Use helper methods for checking visible_to_user? for Event collections

Explanation

This logic (or very similar) appears multiple places in the app:

events.count { |event| event.visible_to_user?(current_user) }

It makes sense to abstract this logic into a method to eliminate repetition (DRY principle) and make changes to this logic easy. That is especially true because this logic is security-sensitive (this change was actually proposed in a related security fix).

Proposal

Helper methods are used for Event "visible_to_user" checking.

Technical notes

Some locations where this code (or similar) is used:

  • count
    • app/controllers/dashboard_controller
    • app/controllers/groups_controller.rb
    • app/controllers/projects_controller.rb
    • app/controllers/users_controller.rb
  • select
    • app/finders/events_finder.rb

Optionally, it would be nice to preload the records required for the permission check (event record), to prevent N+1 queries.

Edited Mar 25, 2020 by Dan Jensen
Assignee Loading
Time tracking Loading