forest_liana 9.22.8 → 9.22.9

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 16535336fcd20313742ad4fc2bc231e159157d00f75fbb5a7cddb326be28507e
-  data.tar.gz: e8f7d86078eb9d1b19b0c5fb923c26d144605914f556204c54ac631c8a84421c
+  metadata.gz: 1427f49be68c4df6bbcd4fd859c13544c59d6c8c24b810cacfe2ebfcf34b20a0
+  data.tar.gz: 4987bbf28820237edab483d04752e068fe35e1a547b95784aa19cf2e70db17f4
 SHA512:
-  metadata.gz: f30b96a77ac786bda68265d8e8f4684a3141747e76096251c5c52f7f95883cb6539072bcb97bbdb796796e3292da67c8541ba7f454d1e6a359770833c5aa1c7b
-  data.tar.gz: ec0e110843449b24f2fd4af2aae10b1ef43282ad01a7000de729e7dbaa135adb1eb7d490d71d4e5d06dad8adb110ea1f94843506f9984515e43657ff3536864a
+  metadata.gz: b0c64c511777459d427d6e33e75698004f96436894c668ffaf2333b63e3c8d539b354155708dd15c88ce1d1b8b6c856082df12bfa555455f14d43f2689c9223f
+  data.tar.gz: bf3bf6469ac14740c7b1eeddd6e05a404ffc7805248ee6bd4974f614c2c7e6b2e7be172743c3b55fa6bcad8bbf4da474ee5ed4306103e3ce4232e2b84d5edd92

data/app/serializers/forest_liana/serializer_factory.rb

@@ -137,7 +137,7 @@ module ForestLiana
         end
 
         def type
-          ForestLiana.name_for(object.class).demodulize
+          @type ||= ForestLiana.name_for(object.class).demodulize
         end
 
         def format_name(attribute_name)
@@ -155,8 +155,9 @@ module ForestLiana
         def relationship_related_link(attribute_name)
           ret = {}
 
-          # Has many smart field
-          current = self.has_many_relationships[attribute_name]
+          # Has many smart field. Read off the class rather than has_many_relationships, which rebuilds
+          # every to-many on each call: once per serialized relation, so quadratic in their number.
+          current = self.class.to_many_associations&.[](attribute_name)
           if current.try(:[], :options).try(:[], :name) == attribute_name
             ret[:href] = "/forest/#{ForestLiana.name_for(object.class)}/#{object.id}/#{attribute_name}"
             return ret
@@ -195,10 +196,9 @@ module ForestLiana
 
           if ret[:href].blank?
             begin
-              SchemaUtils.many_associations(object.class).each do |a|
-                if a.name == attribute_name
-                  ret[:href] = "/forest/#{ForestLiana.name_for(object.class)}/#{object.id}/relationships/#{attribute_name}"
-                end
+              @many_association_names ||= SchemaUtils.many_associations(object.class).map(&:name)
+              if @many_association_names.include?(attribute_name)
+                ret[:href] = "/forest/#{ForestLiana.name_for(object.class)}/#{object.id}/relationships/#{attribute_name}"
               end
             rescue TypeError, ActiveRecord::StatementInvalid, NoMethodError => exception
               FOREST_LOGGER.warn "Cannot load the association #{attribute_name} on #{object.class.name} #{object.id}.\n#{exception&.backtrace&.join("\n\t")}"

data/app/services/forest_liana/ability/apimap_index.rb

@@ -0,0 +1,44 @@
+module ForestLiana
+  module Ability
+    # The apimap lookups a field-read check repeats once per requested field, made once per check
+    # instead: a wide collection on a large schema otherwise rescans every collection, and every
+    # field of the root one, for each field a page displays.
+    class ApimapIndex
+      def initialize(apimap)
+        @collections_by_name = apimap.each_with_object({}) { |collection, index| index[collection.name.to_s] ||= collection }
+        @collections_by_model = {}
+        @fields_by_name = {}
+        @smart_belongs_to_by_name = {}
+      end
+
+      def collection_for(model)
+        @collections_by_model.fetch(model) do
+          @collections_by_model[model] = @collections_by_name[ForestLiana.name_for(model)]
+        end
+      end
+
+      def exposed?(collection_name)
+        @collections_by_name.key?(collection_name)
+      end
+
+      def fields_named(model, field_name)
+        @fields_by_name[model] ||= first_by_name(collection_for(model)&.fields.to_a, all: true)
+        @fields_by_name[model][field_name] || []
+      end
+
+      def smart_belongs_to(model, field_name)
+        @smart_belongs_to_by_name[model] ||= first_by_name(collection_for(model)&.fields_smart_belongs_to.to_a)
+        @smart_belongs_to_by_name[model][field_name]
+      end
+
+      private
+
+      def first_by_name(fields, all: false)
+        fields.each_with_object({}) do |field, index|
+          name = field[:field].to_s
+          all ? (index[name] ||= []) << field : index[name] ||= field
+        end
+      end
+    end
+  end
+end

data/app/services/forest_liana/ability/permission.rb

@@ -86,6 +86,10 @@ module ForestLiana
       def redact_fields(user, root_model, fields_hash, named_collections:)
         return fields_hash if fields_hash.nil?
 
+        with_apimap_index { redact_indexed_fields(user, root_model, fields_hash, named_collections) }
+      end
+
+      def redact_indexed_fields(user, root_model, fields_hash, named_collections)
         root_name = ForestLiana.name_for(root_model)
 
         resolved = fields_hash.each_with_object({}) do |(collection_key, csv), acc|
@@ -131,6 +135,10 @@ module ForestLiana
       # caller cannot read. +root_model+ is pinned readable — +browse+/+read+ already gate it
       # upstream — so it is never itself a refusal.
       def assert_can_read_query_fields(user, root_model, filter_paths: [], sort_paths: [], search_paths: [])
+        with_apimap_index { assert_indexed_query_fields(user, root_model, filter_paths, sort_paths, search_paths) }
+      end
+
+      def assert_indexed_query_fields(user, root_model, filter_paths, sort_paths, search_paths)
         root_name = ForestLiana.name_for(root_model)
 
         usages = filter_paths.map { |path| query_usage('filter on', root_model, path) } +
@@ -352,29 +360,39 @@ module ForestLiana
       end
 
       def smart_belongs_to_field(model, field_name)
-        forest_collection_for(model)&.fields_smart_belongs_to&.find { |field| field[:field].to_s == field_name }
+        apimap_index.smart_belongs_to(model, field_name)
       end
 
       # SchemaAdapter drops a relation to an excluded model, but keeps one whose target is missing from
       # the apimap otherwise (a table absent at boot, a secondary database unreachable): skipped alike.
       # A polymorphic relation's reference names the association, never one of its targets, so it stays.
       def only_computed_smart_field?(model, field_name, unexposed_targets)
-        fields = forest_collection_for(model)&.fields.to_a.select { |field| field[:field].to_s == field_name }
-        fields = fields.reject do |field|
+        fields = apimap_index.fields_named(model, field_name).reject do |field|
           !field[:is_virtual] && unexposed_targets.include?(field[:reference].to_s.split('.').first)
         end
 
         fields.any? && fields.all? { |field| field[:is_virtual] && field[:reference].nil? && field[:integration].nil? }
       end
 
-      def forest_collection_for(model)
-        ForestLiana.apimap.find { |collection| collection.name.to_s == ForestLiana.name_for(model) }
+      def apimap_index
+        @apimap_index || ApimapIndex.new(ForestLiana.apimap)
+      end
+
+      def with_apimap_index
+        return yield if @apimap_index
+
+        @apimap_index = ApimapIndex.new(ForestLiana.apimap)
+        begin
+          yield
+        ensure
+          @apimap_index = nil
+        end
       end
 
       # No role can ever be granted `read` on a collection absent from the apimap — a denial
       # message naming it as unreadable would point at a permission nobody can grant.
       def collection_exposed?(collection_name)
-        ForestLiana.apimap.any? { |collection| collection.name.to_s == collection_name }
+        apimap_index.exposed?(collection_name)
       end
 
       # unexposed/also_denied (each present iff non-empty) tell UnauthorizedFieldsError which of

data/lib/forest_liana/version.rb

@@ -1,3 +1,3 @@
 module ForestLiana
-  VERSION = "9.22.8"
+  VERSION = "9.22.9"
 end

data/spec/requests/projection_header_spec.rb

@@ -225,6 +225,19 @@ describe 'Requesting resources with the Forest-Projection header', :type => :req
       expect(body['data']['relationships'].values.map(&:keys).uniq).to eq [%w[links]]
     end
 
+    # has_many_relationships rebuilds every to-many of the record. Called once per link it is
+    # quadratic in the to-many count, which on a wide collection outweighs the whole get-one.
+    it 'builds the to-many relationships once, however many links the record carries' do
+      builds = 0
+      allow_any_instance_of(ForestLiana::UserSpace::UserSerializer).to receive(:has_many_relationships)
+        .and_wrap_original { |original| builds += 1; original.call }
+
+      get "/forest/User/#{@user.id}", headers: projecting('id,name')
+
+      expect(body['data']['relationships'].keys.size).to eq 7
+      expect(builds).to eq 1
+    end
+
     # selects_from anchors on the query's own FROM, which a `selects_of('users')` filter would
     # not: a to-many preload reads FROM "trees" and names "trees_users", never `"users"`, so it
     # would be dropped before any assertion could see it.

data/spec/services/forest_liana/ability/assert_can_read_query_fields_spec.rb

@@ -67,6 +67,20 @@ module ForestLiana
           expect { dummy_class.assert_can_read_query_fields(user, Tree) }.not_to raise_error
         end
 
+        it 'reads the apimap once, however many paths are checked' do
+          write_permissions('Tree' => true, 'User' => true, 'Island' => true)
+          reads = 0
+          allow(ForestLiana).to receive(:apimap).and_wrap_original { |original| reads += 1; original.call }
+
+          expect do
+            dummy_class.assert_can_read_query_fields(
+              user, Tree, filter_paths: %w[owner:name island:name], sort_paths: %w[cutter:name name],
+                          search_paths: %w[owner:title]
+            )
+          end.not_to raise_error
+          expect(reads).to eq 1
+        end
+
         it 'serves a filter, a sort and a search on an unreadable collection once the option is on' do
           write_permissions('Tree' => true, 'Island' => false)
           ForestLiana.skip_relation_read_permissions = true

data/spec/services/forest_liana/ability/redact_fields_spec.rb

@@ -167,6 +167,22 @@ module ForestLiana
             .to eq('Tree' => 'id,name,island', 'Island' => 'name')
         end
 
+        # Resolving each field against the apimap rescans every collection: on a wide collection and
+        # a large schema, that cost outweighs the request it guards.
+        it 'reads the apimap once, however many fields are requested' do
+          write_permissions('Tree' => true, 'User' => true, 'Island' => true)
+          reads = 0
+          allow(ForestLiana).to receive(:apimap).and_wrap_original { |original| reads += 1; original.call }
+
+          redacted = dummy_class.redact_fields(
+            user, Tree, { 'Tree' => 'id,name,age,owner,cutter,island', 'owner' => 'name', 'island' => 'name' },
+            named_collections: %w[Tree owner island]
+          )
+
+          expect(redacted).to eq('Tree' => 'id,name,age,owner,cutter,island', 'owner' => 'name', 'island' => 'name')
+          expect(reads).to eq 1
+        end
+
         it 'checks nothing at all when only root collection fields are requested' do
           write_permissions({})
           expect_any_instance_of(ForestLiana::Ability::Fetch).not_to receive(:get_permissions)

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: forest_liana
 version: !ruby/object:Gem::Version
-  version: 9.22.8
+  version: 9.22.9
 platform: ruby
 authors:
 - Sandro Munda
 autorequire:
 bindir: bin
 cert_chain: []
-date: 2026-10-07 00:00:00.000000000 Z
+date: 2026-10-09 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: rails
@@ -276,6 +276,7 @@ files:
 - app/serializers/forest_liana/stripe_payment_serializer.rb
 - app/serializers/forest_liana/stripe_subscription_serializer.rb
 - app/services/forest_liana/ability.rb
+- app/services/forest_liana/ability/apimap_index.rb
 - app/services/forest_liana/ability/exceptions/access_denied.rb
 - app/services/forest_liana/ability/exceptions/action_condition_error.rb
 - app/services/forest_liana/ability/exceptions/approval_selection_too_large.rb