jpie 4.1.0 → 4.1.1.pre.202609280317

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 5c04100490b218fa6dbef0035d581acd97ec7ebae03d045d0966a633bdcfb567
-  data.tar.gz: 116d6e4ae7f51f03a47f8222771f2fb508435fce759014eadd3a02642a4f7b85
+  metadata.gz: 89f25c649293b22832412f92bcf29361b881deaf953d6b2db661736e226abd8d
+  data.tar.gz: 4256bc8778bf8968c852fb901f753fe433b3ed21776a02ea2445f86f179a05c2
 SHA512:
-  metadata.gz: e86bd604abba1b02e6148d857a2967a05b90a35c796503f2517d25368cbb95a8c102afddc2208a8f77961085bc041a55e27e6b6d0f304b37ed9404362fbf64eb
-  data.tar.gz: 3ec3bda5b8ce2e07fb494f790cbc20391b37fd12a9f57c6a352b3129a9037246116d68440f70cb86b17e3ca424ad6bd4efdbba174b3af8825cb1149bfc59fbb5
+  metadata.gz: 5384c6655800b556886f7ba54510c982fb2432fdcdde2439c1ce90f5d77bd10de6094973e0f6bed8c01f22a32c064de5c255b133c87c2395cbc4c12f9948e9b4
+  data.tar.gz: 9b72004eb39131a37d9e289e9c0103f88f17ebffd48df26a5ff0ee93337af855e7932c1965468a2d8ca0a4300180dba6e37897964cc124e26d2076cfe2aff536

data/CHANGELOG.md

@@ -7,6 +7,19 @@ at release time.
 
 ## [Unreleased]
 
+### Fixed
+
+- **Vet a partial where hash in the database, not in memory.**
+  `IncludeFilterCache#filter` matched sideloaded records against
+  `where_values_hash`. That hash holds only the conditions ActiveRecord
+  expresses as a hash, and drops `where.not`, raw SQL, joins and ranges. A
+  resource whose `records` scope mixed both kinds lost the half the hash could
+  not carry, so an `?include=` surfaced records the related endpoint hides. The
+  hash now stands in for the scope only when it reproduces the whole where
+  clause; otherwise `filter` and `warm` vet ids in the database against the
+  full scope. Regression spec:
+  `include_filter_partial_where_hash_bypass_spec.rb`.
+
 ## [4.1.0] - 2026-09-15
 
 ### Fixed

data/lib/json_api/serialization/include_filter_cache.rb

@@ -76,12 +76,29 @@ module JSONAPI
         handler.call(controller: @authorization_context, scope:, action: :index, model_class: klass)
       end
 
+      # The hash stands in for the scope only when it reproduces the whole where
+      # clause. `where_values_hash` keeps the conditions ActiveRecord expresses
+      # as a hash and drops the rest: `where.not`, raw SQL, joins and ranges. A
+      # scope that mixes both kinds would otherwise lose the half the hash
+      # cannot carry, and an include would surface records the related endpoint
+      # hides. Return {} for a partial hash, so #filter and #warm vet ids in the
+      # database against the full scope.
       def where_hash_for(scope, klass)
-        scope.where_values_hash(klass.table_name)
+        hash = scope.where_values_hash(klass.table_name)
+        return {} if hash.blank?
+
+        whole_clause?(scope, hash) ? hash : {}
       rescue StandardError
         {}
       end
 
+      # Rebuilds the clause from the hash on the same relation and compares the
+      # SQL. Rebuilding on `klass.unscoped` instead would repeat the condition
+      # an STI subclass already carries, and read every STI resource as partial.
+      def whole_clause?(scope, hash)
+        scope.unscope(:where).where(hash).only(:where).to_sql == scope.only(:where).to_sql
+      end
+
       def matches_where_hash?(record, hash)
         hash.all? do |attr, val|
           r_val = record.read_attribute(attr)

data/lib/json_api/version.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
 
 module JSONAPI
-  VERSION = "4.1.0"
+  VERSION = "4.1.1.pre.202609280317"
 end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: jpie
 version: !ruby/object:Gem::Version
-  version: 4.1.0
+  version: 4.1.1.pre.202609280317
 platform: ruby
 authors:
 - Emil Kampp