stffn/declarative_authorization — pull request #170 by bwlang (2013-01-16 20:28:05+00:00)
Title: removes harmful OR (1=1)

This fixes a problem in which sql like this can be generated:

SELECT DISTINCT ON ("screening_projects".id) "screening_projects".id, screening_projects.display_order AS alias_0
FROM "screening_projects"
LEFT OUTER JOIN "screening_project_roles" ON ("screening_projects"."id" = "screening_project_roles"."screening_project_id")
LEFT OUTER JOIN "roles" ON ("roles"."id" = "screening_project_roles"."role_id")
WHERE (("roles"."id" IN (3,4,5)) OR (1=1))

(note the extra 1=1 that emasculates the "id in..." subquery)
in response to an if_attribute rule like this:

if_attribute :roles => intersects_with {user.roles}