diff --git a/app/controllers/topics_controller.rb b/app/controllers/topics_controller.rb index 253f1ec1..b0fd4057 100644 --- a/app/controllers/topics_controller.rb +++ b/app/controllers/topics_controller.rb @@ -24,7 +24,7 @@ class TopicsController < ApplicationController respond_to do |format| format.html do - @alltopics = [@topic].concat(policy_scope(Topic.relatives1(@topic.id)).to_a).concat(policy_scope(Topic.relatives2(@topic.id)).to_a) + @alltopics = [@topic].concat(policy_scope(Topic.relatives1(@topic.id, current_user)).to_a).concat(policy_scope(Topic.relatives2(@topic.id, current_user)).to_a) @allsynapses = policy_scope(Synapse.for_topic(@topic.id)).to_a puts @alltopics.length puts @allsynapses.length @@ -42,7 +42,7 @@ class TopicsController < ApplicationController @topic = Topic.find(params[:id]) authorize @topic - @alltopics = [@topic].concat(policy_scope(Topic.relatives1(@topic.id)).to_a).concat(policy_scope(Topic.relatives2(@topic.id)).to_a) + @alltopics = [@topic].concat(policy_scope(Topic.relatives1(@topic.id, current_user)).to_a).concat(policy_scope(Topic.relatives2(@topic.id, current_user)).to_a) @allsynapses = policy_scope(Synapse.for_topic(@topic.id)) @allcreators = @alltopics.map(&:user).uniq diff --git a/app/models/topic.rb b/app/models/topic.rb index 4ff6ac50..4cb58f65 100644 --- a/app/models/topic.rb +++ b/app/models/topic.rb @@ -42,16 +42,34 @@ class Topic < ActiveRecord::Base topics1 + topics2 end - scope :relatives1, ->(topic_id = nil) { - includes(:topics1) - .where('synapses.node1_id = ?', topic_id) - .references(:synapses) + scope :relatives1, ->(topic_id = nil, user = nil) { + visible = %w(public commons) + permission = 'synapses.permission IN (?)' + if user + synapse_permission = permission + ' OR synapses.defer_to_map_id IN (?) OR synapses.user_id = ?' + return includes(:topics1) + .where('synapses.node1_id = ? AND (' + synapse_permission + ')', topic_id, visible, user.shared_maps.map(&:id), user.id) + .references(:synapses) + else + return includes(:topics1) + .where('synapses.node1_id = ? AND (' + permission + ')', topic_id, visible) + .references(:synapses) + end } - scope :relatives2, ->(topic_id = nil) { - includes(:topics2) - .where('synapses.node2_id = ?', topic_id) - .references(:synapses) + scope :relatives2, ->(topic_id = nil, user = nil) { + visible = %w(public commons) + permission = 'synapses.permission IN (?)' + if user + synapse_permission = permission + ' OR synapses.defer_to_map_id IN (?) OR synapses.user_id = ?' + return includes(:topics2) + .where('synapses.node2_id = ? AND (' + synapse_permission + ')', topic_id, visible, user.shared_maps.map(&:id), user.id) + .references(:synapses) + else + return includes(:topics2) + .where('synapses.node2_id = ? AND (' + permission + ')', topic_id, visible) + .references(:synapses) + end } delegate :name, to: :user, prefix: true