AO3-7468 Preload current_user roles

app/controllers/admin/admin_users_controller.rb

@@ -11,7 +11,7 @@ def set_roles
   end
 
   def load_user
-    @user = User.find_by!(login: params[:id])
+    @user = User.includes(:roles).find_by!(login: params[:id])
   end
 
   def user_is_banned

app/models/user.rb

@@ -274,6 +274,12 @@ def self.find_first_by_auth_conditions(tainted_conditions, options = {})
     relation.first
   end
 
+  # Override of Devise method to preload roles for permission checks.
+  def self.serialize_from_session(key, salt)
+    record = includes(:roles).where(primary_key => key).first
+    record if record && record.authenticatable_salt == salt
+  end
+
   def self.for_claims(claims_ids)
     joins(:request_claims)
       .where("challenge_claims.id IN (?)", claims_ids)

app/views/admin/admin_users/_user_form.html.erb

@@ -12,7 +12,7 @@
   <td><%= text_field_tag "user[email]", user.email, title: ts("Email"), disabled: !admin_can_update_user_email? %></td>
   <% for role in @roles %>
     <td>
-      <%= check_box_tag "user[roles][]", role.id, user.roles.include?(role), title: role.name, id: "user_roles_#{role.id}", disabled: !policy(User).can_edit_user_role?(role) %>
+      <%= check_box_tag "user[roles][]", role.id, user.has_role?(role.name), title: role.name, id: "user_roles_#{role.id}", disabled: !policy(User).can_edit_user_role?(role) %>
     </td>
   <% end %>
   <td>

spec/controllers/admin/admin_users_controller_spec.rb

@@ -160,6 +160,14 @@
         expect(response).to have_http_status(:success)
       end
 
+      it "preloads the user's roles" do
+        fake_login_admin(admin)
+        expect(User).to receive(:includes).with(:roles).and_call_original
+        get :show, params: { id: user.login }
+
+        expect(assigns(:user).association(:roles)).to be_loaded
+      end
+
       it "if user does not exist, raises a 404" do
         fake_login_admin(admin)
         params = { id: "not_existing_id" }

spec/models/user_spec.rb

@@ -1,6 +1,34 @@
 require "spec_helper"
 
 describe User do
+  describe ".serialize_from_session" do
+    let(:role) { create(:role) }
+    let(:user) { create(:user, roles: [role]) }
+
+    it "returns the user with roles loaded when the salt matches" do
+      deserialized_user = described_class.serialize_from_session(user.to_key, user.authenticatable_salt)
+
+      expect(deserialized_user).to eq(user)
+      expect(deserialized_user.association(:roles)).to be_loaded
+      expect(deserialized_user.roles).to contain_exactly(role)
+      expect(Role).not_to receive(:find_by)
+      expect(deserialized_user.has_role?(role.name)).to be(true)
+    end
+
+    it "loads the roles association when the user has no roles" do
+      user = create(:user)
+
+      deserialized_user = described_class.serialize_from_session(user.to_key, user.authenticatable_salt)
+
+      expect(deserialized_user.association(:roles)).to be_loaded
+      expect(deserialized_user.roles).to be_empty
+    end
+
+    it "returns nil when the salt does not match" do
+      expect(described_class.serialize_from_session(user.to_key, "invalid salt")).to be_nil
+    end
+  end
+
   describe "audits" do
     let(:user) { create(:user) }