From 24c4f7d631a997d8df42f7691b57f627f72bc2f6 Mon Sep 17 00:00:00 2001
From: Connor Turland <connorturland@gmail.com>
Date: Mon, 17 Oct 2016 01:15:18 -0400
Subject: [PATCH] make some things more explicit

---
 app/models/user.rb             | 1 +
 app/policies/mapping_policy.rb | 2 ++
 app/policies/message_policy.rb | 2 ++
 app/policies/synapse_policy.rb | 3 +--
 app/policies/topic_policy.rb   | 2 +-
 5 files changed, 7 insertions(+), 3 deletions(-)

diff --git a/app/models/user.rb b/app/models/user.rb
index 8993054a..52d6ef09 100644
--- a/app/models/user.rb
+++ b/app/models/user.rb
@@ -66,6 +66,7 @@ class User < ApplicationRecord
   end
   
   def all_accessible_maps
+    #TODO: is there a way to keep this an ActiveRecord relation?
     maps + shared_maps
   end
 
diff --git a/app/policies/mapping_policy.rb b/app/policies/mapping_policy.rb
index d9d230d7..6cdb7e9b 100644
--- a/app/policies/mapping_policy.rb
+++ b/app/policies/mapping_policy.rb
@@ -10,6 +10,8 @@ class MappingPolicy < ApplicationPolicy
       permission = 'maps.permission IN (?)'
       return scope.joins(:map).where(permission, visible) unless user
 
+      # if this is getting changed, the policy_scope for messages should also be changed
+      # as it is based entirely on the map to which it belongs
       scope.joins(:map).where(permission, visible)
            .or(scope.joins(:map).where('maps.id IN (?)', user.shared_maps.map(&:id)))
            .or(scope.joins(:map).where('maps.user_id = ?', user.id))
diff --git a/app/policies/message_policy.rb b/app/policies/message_policy.rb
index 0c37d800..c32e29ed 100644
--- a/app/policies/message_policy.rb
+++ b/app/policies/message_policy.rb
@@ -6,6 +6,8 @@ class MessagePolicy < ApplicationPolicy
       permission = 'maps.permission IN (?)'
       return scope.joins(:map).where(permission, visible) unless user
 
+      # if this is getting changed, the policy_scope for mappings should also be changed
+      # as it is based entirely on the map to which it belongs
       scope.joins(:map).where(permission, visible)
            .or(scope.joins(:map).where('maps.id IN (?)', user.shared_maps.map(&:id)))
            .or(scope.joins(:map).where('maps.user_id = ?', user.id))
diff --git a/app/policies/synapse_policy.rb b/app/policies/synapse_policy.rb
index 863ab17b..f3d2c997 100644
--- a/app/policies/synapse_policy.rb
+++ b/app/policies/synapse_policy.rb
@@ -3,11 +3,10 @@ class SynapsePolicy < ApplicationPolicy
   class Scope < Scope
     def resolve
       visible = %w(public commons)
-
       return scope.where(permission: visible) unless user
 
       scope.where(permission: visible)
-           .or(scope.where(defer_to_map_id: user.all_accessible_maps.map(&:id)))
+           .or(scope.where.not(defer_to_map_id: nil).where(defer_to_map_id: user.all_accessible_maps.map(&:id)))
            .or(scope.where(user_id: user.id))
     end
   end
diff --git a/app/policies/topic_policy.rb b/app/policies/topic_policy.rb
index d51bb062..cf091662 100644
--- a/app/policies/topic_policy.rb
+++ b/app/policies/topic_policy.rb
@@ -6,7 +6,7 @@ class TopicPolicy < ApplicationPolicy
       return scope.where(permission: visible) unless user
 
       scope.where(permission: visible)
-           .or(scope.where(defer_to_map_id: user.all_accessible_maps.map(&:id)))
+           .or(scope.where.not(defer_to_map_id: nil).where(defer_to_map_id: user.all_accessible_maps.map(&:id)))
            .or(scope.where(user_id: user.id))
     end
   end