wireframe / multitenant

making cross tenant data leaks a thing of the past.
http://blog.codecrate.com/2011/03/multitenant-locking-down-your-app-and.html
MIT License
164 stars 36 forks source link

#with_tenant method doesn't do it's job for ActiveRecord relations #11

Open k-rudy opened 11 years ago

k-rudy commented 11 years ago

The problem I have faced is the following: with_tenant method works correctly only for cases where ActiveRecord relation queries db inside the with_tenant block. Otherwise, it is simply ignored.

In other words it works fine here (let's say there are 4 items and only 3 are with the tenant):

Multitenant.with_tenant @tenant do
  @items = Item.where("name IS NOT NULL").to_a 
end
puts @items.count # 3; all correct

But fails to work here:

Multitenant.with_tenant @tenant do
  @items = Item.where("name IS NOT NULL")
end
puts @items.count # 4; incorrect!

Spec that indicates the failure can be found here 81fcb097f1

wireframe commented 11 years ago

This looks to be working as expected since ActiveRecord::Relation is lazily evaluated. The current_tenant attribute is unset after the block has been run, and so invoking count or each outside of the with_tenant block will not add the extra query scope information.

If there is a way to support this usecase, I'm all for it. Do you have any suggestions or patches that work around the issue?

k-rudy commented 11 years ago

@wireframe thanks for your input however personally for me this was not an expected behavior. If this is not gonna be fixed I would recommend adding a sort of note to the readme file about the fact that Relation should be compiled (evaluated) inside the with_tenant block.