jpie 4.1.5 → 4.1.6

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 618cb164f0b64934d5cd9a0c6e871b726bcc6b40f4add24c3204bea490a0cd5c
-  data.tar.gz: f4acc02e6f57760deae01dc2d4c49acb29fb5273acefb3eac290f7519e3f53d4
+  metadata.gz: 88daaadec0328fdb557e2376e20763a99dcefb98ba869e5d94230bda9c055b88
+  data.tar.gz: 20effbb785465921ecd1aa325c23d7207c6db317948f66c643483a999ae01372
 SHA512:
-  metadata.gz: b83a3b08c429dc700144718b112c578bb9c67243a05a2400ef7fdd9055f614e50852e4819bd63c6897e04cf168eee09e1f7d2b606da39340b9dc6acd2e723b8a
-  data.tar.gz: 79f17c229521c0c99541e9787e298e9e00268996759ca8a54f67fec95f212f3cd7f124ea672d8c9da65f65546c6ad02794c971b49a8a8fef7b874883eb601760
+  metadata.gz: 3643d03bdf7acec6532241e282379e7b9bd3fe6f3dffad7b5d753ba23ce642d0b1c0ebe30962c03cde53a38d7a747acae589d002d702d5243c4112f80bda980a
+  data.tar.gz: 7dbaa3e703ecc13f432a54341d39f357a860896efef6b078572be24e78258658bb343c0a49eb1b3ad0600362c296ab4d620943da21d1bc7ff766b8ed33b27b1e

data/CHANGELOG.md

@@ -7,6 +7,38 @@ at release time.
 
 ## [Unreleased]
 
+## [4.1.6] - 2026-11-13
+
+### Fixed
+
+- **Keep a primary record out of `included`.** A primary record that an include
+  reached again was serialized a second time, with its meta and computed
+  attributes, and sent in `included`. JSON:API allows one resource object for
+  each type and id in a document. Every primary now counts as seen before the
+  include walk starts. The walk still goes past it to the records behind it.
+
+### Added
+
+- **`Resource.included_preloads` to give an included record lighter preloads.**
+  The include walk ran the full `records` preloads of a resource on every
+  record that another resource included. An included record serializes only
+  the relationships its include path names, so a deep preload for the
+  resource's own response (a conversation's messages, for example) loaded rows
+  the response never read. `included_preloads` returns the preloads of
+  `records` by default, so nothing changes until a resource overrides it.
+  Regression spec: `included_preloads_spec.rb`.
+
+### Changed
+
+- **Compare the query values, not two SQL strings, to see if the hook narrowed
+  an include scope.** The include filter cache built the SQL of the resource
+  scope and of the authorized scope for each included class, in each request.
+  It now compares the values of the two relations and builds no SQL. A narrowed
+  scope still reads as narrowed. A scope the hook leaves unchanged still reads
+  as not narrowed. The documents do not change. On the Kiln test app, the
+  compare allocates 740 objects for each class before and 18 after.
+- A sparse fieldset now limits which attributes the serializer reads. It read every attribute of every record and cut the fieldset out afterwards, so a resource method outside the fieldset ran for every row.
+
 ## [4.1.5] - 2026-11-11
 
 ### Fixed

data/lib/json_api/controllers/concerns/resource_actions/include_preloading.rb

@@ -103,8 +103,7 @@ module JSONAPI
       end
 
       def resource_preload_values(klass)
-        scope = ResourceLoader.find_for_model(klass, namespace: jsonapi_namespace).records
-        scope.preload_values + scope.includes_values
+        ResourceLoader.find_for_model(klass, namespace: jsonapi_namespace).included_preloads
       end
     end
   end

data/lib/json_api/controllers/concerns/resource_actions/serialization.rb

@@ -41,6 +41,9 @@ module JSONAPI
         shared_context = JSONAPI::Serialization::IncludeContext.new(
           fields: fields, included_records: [], processed: Set.new, all_includes: nil,
         )
+        # A primary that an include reaches again belongs in `data` alone. Mark every primary
+        # before the first walk, so no walk serializes it a second time.
+        resources.each { |r| shared_context.processed.add([r.class, r.id]) }
         cache = build_include_filter_cache(resources, includes)
 
         data = resources.map do |r|

data/lib/json_api/resources/concerns/included_preloads.rb

@@ -0,0 +1,22 @@
+# frozen_string_literal: true
+
+module JSONAPI
+  module Resources
+    module IncludedPreloads
+      extend ActiveSupport::Concern
+
+      class_methods do
+        # The preloads the include walk runs on this resource's records when
+        # another resource reaches them through `?include=`. By default they
+        # are the preloads of `records`. Override it when `records` preloads
+        # more than an included record needs. An included record serializes
+        # only the relationships its include path names, so a deep preload
+        # that feeds the resource's own response is wasted there.
+        def included_preloads
+          scope = records
+          scope.preload_values + scope.includes_values
+        end
+      end
+    end
+  end
+end

data/lib/json_api/resources/resource.rb

@@ -6,6 +6,7 @@ require_relative "concerns/sortable_fields_dsl"
 require_relative "concerns/relationships_dsl"
 require_relative "concerns/meta_dsl"
 require_relative "concerns/model_class_helpers"
+require_relative "concerns/included_preloads"
 
 module JSONAPI
   class Resource
@@ -15,6 +16,7 @@ module JSONAPI
     include Resources::RelationshipsDsl
     include Resources::MetaDsl
     include Resources::ModelClassHelpers
+    include Resources::IncludedPreloads
 
     class << self
       attr_accessor :type_format

data/lib/json_api/serialization/concerns/attributes_serialization.rb

@@ -7,10 +7,7 @@ module JSONAPI
         type_fields = extract_type_fields(fields)
         return {} if type_fields.empty? && fields.any?
 
-        attributes = build_attributes_hash
-        return attributes if type_fields.empty?
-
-        attributes.slice(*type_fields.map(&:to_sym))
+        build_attributes_hash(type_fields.map(&:to_sym))
       end
 
       private
@@ -19,11 +16,15 @@ module JSONAPI
         fields[record_type.to_sym] || []
       end
 
-      def build_attributes_hash
+      # A sparse fieldset names the attributes to send, so only those are read. Building
+      # every attribute and slicing afterwards paid for each unrequested resource method on
+      # every row. The keys keep the order of the fieldset, as the slice did.
+      def build_attributes_hash(requested)
         permitted_attrs = definition.permitted_attributes
+        wanted = requested.empty? ? permitted_attrs : requested.select { |attr_sym| permitted_attrs.include?(attr_sym) }
         attributes = {}
 
-        permitted_attrs.each do |attr_sym|
+        wanted.each do |attr_sym|
           attributes[attr_sym] = get_attribute_value(definition_instance, attr_sym)
         end
 

data/lib/json_api/serialization/concerns/includes_serialization.rb

@@ -28,6 +28,7 @@ module JSONAPI
 
         ctx = context || build_include_context(fields, all_includes)
         ctx.all_includes ||= all_includes
+        ctx.processed.add(build_record_key(record))
         all_includes.each { |path| serialize_include_path(record, path_walk_for(path, ctx), 0, ctx) }
         ctx.included_records
       end

data/lib/json_api/serialization/include_filter_cache.rb

@@ -75,12 +75,23 @@ module JSONAPI
         Entry.new(
           base_scope: base_scope,
           authorized_scope: authorized_scope,
-          narrowed: authorized_scope.to_sql != base_scope.to_sql,
+          narrowed: narrowed?(authorized_scope, base_scope),
           where_clause_empty: base_scope.where_clause.empty?,
           where_hash: where_hash_for(base_scope, klass),
         )
       end
 
+      # A scope the hook leaves as it found it keeps the same query values, so the
+      # compare reads them and builds no SQL. Building both statements for every
+      # included class cost thousands of objects per request. Two scopes whose
+      # values differ but whose SQL matches read as narrowed. That only adds a
+      # vetting query: the verdicts come from the same SQL.
+      def narrowed?(authorized_scope, base_scope)
+        return false if authorized_scope.equal?(base_scope)
+
+        authorized_scope.values != base_scope.values
+      end
+
       # Mirrors the serializer's include authorization: no context (serializer
       # used outside a request) or no configured hook leaves the scope untouched.
       def apply_authorization(scope, klass)

data/lib/json_api/version.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
 
 module JSONAPI
-  VERSION = "4.1.5"
+  VERSION = "4.1.6"
 end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: jpie
 version: !ruby/object:Gem::Version
-  version: 4.1.5
+  version: 4.1.6
 platform: ruby
 authors:
 - Emil Kampp
@@ -135,6 +135,7 @@ files:
 - lib/json_api/resources/active_storage_blob_resource.rb
 - lib/json_api/resources/concerns/attributes_dsl.rb
 - lib/json_api/resources/concerns/filters_dsl.rb
+- lib/json_api/resources/concerns/included_preloads.rb
 - lib/json_api/resources/concerns/meta_dsl.rb
 - lib/json_api/resources/concerns/model_class_helpers.rb
 - lib/json_api/resources/concerns/relationships_dsl.rb