
             .try(:[], :intercom)

data/app/services/forest_liana/ability/permission.rb

@@ -54,8 +54,8 @@ module ForestLiana
 
       # +refetch+ drops the cached permissions first. Only a caller about to refuse on a denial asks
       # for it (a stale, up to TTL-old cache may sit behind a permission granted moments ago): the
-      # refetch deletes the cluster-wide `forest.collections` entry, so a field that is merely
-      # redacted is answered from the cache.
+      # refetch rewrites the cluster-wide `forest.collections` entry and this request's copy, so a
+      # field that is merely redacted is answered from the cache.
       def read_permissions(user, collection_names, refetch: false)
         @read_permissions_cache ||= {}
         to_fetch = refetch ? collection_names.uniq : collection_names.uniq - @read_permissions_cache.keys
@@ -251,17 +251,20 @@ module ForestLiana
       end
 
       def get_user_data(user_id, force_fetch = true)
-        cache = Rails.cache.fetch('forest.users', expires_in: TTL) do
-          users = {}
-          get_permissions('/liana/v4/permissions/users').each do |user|
-            users[user['id'].to_s] = user
-          end
+        cache = RequestCache.fetch('forest.users') do
+          Rails.cache.fetch('forest.users', expires_in: TTL) do
+            users = {}
+            get_permissions('/liana/v4/permissions/users').each do |user|
+              users[user['id'].to_s] = user
+            end
 
-          users
+            users
+          end
         end
 
         if !cache.key?(user_id.to_s) && force_fetch
           Rails.cache.delete('forest.users')
+          RequestCache.delete('forest.users')
           get_user_data(user_id, false)
         else
           cache[user_id.to_s]
@@ -273,9 +276,15 @@ module ForestLiana
       # followed failed, so during a Forest API incident every pod re-hit the dead API on every
       # request instead of riding on the last good payload until the TTL ran out.
       def get_collections_permissions_data(force_fetch = false)
-        Rails.cache.write('forest.collections', fetch_collections_permissions, expires_in: TTL) if force_fetch == true
+        if force_fetch == true
+          collections = fetch_collections_permissions
+          Rails.cache.write('forest.collections', collections, expires_in: TTL)
+          return RequestCache.write('forest.collections', collections)
+        end
 
-        Rails.cache.fetch('forest.collections', expires_in: TTL) { fetch_collections_permissions }
+        RequestCache.fetch('forest.collections') do
+          Rails.cache.fetch('forest.collections', expires_in: TTL) { fetch_collections_permissions }
+        end
       end
 
       def fetch_collections_permissions
@@ -285,9 +294,15 @@ module ForestLiana
       end
 
       def get_chart_data(rendering_id, force_fetch = false)
-        Rails.cache.write('forest.stats', fetch_chart_data(rendering_id), expires_in: TTL) if force_fetch == true
+        if force_fetch == true
+          stats = fetch_chart_data(rendering_id)
+          Rails.cache.write('forest.stats', stats, expires_in: TTL)
+          return RequestCache.write('forest.stats', stats)
+        end
 
-        Rails.cache.fetch('forest.stats', expires_in: TTL) { fetch_chart_data(rendering_id) }
+        RequestCache.fetch('forest.stats') do
+          Rails.cache.fetch('forest.stats', expires_in: TTL) { fetch_chart_data(rendering_id) }
+        end
       end
 
       def fetch_chart_data(rendering_id)
@@ -297,8 +312,10 @@ module ForestLiana
       end
 
       def has_permission_system?
-        Rails.cache.fetch('forest.has_permission') do
-          (get_permissions('/liana/v4/permissions/environment') == true) ? false : true
+        RequestCache.fetch('forest.has_permission') do
+          Rails.cache.fetch('forest.has_permission') do
+            (get_permissions('/liana/v4/permissions/environment') == true) ? false : true
+          end
         end
       end
 

data/app/services/forest_liana/base_getter.rb

@@ -777,8 +777,7 @@ module ForestLiana
       # Handle composite primary keys - name might be an Array
       name_sym = name.is_a?(Array) ? name : name.to_sym
       ForestLiana::QueryHelper.get_one_associations(projected_resource)
-                              .select { |association| association.name == name_sym }
-                              .first
+                              .find { |association| association.name == name_sym }
     end
 
     def is_active_storage_association?(association)

data/app/services/forest_liana/request_cache.rb

@@ -0,0 +1,28 @@
+module ForestLiana
+  # Keeps what a Forest request reads from Rails.cache for the rest of that request: each read
+  # there deserializes the whole payload again. Off outside +with+, where every call goes straight
+  # to Rails.cache as before.
+  class RequestCache < ActiveSupport::CurrentAttributes
+    attribute :store
+
+    def self.with(&block)
+      set(store: {}, &block)
+    end
+
+    def self.fetch(key)
+      return yield if store.nil?
+      return store[key] if store.key?(key)
+
+      store[key] = yield
+    end
+
+    def self.write(key, value)
+      store[key] = value unless store.nil?
+      value
+    end
+
+    def self.delete(key)
+      store&.delete(key)
+    end
+  end
+end

data/app/services/forest_liana/resources_getter.rb

@@ -235,7 +235,7 @@ module ForestLiana
 
       begin
         segment_query = @params[:segmentQuery].gsub(/\;\s*$/, '')
-        ScopeManager.inject_context_variables_on_query(segment_query, @user)
+        segment_query = ScopeManager.inject_context_variables_on_query(segment_query, @user)
 
         @records = @records.where(
           "#{@resource.table_name}.#{@resource.primary_key} IN (SELECT id FROM (#{segment_query}) as ids)"

data/app/services/forest_liana/schema_utils.rb

@@ -2,6 +2,12 @@ module ForestLiana
   class SchemaUtils
 
     def self.associations(active_record_class)
+      model = active_record_class.is_a?(ActiveRecord::Relation) ? active_record_class.klass : active_record_class
+
+      LookupCache.fetch(:associations, model) { scan_associations(model).freeze }
+    end
+
+    def self.scan_associations(active_record_class)
       active_record_class.reflect_on_all_associations.select do |association|
         begin
           polymorphic?(association) ? true : !is_active_type?(association.klass)
@@ -89,14 +95,14 @@ module ForestLiana
     end
 
     def self.polymorphic_models(relation)
-      models = []
-      ForestLiana.models.each do |model|
-        unless model.reflect_on_all_associations.select { |association| association.options[:as] == relation.name.to_sym }.empty?
-          models << model
-        end
-      end
+      name = relation.name.to_sym
+      LookupCache.fetch(:polymorphic_models, name) { scan_polymorphic_models(name).freeze }
+    end
 
-      models
+    def self.scan_polymorphic_models(name)
+      ForestLiana.models.select do |model|
+        model.reflect_on_all_associations.any? { |association| association.options[:as] == name }
+      end
     end
 
 

data/app/services/forest_liana/scope_manager.rb

@@ -64,18 +64,21 @@ module ForestLiana
 
     def self.invalidate_scope_cache(rendering_id)
       Rails.cache.delete('forest.scopes.' + rendering_id.to_s)
+      RequestCache.delete("forest.scopes.#{rendering_id}")
     end
 
     def self.fetch_scopes(rendering_id)
-      Rails.cache.fetch("forest.scopes.#{rendering_id}", expires_in: @@scope_cache_expiration_delta) do
-        response = ForestLiana::ForestApiRequester.get("/liana/v4/permissions/renderings/#{rendering_id}")
-        raise 'Unable to fetch scopes' unless response.is_a?(Net::HTTPOK)
-        parsed_response = JSON.parse(response.body)
-
-        {
-          'scopes' => decode_scope(parsed_response['collections']),
-          'team' => parsed_response['team']
-        }
+      RequestCache.fetch("forest.scopes.#{rendering_id}") do
+        Rails.cache.fetch("forest.scopes.#{rendering_id}", expires_in: @@scope_cache_expiration_delta) do
+          response = ForestLiana::ForestApiRequester.get("/liana/v4/permissions/renderings/#{rendering_id}")
+          raise 'Unable to fetch scopes' unless response.is_a?(Net::HTTPOK)
+          parsed_response = JSON.parse(response.body)
+
+          {
+            'scopes' => decode_scope(parsed_response['collections']),
+            'team' => parsed_response['team']
+          }
+        end
       end
     end
 

data/app/services/forest_liana/search_query_builder.rb

@@ -20,8 +20,7 @@ module ForestLiana
 
     def perform(resource)
       @resource = @records = resource
-      @tables_associated_to_relations_name =
-        ForestLiana::QueryHelper.get_tables_associated_to_relations_name(@resource)
+      @tables_associated_to_relations_name = nil
       # Two different contributors, kept apart rather than folded into one flag: a lambda that
       # runs without raising isn't necessarily a lambda that filtered anything (one returning its
       # query untouched pushes no condition, constrains nothing). Conflating the two let a
@@ -265,12 +264,16 @@ module ForestLiana
     end
 
     def association_table_name(name)
-      QueryHelper.get_tables_associated_to_relations_name(@records).detect { |key, values|
+      tables_associated_to_relations_name.detect { |key, values|
         break key if Array(values).include?(name)
       }
 
     end
 
+    def tables_associated_to_relations_name
+      @tables_associated_to_relations_name ||= QueryHelper.get_tables_associated_to_relations_name(@resource)
+    end
+
     # Recorded here, checked separately by +assert_sort_readable!+: a count route runs this same
     # parsing (Rails strips the ORDER BY from the emitted COUNT SQL on its own) but must not refuse
     # a sort it never actually applies, so the two are split rather than checked inline.

data/app/services/forest_liana/utils/context_variables_injector.rb

@@ -27,7 +27,7 @@ module ForestLiana
         while (match = regex.match(value_with_context_variables_injected))
           context_variable_key = match[1]
 
-          value_with_context_variables_injected.gsub!(
+          value_with_context_variables_injected = value_with_context_variables_injected.gsub(
             /{{#{context_variable_key}}}/,
             yield(context_variable_key)
           )

data/lib/forest_liana/lookup_cache.rb

@@ -1,14 +1,27 @@
 module ForestLiana
-  # Remembers lookups by name over ForestLiana.models, .apimap and .names_overriden: on a large
-  # schema each one is a linear scan, schema_for_resource a scan of scans, and every request runs
-  # several. Any of the three being replaced or growing (the bootstrapper, a Forest collection
-  # file, a code reload) drops everything remembered, so an answer never outlives what it read.
+  # Remembers lookups over ForestLiana.models, .apimap and .names_overriden, and what
+  # .included_models/.excluded_models let through: on a large schema each one is a linear scan,
+  # schema_for_resource a scan of scans, and every request runs several. Any of these being
+  # replaced or growing (the bootstrapper, a Forest collection file, a code reload) drops everything
+  # remembered, so an answer never outlives what it read.
   module LookupCache
+    # Swapped as a whole, so a thread never pairs new sources with the stores of old ones.
+    Snapshot = Struct.new(:sources, :sizes, :stores) do
+      def current?(models, apimap, names, included, excluded)
+        same?(0, models) && same?(1, apimap) && same?(2, names) && same?(3, included) && same?(4, excluded)
+      end
+
+      private
+
+      def same?(index, source)
+        source.equal?(sources[index]) && source.size == sizes[index]
+      end
+    end
+
     # A miss is not remembered: the router resolves a request's collection before authenticating
     # it, so caching unknown names would let any caller grow this cache without bound.
     def self.fetch(namespace, key)
-      reset_if_stale
-      store = (@stores[namespace] ||= {})
+      store = (current_stores[namespace] ||= {})
       return store[key] if store.key?(key)
 
       value = yield
@@ -17,21 +30,23 @@ module ForestLiana
     end
 
     def self.reset!
-      @stores = nil
+      @snapshot = nil
     end
 
-    def self.reset_if_stale
+    # Runs on every lookup, thousands of times per list: a hit must not allocate.
+    def self.current_stores
       models = ForestLiana.models
       apimap = ForestLiana.apimap
       names = ForestLiana.names_overriden
-      return if @stores && models.equal?(@models) && models.size == @models_size &&
-                apimap.equal?(@apimap) && apimap.size == @apimap_size &&
-                names.equal?(@names) && names.size == @names_size
+      included = ForestLiana.included_models
+      excluded = ForestLiana.excluded_models
+      snapshot = @snapshot
+      return snapshot.stores if snapshot&.current?(models, apimap, names, included, excluded)
 
-      @models, @models_size = models, models.size
-      @apimap, @apimap_size = apimap, apimap.size
-      @names, @names_size = names, names.size
-      @stores = {}
+      sources = [models, apimap, names, included, excluded]
+      snapshot = Snapshot.new(sources, sources.map(&:size), {})
+      @snapshot = snapshot
+      snapshot.stores
     end
   end
 end

data/lib/forest_liana/version.rb

@@ -1,3 +1,3 @@
 module ForestLiana
-  VERSION = "9.22.11"
+  VERSION = "9.22.12"
 end

data/spec/helpers/forest_liana/decoration_helper_spec.rb

@@ -76,16 +76,22 @@ module ForestLiana
         end
       end
 
-      context 'when regex matching raises an exception' do
+      context 'when search_value is not a valid regex' do
         let(:search_value) { '[invalid_regex' }
 
-        it 'handles the exception gracefully' do
+        it 'does not match a value that does not contain it' do
           expect {
             described_class.detect_match_and_decorate(record, index, field_name, value, search_value, match_fields)
           }.not_to raise_error
 
           expect(match_fields).to be_empty
         end
+
+        it 'matches a value that contains it literally' do
+          described_class.detect_match_and_decorate(record, index, field_name, 'a[invalid_regex', search_value, match_fields)
+
+          expect(match_fields[index][:search]).to eq(['name'])
+        end
       end
 
       context 'with special regex characters in search_value' do
@@ -97,6 +103,12 @@ module ForestLiana
 
           expect(match_fields[index][:search]).to include('name')
         end
+
+        it 'does not match a value without the literal character' do
+          described_class.detect_match_and_decorate(record, index, field_name, 'testXemail', search_value, match_fields)
+
+          expect(match_fields).to be_empty
+        end
       end
     end
 
@@ -179,6 +191,31 @@ module ForestLiana
 
           expect(result[0][:search]).to eq(['name'])
         end
+
+        it 'compiles the search pattern once for every record and field' do
+          allow(Regexp).to receive(:new).and_call_original
+          expect(Regexp).to receive(:new).with('john', Regexp::IGNORECASE).once.and_call_original
+
+          described_class.decorate_for_search(records_serialized, field_names, search_value)
+        end
+
+        it 'highlights a search holding regex metacharacters literally' do
+          records_serialized['data'][1]['attributes']['name'] = 'f(x)'
+
+          result = described_class.decorate_for_search(records_serialized, field_names, '(')
+
+          expect(result).to eq({ 1 => { id: '2', search: ['name'] } })
+        end
+
+        it 'does not read a quantifier as one' do
+          records_serialized['data'][1]['attributes']['name'] = 'aaa'
+
+          expect(described_class.decorate_for_search(records_serialized, field_names, 'a*')).to be_nil
+        end
+
+        it 'does not read an alternation as one' do
+          expect(described_class.decorate_for_search(records_serialized, field_names, 'zzz|john')).to be_nil
+        end
       end
 
       context 'when no matches are found' do
@@ -228,6 +265,12 @@ module ForestLiana
             described_class.decorate_for_search(records_serialized, field_names, search_value)
           }.to raise_error(ArgumentError, "Missing 'attributes' key in record #{records_serialized['data'][0]}")
         end
+
+        it 'raises ArgumentError even when the search holds regex metacharacters' do
+          expect {
+            described_class.decorate_for_search(records_serialized, field_names, '[john')
+          }.to raise_error(ArgumentError, "Missing 'attributes' key in record #{records_serialized['data'][0]}")
+        end
       end
     end
   end

data/spec/lib/forest_liana/lookup_cache_spec.rb

@@ -1,6 +1,17 @@
 require 'rails_helper'
 
 describe 'Lookups by name over the schema' do
+  describe 'ForestLiana::LookupCache.fetch' do
+    it 'answers a remembered lookup without allocating' do
+      ForestLiana::LookupCache.fetch(:spec, :key) { :value }
+
+      allocated = GC.stat(:total_allocated_objects)
+      1_000.times { ForestLiana::LookupCache.fetch(:spec, :key) { :value } }
+
+      expect(GC.stat(:total_allocated_objects) - allocated).to be < 100
+    end
+  end
+
   describe 'ForestLiana.name_for' do
     after { ForestLiana.names_overriden.delete(Tree) }
 
@@ -49,6 +60,108 @@ describe 'Lookups by name over the schema' do
     end
   end
 
+  describe 'ForestLiana::SchemaUtils.polymorphic_models' do
+    let(:addressable) { Address.reflect_on_association(:addressable) }
+
+    it 'scans the models once for repeated lookups of a relation' do
+      expect(ForestLiana::SchemaUtils).to receive(:scan_polymorphic_models).with(:addressable).once.and_call_original
+
+      3.times { expect(ForestLiana::SchemaUtils.polymorphic_models(addressable)).to eq [User] }
+    end
+
+    it 'returns a frozen list' do
+      expect(ForestLiana::SchemaUtils.polymorphic_models(addressable)).to be_frozen
+    end
+
+    it 'remembers a relation no model targets' do
+      orphan = double(name: :orphan)
+      expect(ForestLiana::SchemaUtils).to receive(:scan_polymorphic_models).with(:orphan).once.and_call_original
+
+      2.times { expect(ForestLiana::SchemaUtils.polymorphic_models(orphan)).to eq [] }
+    end
+
+    it 'finds a target added to the models after a first lookup' do
+      target = Class.new(ActiveRecord::Base) do
+        self.table_name = 'trees'
+        has_many :addresses, as: :addressable
+      end
+      expect(ForestLiana::SchemaUtils.polymorphic_models(addressable)).to eq [User]
+
+      ForestLiana.models << target
+
+      expect(ForestLiana::SchemaUtils.polymorphic_models(addressable)).to contain_exactly(User, target)
+    ensure
+      ForestLiana.models.delete(target)
+    end
+  end
+
+  describe 'ForestLiana::SchemaUtils.associations' do
+    it 'reflects on a model once for repeated lookups, a relation included' do
+      expect(ForestLiana::SchemaUtils).to receive(:scan_associations).with(Tree).once.and_call_original
+
+      expected = Tree.reflect_on_all_associations.map(&:name)
+      expect(ForestLiana::SchemaUtils.associations(Tree).map(&:name)).to match_array(expected)
+      expect(ForestLiana::SchemaUtils.associations(Tree.where(name: 'oak')).map(&:name)).to match_array(expected)
+    end
+
+    it 'keeps only the to-many associations for many_associations' do
+      expect(ForestLiana::SchemaUtils.many_associations(Tree).map(&:name)).to eq([:owner_named_trees])
+    end
+  end
+
+  describe 'ForestLiana::QueryHelper.get_one_associations' do
+    it 'computes the to-one associations of a model once for repeated lookups' do
+      expect(ForestLiana::QueryHelper).to receive(:scan_one_associations).with(Address).once.and_call_original
+
+      3.times { expect(ForestLiana::QueryHelper.get_one_associations(Address).map(&:name)).to eq [:addressable] }
+    end
+
+    it 'returns a frozen list' do
+      expect(ForestLiana::QueryHelper.get_one_associations(Address)).to be_frozen
+    end
+
+    it 'drops a target excluded after a first lookup' do
+      previous = ForestLiana.excluded_models
+      expect(ForestLiana::QueryHelper.get_one_associations(Address).map(&:name)).to eq [:addressable]
+
+      ForestLiana.excluded_models = previous + ['User']
+
+      expect(ForestLiana::QueryHelper.get_one_associations(Address)).to eq []
+    ensure
+      ForestLiana.excluded_models = previous
+    end
+
+    it 'drops a target excluded by a replacement list of the same size' do
+      previous = ForestLiana.excluded_models
+      ForestLiana.excluded_models = previous + ['Tree']
+      expect(ForestLiana::QueryHelper.get_one_associations(Address).map(&:name)).to eq [:addressable]
+
+      ForestLiana.excluded_models = previous + ['User']
+
+      expect(ForestLiana::QueryHelper.get_one_associations(Address)).to eq []
+    ensure
+      ForestLiana.excluded_models = previous
+    end
+
+    it 'drops a target left out of the included models after a first lookup' do
+      previous = ForestLiana.included_models
+      expect(ForestLiana::QueryHelper.get_one_associations(Address).map(&:name)).to eq [:addressable]
+
+      ForestLiana.included_models = ['Address']
+
+      expect(ForestLiana::QueryHelper.get_one_associations(Address)).to eq []
+    ensure
+      ForestLiana.included_models = previous
+    end
+
+    it 'answers a relation from the lookup of its model' do
+      expect(ForestLiana::QueryHelper).to receive(:scan_one_associations).with(Address).once.and_call_original
+
+      expect(ForestLiana::QueryHelper.get_one_associations(Address).map(&:name)).to eq [:addressable]
+      expect(ForestLiana::QueryHelper.get_one_associations(Address.where(city: 'Papeete')).map(&:name)).to eq [:addressable]
+    end
+  end
+
   describe 'ForestLiana.schema_for_resource' do
     it 'resolves the collection of a resource once for repeated lookups' do
       expect(ForestLiana.schema_for_resource(Tree).name).to eq 'Tree'

data/spec/requests/actions_controller_spec.rb

@@ -764,5 +764,43 @@ describe 'Requesting Actions routes', :type => :request  do
         expect(result).not_to have_key('Island')
       end
     end
+
+    context 'with several requested relations' do
+      let(:smart_relations) do
+        [
+          { field: :organization, reference: 'Api__OrganizationsView.id', is_virtual: true, is_searchable: false, type: 'String' },
+          { field: :parent_island, reference: 'Island.id', is_virtual: true, is_searchable: false, type: 'String' }
+        ]
+      end
+      let(:forest_collection) { double('forest_collection', name: collection_name, fields_smart_belongs_to: smart_relations) }
+      let(:params_fields) do
+        ActionController::Parameters.new({ 'Island' => 'id,name', 'organization' => 'name', 'parent_island' => 'name' })
+      end
+
+      before do
+        allow(ForestLiana).to receive(:apimap).and_return([forest_collection])
+        allow(controller).to receive(:params).and_return(
+          ActionController::Parameters.new({ collection: 'Island', fields: params_fields.to_unsafe_h })
+        )
+      end
+
+      it 'finds the collection once' do
+        expect(forest_collection).to receive(:name).once.and_return(collection_name)
+
+        controller.send(:fields_per_model, params_fields, model)
+      end
+
+      it 'reads its smart belongs-to once' do
+        expect(forest_collection).to receive(:fields_smart_belongs_to).once.and_return(smart_relations)
+
+        controller.send(:fields_per_model, params_fields, model)
+      end
+
+      it 'keys every relation as it would alone' do
+        result = controller.send(:fields_per_model, params_fields, model)
+
+        expect(result).to eq('Island' => 'id,name', 'Api__OrganizationsView' => 'name', 'parent_island' => 'name')
+      end
+    end
   end
 end

data/spec/requests/permissions_cache_footprint_spec.rb

@@ -0,0 +1,122 @@
+require 'rails_helper'
+
+describe 'Permission and scope reads of a request', type: :request do
+  token = JWT.encode({ id: 1, email: 'michael.kelso@that70.show', first_name: 'Michael', last_name: 'Kelso',
+                       team: 'Operations', rendering_id: 16, exp: Time.now.to_i + 2.weeks.to_i,
+                       permission_level: 'user' },
+                     ForestLiana.auth_secret, 'HS256')
+  headers = { 'Accept' => 'application/json', 'Content-Type' => 'application/json',
+              'Authorization' => "Bearer #{token}" }
+
+  let(:auth_headers) { headers }
+  let(:readable) { %w[Tree Location User Island] }
+  let(:refetched_readable) { readable }
+  let(:scope) { { 'field' => 'name', 'operator' => 'present', 'value' => nil } }
+  let(:users) { [{ 'id' => 1, 'roleId' => 1 }] }
+  let(:refetched_users) { users }
+  let(:cache) { ActiveSupport::Cache::MemoryStore.new }
+  let!(:tree) do
+    user = User.create!(name: 'Michel')
+    tree = Tree.create!(name: 'Lemon Tree', owner: user, cutter: user)
+    Location.create!(coordinates: '1,2', island: Island.create!(name: 'Lemon Island', trees: [tree]))
+    tree
+  end
+
+  def environment(readable_collections)
+    enabled = { 'roles' => [1] }
+    collections = %w[Tree Location User Island].to_h do |name|
+      read = readable_collections.include?(name) ? enabled : { 'roles' => [] }
+      crud = %w[browseEnabled editEnabled addEnabled deleteEnabled exportEnabled].to_h { |key| [key, enabled] }
+      [name, { 'collection' => crud.merge('readEnabled' => read), 'actions' => {} }]
+    end
+
+    { 'collections' => collections }
+  end
+
+  before do
+    allow(Rails).to receive(:cache).and_return(cache)
+    @environment_fetches = 0
+    @users_fetches = 0
+    allow_any_instance_of(ForestLiana::Ability::Fetch).to receive(:get_permissions) do |_, path|
+      case path
+      when '/liana/v4/permissions/environment'
+        @environment_fetches += 1
+        environment(@environment_fetches == 1 ? readable : refetched_readable)
+      when '/liana/v4/permissions/users'
+        @users_fetches += 1
+        @users_fetches == 1 ? users : refetched_users
+      end
+    end
+    rendering = Net::HTTPOK.new('1.1', 200, 'OK')
+    allow(rendering).to receive(:body).and_return(JSON.generate(
+      'collections' => { 'Tree' => { 'scope' => scope } }, 'team' => { 'id' => 1, 'name' => 'Operations' }
+    ))
+    allow(ForestLiana::ForestApiRequester).to receive(:get).and_return(rendering)
+    allow(ForestLiana::IpWhitelist).to receive(:retrieve) { true }
+    allow(ForestLiana::IpWhitelist).to receive(:is_ip_whitelist_retrieved) { true }
+    allow(ForestLiana::IpWhitelist).to receive(:is_ip_valid) { true }
+  end
+
+  after do
+    [Location, Tree, Island, User].each(&:destroy_all)
+  end
+
+  def cache_reads
+    reads = Hash.new(0)
+    subscriber = ActiveSupport::Notifications.subscribe('cache_read.active_support') do |*, payload|
+      reads[payload[:key].to_s] += 1
+    end
+    yield
+    reads
+  ensure
+    ActiveSupport::Notifications.unsubscribe(subscriber)
+  end
+
+  let(:fields) { { 'Tree' => 'id,name,owner', 'owner' => 'name' } }
+  let(:filtered) do
+    { fields: fields, filters: JSON.generate(field: 'owner:name', operator: 'present', value: nil),
+      sort: 'owner.name', timezone: 'Europe/Paris' }
+  end
+
+  {
+    'a list filtered and sorted on a relation' => ->(tree, params) { ['/forest/Tree', params.merge(page: { number: 1, size: 10 })] },
+    'its count' => ->(tree, params) { ['/forest/Tree/count', params.except(:sort)] },
+    'a get-one' => ->(tree, params) { ["/forest/Tree/#{tree.id}", { timezone: 'Europe/Paris' }] },
+    'a related list' => ->(tree, _) { ["/forest/Island/#{tree.island_id}/relationships/trees", { fields: { 'Tree' => 'id,name,owner', 'owner' => 'name' }, timezone: 'Europe/Paris' }] },
+  }.each do |name, request|
+    it "reads each key at most once for #{name}" do
+      path, params = request.call(tree, filtered)
+      reads = cache_reads { get path, params: params, headers: auth_headers }
+
+      expect(response).to have_http_status(200)
+      expect(reads.keys).to include('forest.collections', 'forest.users')
+      expect(reads.values).to all(eq(1))
+    end
+  end
+
+  describe 'when a relation is denied by a stale cache' do
+    let(:readable) { %w[Tree Location Island] }
+    let(:refetched_readable) { %w[Tree Location User Island] }
+
+    it 'refetches once and answers the rest of the request from the fresh permissions' do
+      cache.write('forest.has_permission', true)
+      get '/forest/Tree', params: filtered.merge(page: { number: 1, size: 10 }), headers: auth_headers
+
+      expect(response).to have_http_status(200)
+      expect(JSON.parse(response.body)['included'].map { |record| record['type'] }).to include('User')
+      expect(@environment_fetches).to eq(2)
+    end
+  end
+
+  describe 'when the user is missing from a stale users cache' do
+    let(:users) { [] }
+    let(:refetched_users) { [{ 'id' => 1, 'roleId' => 1 }] }
+
+    it 'refetches the users once and authorizes the request' do
+      get '/forest/Tree', params: filtered.merge(page: { number: 1, size: 10 }), headers: auth_headers
+
+      expect(response).to have_http_status(200)
+      expect(@users_fetches).to eq(2)
+    end
+  end
+end

data/spec/requests/schema_lookup_footprint_spec.rb

@@ -0,0 +1,62 @@
+require 'rails_helper'
+
+describe 'Schema scans of a list call', type: :request do
+  token = JWT.encode({ id: 38, email: 'michael.kelso@that70.show', first_name: 'Michael',
+                       last_name: 'Kelso', team: 'Operations', rendering_id: 16,
+                       exp: Time.now.to_i + 2.weeks.to_i, permission_level: 'admin' },
+                     ForestLiana.auth_secret, 'HS256')
+  headers = { 'Accept' => 'application/json', 'Content-Type' => 'application/json',
+              'Authorization' => "Bearer #{token}" }
+
+  let(:auth_headers) { headers }
+  let!(:user) { User.create!(name: 'Michel') }
+  let!(:address) { Address.create!(line1: '1 Palm Street', city: 'Papeete', zipcode: '98713', addressable: user) }
+
+  before do
+    allow(ForestLiana::IpWhitelist).to receive(:retrieve) { true }
+    allow(ForestLiana::IpWhitelist).to receive(:is_ip_whitelist_retrieved) { true }
+    allow(ForestLiana::IpWhitelist).to receive(:is_ip_valid) { true }
+    allow_any_instance_of(ForestLiana::Ability).to receive(:forest_authorize!) { true }
+    Rails.cache.write('forest.has_permission', false)
+    allow(ForestLiana::ScopeManager).to receive(:fetch_scopes)
+      .and_return({ 'scopes' => {}, 'team' => { 'id' => '1', 'name' => 'Operations' } })
+  end
+
+  after do
+    Address.destroy_all
+    User.destroy_all
+  end
+
+  def list(fields)
+    get '/forest/Address', params: { fields: fields, page: { 'number' => '1', 'size' => '10' },
+                                     sort: '-id', timezone: 'Europe/Paris' }, headers: auth_headers
+    expect(response).to have_http_status(200)
+  end
+
+  it 'scans the models for the targets of a polymorphic relation once, whatever the projection' do
+    scans = 0
+    allow(ForestLiana::SchemaUtils).to receive(:scan_polymorphic_models).and_wrap_original do |original, *args|
+      scans += 1
+      original.call(*args)
+    end
+
+    list('Address' => 'id,line1')
+    list('Address' => 'id,line1,city,zipcode,addressable', 'addressable' => 'id')
+
+    expect(scans).to eq(1)
+  end
+
+  it 'reflects on the serialized model once, whatever the number of rows' do
+    2.times { Address.create!(line1: 'Another street', city: 'Papeete', zipcode: '98713', addressable: user) }
+    scans = []
+    allow(ForestLiana::SchemaUtils).to receive(:scan_associations).and_wrap_original do |original, model|
+      scans << model
+      original.call(model)
+    end
+
+    list('Address' => 'id,line1,addressable', 'addressable' => 'id')
+
+    expect(JSON.parse(response.body)['data'].size).to eq(3)
+    expect(scans.count(Address)).to eq(1)
+  end
+end

data/spec/services/forest_liana/request_cache_spec.rb

@@ -0,0 +1,50 @@
+module ForestLiana
+  describe RequestCache do
+    it 'runs the block on every call outside a request' do
+      calls = 0
+      2.times { described_class.fetch('key') { calls += 1 } }
+
+      expect(calls).to eq(2)
+    end
+
+    it 'runs the block once per key within a request' do
+      calls = 0
+      values = described_class.with { Array.new(2) { described_class.fetch('key') { calls += 1 } } }
+
+      expect(calls).to eq(1)
+      expect(values).to eq([1, 1])
+    end
+
+    it 'remembers a false value' do
+      calls = 0
+      described_class.with { 2.times { described_class.fetch('key') { calls += 1; false } } }
+
+      expect(calls).to eq(1)
+    end
+
+    it 'answers a written value to the rest of the request' do
+      described_class.with do
+        described_class.fetch('key') { 'stale' }
+        described_class.write('key', 'fresh')
+
+        expect(described_class.fetch('key') { 'unused' }).to eq('fresh')
+      end
+    end
+
+    it 'runs the block again after a delete' do
+      described_class.with do
+        described_class.fetch('key') { 'stale' }
+        described_class.delete('key')
+
+        expect(described_class.fetch('key') { 'fresh' }).to eq('fresh')
+      end
+    end
+
+    it 'forgets everything once the request is over' do
+      described_class.with { described_class.fetch('key') { 'first' } }
+
+      expect(described_class.with { described_class.fetch('key') { 'second' } }).to eq('second')
+      expect(described_class.store).to be_nil
+    end
+  end
+end

data/spec/services/forest_liana/resources_getter_spec.rb

@@ -151,6 +151,23 @@ module ForestLiana
       end
     end
 
+    describe 'when a live query segment uses a context variable' do
+      let(:user) { { 'id' => '1', 'name' => 'Michel', 'rendering_id' => rendering_id } }
+      let(:getter) do
+        described_class.new(resource, {
+          page: { size: pageSize, number: pageNumber },
+          fields: { 'User' => 'id,name' },
+          segmentQuery: "SELECT id FROM users WHERE name = '{{currentUser.name}}'",
+        }, user)
+      end
+
+      it 'injects the variable into the query it runs' do
+        getter.perform
+
+        expect(getter.records.map(&:name)).to eq(['Michel'])
+      end
+    end
+
     describe 'when there are more records than the page size' do
       describe 'when asking for the 1st page and 15 records' do
         let(:pageSize) { 15 }

data/spec/services/forest_liana/scope_manager_spec.rb

@@ -124,6 +124,16 @@ module ForestLiana
             }
           )
         end
+
+        it 'injects each user their own values from a shared scope' do
+          other_user = user.merge('email' => 'other@forestadmin.com')
+
+          ForestLiana::RequestCache.with do
+            expect(described_class.get_scope(collection_name, user)['conditions'][0]['value']).to eq('jd@forestadmin.com')
+            expect(described_class.get_scope(collection_name, other_user)['conditions'][0]['value']).to eq('other@forestadmin.com')
+            expect(described_class.fetch_scopes(rendering_id)['scopes']['User']['conditions'][0]['value']).to eq('{{currentUser.email}}')
+          end
+        end
       end
 
       describe 'when target collection has no scopes' do
@@ -347,9 +357,14 @@ module ForestLiana
         end
 
         it 'should inject the context variables in the query' do
+          expect(described_class.inject_context_variables_on_query(query, user))
+            .to eq "SELECT id FROM users WHERE email = 'jd@forestadmin.com'"
+        end
+
+        it 'should leave the query it was given untouched' do
           described_class.inject_context_variables_on_query(query, user)
 
-          expect(query).to eq "SELECT id FROM users WHERE email = 'jd@forestadmin.com'"
+          expect(query).to eq "SELECT id FROM users WHERE email = '{{currentUser.email}}'"
         end
       end
     end

data/spec/services/forest_liana/search_query_builder_spec.rb

@@ -259,6 +259,35 @@ module ForestLiana
       end
     end
 
+    describe 'the tables behind a sort on a relation' do
+      let(:params) { { sort: sort } }
+
+      context 'without a sort on a relation' do
+        let(:sort) { '-name' }
+
+        it 'never resolves them' do
+          expect(ForestLiana::QueryHelper).not_to receive(:get_tables_associated_to_relations_name)
+
+          builder.perform(Tree)
+        end
+      end
+
+      context 'with a sort on two relations' do
+        let(:sort) { '-owner.name,cutter.age' }
+
+        it 'resolves them once' do
+          expect(ForestLiana::QueryHelper).to receive(:get_tables_associated_to_relations_name)
+            .with(Tree).once.and_call_original
+
+          builder.perform(Tree)
+        end
+
+        it 'orders on the tables of both relations' do
+          expect(builder.perform(Tree).to_sql).to include('ORDER BY "users"."name" DESC, "users"."age" ASC')
+        end
+      end
+    end
+
     describe 'the footprint it reports' do
       # search_param and the SQL it emits are meant to come from the same `push_condition` calls;
       # this walks the emitted WHERE clause independently of the recording and compares the two as

data/spec/services/forest_liana/serializer_factory_spec.rb

@@ -1,5 +1,20 @@
 module ForestLiana
   describe SerializerFactory do
+    describe 'projected fields' do
+      it 'follows the fields of each serialize call, even when the calls share one context' do
+        tree = Tree.create!(name: 'Oak', owner: User.create!(name: 'Owner'))
+        serializer = described_class.new.serializer_for(Tree)
+        context = {}
+        attributes = lambda do |fields|
+          ForestAdmin::JSONAPI::Serializer.serialize(tree, serializer: serializer, context: context,
+                                                           fields: { 'Tree' => fields })['data']['attributes']
+        end
+
+        expect(attributes.call('id,name')).to include('name' => 'Oak')
+        expect(attributes.call('id,age')).not_to have_key('name')
+      end
+    end
+
     describe '#serializer_for has_one_relationships patch' do
       let(:user) { User.create!(name: 'PatchTest') }
       let(:island) { Island.create!(name: 'TestIsland') }

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: forest_liana
 version: !ruby/object:Gem::Version
-  version: 9.22.11
+  version: 9.22.12
 platform: ruby
 authors:
 - Sandro Munda
 autorequire:
 bindir: bin
 cert_chain: []
-date: 2026-10-10 00:00:00.000000000 Z
+date: 2026-10-13 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: rails
@@ -323,6 +323,7 @@ files:
 - app/services/forest_liana/projection_parser.rb
 - app/services/forest_liana/query_stat_getter.rb
 - app/services/forest_liana/record_findable.rb
+- app/services/forest_liana/request_cache.rb
 - app/services/forest_liana/resource_creator.rb
 - app/services/forest_liana/resource_getter.rb
 - app/services/forest_liana/resource_updater.rb
@@ -484,11 +485,13 @@ files:
 - spec/requests/cors_spec.rb
 - spec/requests/count_spec.rb
 - spec/requests/missing_attribute_valve_spec.rb
+- spec/requests/permissions_cache_footprint_spec.rb
 - spec/requests/projection_header_spec.rb
 - spec/requests/projection_inherited_loads_spec.rb
 - spec/requests/query_footprint_spec.rb
 - spec/requests/related_list_nested_through_spec.rb
 - spec/requests/resources_spec.rb
+- spec/requests/schema_lookup_footprint_spec.rb
 - spec/requests/smart_field_named_like_unexposed_relation_spec.rb
 - spec/requests/stats_spec.rb
 - spec/requests/sti_record_conversion_spec.rb
@@ -518,6 +521,7 @@ files:
 - spec/services/forest_liana/line_stat_getter_spec.rb
 - spec/services/forest_liana/pie_stat_getter_spec.rb
 - spec/services/forest_liana/projection_parser_spec.rb
+- spec/services/forest_liana/request_cache_spec.rb
 - spec/services/forest_liana/resource_updater_spec.rb
 - spec/services/forest_liana/resources_getter_composite_keys_spec.rb
 - spec/services/forest_liana/resources_getter_spec.rb
@@ -843,11 +847,13 @@ test_files:
 - spec/requests/cors_spec.rb
 - spec/requests/count_spec.rb
 - spec/requests/missing_attribute_valve_spec.rb
+- spec/requests/permissions_cache_footprint_spec.rb
 - spec/requests/projection_header_spec.rb
 - spec/requests/projection_inherited_loads_spec.rb
 - spec/requests/query_footprint_spec.rb
 - spec/requests/related_list_nested_through_spec.rb
 - spec/requests/resources_spec.rb
+- spec/requests/schema_lookup_footprint_spec.rb
 - spec/requests/smart_field_named_like_unexposed_relation_spec.rb
 - spec/requests/stats_spec.rb
 - spec/requests/sti_record_conversion_spec.rb
@@ -877,6 +883,7 @@ test_files:
 - spec/services/forest_liana/line_stat_getter_spec.rb
 - spec/services/forest_liana/pie_stat_getter_spec.rb
 - spec/services/forest_liana/projection_parser_spec.rb
+- spec/services/forest_liana/request_cache_spec.rb
 - spec/services/forest_liana/resource_updater_spec.rb
 - spec/services/forest_liana/resources_getter_composite_keys_spec.rb
 - spec/services/forest_liana/resources_getter_spec.rb