scoping on topic json properties (#813)

app/controllers/maps_controller.rb

@@ -83,7 +83,7 @@ class MapsController < ApplicationController
   # GET maps/:id/contains
   def contains
     respond_to do |format|
-      format.json { render json: @map.contains(current_user) }
+      format.json { render json: @map.contains(current_user).to_json(user: current_user) }
     end
   end
 

app/controllers/topics_controller.rb

@@ -11,11 +11,11 @@ class TopicsController < ApplicationController
   def autocomplete_topic
     term = params[:term]
     if term && !term.empty?
-      @topics = policy_scope(Topic.where('LOWER("name") like ?', term.downcase + '%')).order('"name"')
+      @topics = policy_scope(Topic).where('LOWER("name") like ?', term.downcase + '%').order('"name"')
       @mapTopics = @topics.select { |t| t.metacode.name == 'Metamap' }
       # prioritize topics which point to maps, over maps
       @exclude = @mapTopics.length > 0 ? @mapTopics.map(&:name) : ['']
-      @maps = policy_scope(Map.where('LOWER("name") like ? AND name NOT IN (?)', term.downcase + '%', @exclude)).order('"name"')
+      @maps = policy_scope(Map).where('LOWER("name") like ? AND name NOT IN (?)', term.downcase + '%', @exclude).order('"name"')
     else
       @topics = []
       @maps = []
@@ -39,7 +39,7 @@ class TopicsController < ApplicationController
 
         respond_with(@allsynapses, @alltopics, @allcreators, @topic)
       end
-      format.json { render json: @topic }
+      format.json { render json: @topic.to_json(user: current_user) }
     end
   end
 
@@ -55,9 +55,9 @@ class TopicsController < ApplicationController
     @allcreators += @allsynapses.map(&:user).uniq
 
     @json = {}
-    @json['topic'] = @topic
+    @json['topic'] = @topic.to_json(user: current_user)
     @json['creators'] = @allcreators
-    @json['relatives'] = @alltopics
+    @json['relatives'] = @alltopics.to_json(user: current_user)
     @json['synapses'] = @allsynapses
 
     respond_to do |format|
@@ -114,7 +114,7 @@ class TopicsController < ApplicationController
     end
 
     @json = {}
-    @json['topics'] = alltopics
+    @json['topics'] = alltopics.to_json(user: current_user)
     @json['synapses'] = allsynapses
     @json['creators'] = allcreators
 
@@ -131,7 +131,7 @@ class TopicsController < ApplicationController
 
     respond_to do |format|
       if @topic.save
-        format.json { render json: @topic, status: :created }
+        format.json { render json: @topic.to_json(user: current_user), status: :created }
       else
         format.json { render json: @topic.errors, status: :unprocessable_entity }
       end

app/helpers/topics_helper.rb

@@ -15,8 +15,8 @@ module TopicsHelper
         permission: t.permission,
 
         rtype: is_map ? 'map' : 'topic',
-        inmaps: is_map ? [] : t.inmaps,
+        inmaps: is_map ? [] : t.inmaps(current_user),
-        inmapsLinks: is_map ? [] : t.inmapsLinks,
+        inmapsLinks: is_map ? [] : t.inmapsLinks(current_user),
         type: is_map ? metamapMetacode.name : t.metacode.name,
         typeImageURL: is_map ? metamapMetacode.icon : t.metacode.icon,
         mapCount: is_map ? 0 : t.maps.count,

app/models/topic.rb

@@ -59,28 +59,31 @@ class Topic < ApplicationRecord
     user.image.url
   end
 
-  def map_count
+  def map_count(user)
-    maps.count
+    Pundit.policy_scope(user, maps).count
   end
 
-  def synapse_count
+  def synapse_count(user)
-    synapses.count
+    Pundit.policy_scope(user, synapses).count
   end
 
-  def inmaps
+  def inmaps(user)
-    maps.map(&:name)
+    Pundit.policy_scope(user, maps).map(&:name)
   end
 
-  def inmapsLinks
+  def inmapsLinks(user)
-    maps.map(&:id)
+    Pundit.policy_scope(user, maps).map(&:id)
   end
 
   def calculated_permission
     defer_to_map&.permission || permission
   end
 
-  def as_json(_options = {})
+  def as_json(options = {})
-    super(methods: [:user_name, :user_image, :map_count, :synapse_count, :inmaps, :inmapsLinks, :calculated_permission, :collaborator_ids])
+    raise 'You must pass a user' unless options[:user].is_a? User
+    super(methods: [:user_name, :user_image, :calculated_permission, :collaborator_ids])
+      .merge(inmaps: inmaps(options[:user]), inmapsLinks: inmapsLinks(options[:user]),
+             map_count: map_count(options[:user]), synapse_count: synapse_count(options[:user]))
   end
 
   def collaborator_ids

app/views/maps/show.html.erb

@@ -12,7 +12,7 @@
     Metamaps.Active.Map = <%= @map.to_json.html_safe %>;
     Metamaps.Mappers = <%= @allmappers.to_json.html_safe %>;
     Metamaps.Collaborators = <%= @allcollaborators.to_json.html_safe %>;
-    Metamaps.Topics = <%= @alltopics.to_json.html_safe %>;
+    Metamaps.Topics = <%= @alltopics.to_json(user: current_user).html_safe %>;
     Metamaps.Synapses = <%= @allsynapses.to_json.html_safe %>;
     Metamaps.Mappings = <%= @allmappings.to_json.html_safe %>;
     Metamaps.Messages = <%= @allmessages.to_json.html_safe %>;

app/views/topics/show.html.erb

@@ -19,9 +19,9 @@
 <script>
     Metamaps.currentSection = "topic";
     Metamaps.currentPage = <%= @topic.id.to_s %>;
-    Metamaps.Active.Topic = <%= @topic.to_json.html_safe %>;
+    Metamaps.Active.Topic = <%= @topic.to_json(user: current_user).html_safe %>;
     Metamaps.Creators = <%= @allcreators.to_json.html_safe %>;
-    Metamaps.Topics = <%= @alltopics.to_json.html_safe %>;
+    Metamaps.Topics = <%= @alltopics.to_json(user: current_user).html_safe %>;
     Metamaps.Synapses = <%= @allsynapses.to_json.html_safe %>;
     Metamaps.Visualize.type = "RGraph";
 </script>