diff --git a/app/controllers/topics_controller.rb b/app/controllers/topics_controller.rb index fa7eada8..846c5469 100644 --- a/app/controllers/topics_controller.rb +++ b/app/controllers/topics_controller.rb @@ -40,7 +40,7 @@ class TopicsController < ApplicationController @topic = Topic.find(params[:id]) authorize @topic - @alltopics = [@topic].concat(policy_scope(Topic.relatives1(@topic.id, current_user)).to_a).concat(policy_scope(Topic.relatives2(@topic.id, current_user)).to_a) + @alltopics = [@topic].concat(policy_scope(Topic.relatives(@topic.id, current_user)).to_a) @allsynapses = policy_scope(Synapse.for_topic(@topic.id)) @allcreators = @alltopics.map(&:user).uniq @@ -64,7 +64,7 @@ class TopicsController < ApplicationController topicsAlreadyHas = params[:network] ? params[:network].split(',').map(&:to_i) : [] - @alltopics = policy_scope(Topic.relatives1(@topic.id)).to_a.concat(policy_scope(Topic.relatives2(@topic.id)).to_a).uniq + @alltopics = policy_scope(Topic.relatives(@topic.id, current_user)).to_a @alltopics.delete_if do |topic| !topicsAlreadyHas.index(topic.id).nil? end @@ -86,7 +86,7 @@ class TopicsController < ApplicationController topicsAlreadyHas = params[:network] ? params[:network].split(',').map(&:to_i) : [] - alltopics = policy_scope(Topic.relatives1(@topic.id)).to_a.concat(policy_scope(Topic.relatives2(@topic.id)).to_a).uniq + alltopics = policy_scope(Topic.relatives(@topic.id)).to_a alltopics.delete_if do |topic| !topicsAlreadyHas.index(topic.id.to_s).nil? end diff --git a/app/models/topic.rb b/app/models/topic.rb index 6ca214fe..a91c75fc 100644 --- a/app/models/topic.rb +++ b/app/models/topic.rb @@ -43,41 +43,13 @@ class Topic < ActiveRecord::Base end scope :relatives, ->(topic_id = nil, user = nil) { + # should only see topics through *visible* synapses + # e.g. Topic A (commons) -> synapse (private) -> Topic B (commons) must be filtered out synapses = Pundit.policy_scope(user, Synapse.where(node1_id: topic_id)).pluck(:node2_id) synapses += Pundit.policy_scope(user, Synapse.where(node2_id: topic_id)).pluck(:node1_id) where(id: synapses.uniq) } - scope :relatives1, ->(topic_id = nil, user = nil) { - visible = %w(public commons) - permission = 'synapses.permission IN (?)' - if user - synapse_permission = permission + ' OR synapses.defer_to_map_id IN (?) OR synapses.user_id = ?' - return includes(:topics1) - .where('synapses.node1_id = ? AND (' + synapse_permission + ')', topic_id, visible, user.shared_maps.map(&:id), user.id) - .references(:synapses) - else - return includes(:topics1) - .where('synapses.node1_id = ? AND (' + permission + ')', topic_id, visible) - .references(:synapses) - end - } - - scope :relatives2, ->(topic_id = nil, user = nil) { - visible = %w(public commons) - permission = 'synapses.permission IN (?)' - if user - synapse_permission = permission + ' OR synapses.defer_to_map_id IN (?) OR synapses.user_id = ?' - return includes(:topics2) - .where('synapses.node2_id = ? AND (' + synapse_permission + ')', topic_id, visible, user.shared_maps.map(&:id), user.id) - .references(:synapses) - else - return includes(:topics2) - .where('synapses.node2_id = ? AND (' + permission + ')', topic_id, visible) - .references(:synapses) - end - } - delegate :name, to: :user, prefix: true def user_image