artsy/garner — pull request #68 by mzikherman (2014-07-16 21:47:17+00:00)
Title: @fancyremarker => Failing spec for garnered_find not respecting chained criteria

Ahoy there!

Here is a failing spec that shows ```garnered_find``` not respecting chained criteria.

I would expect ```@monger_who_is_a_thug.cheeses.garnered_find("cheddar")``` to return nothing, since cheddar is not one of this monger's cheeses.

I'm realizing in our API, we do build up scopes/chain criteria and then call garnered_find at the end on some object. This means that someone can make an API call for something they are authorized for, but pass in an object id for something else and get it. Something like ```partner.artworks.garnered_find(id)``` means that if you pass in the id of _any_ artwork, as long as you have access to the given partner, you'll be able to get the details of a completely different private work.

Let me know if you think this is something we should fix in Garner, I'll try it out. I am thinking that the criteria used for the lookup needs to be added to the identity.