Cache context based on record

[NuckChorris]

We allow access to certain fields on the user (email, etc.) only if context[:current_user] == record but this can't currently be used with caching in any reasonable manner.

For now I'm just caching a copy for each user who sees it, but that's absurd and definitely not what we need. Is there a better solution, or would it be possible to get the record inside Resource.attribute_caching_context(context)?

[lgebhardt]

edit: @DavidMikeSimon's comment below corrected a misunderstanding on my part, so deleting bad advice.

[DavidMikeSimon]

Actually, this should already be correctly handled by the default config; the cache entries are keyed by the serializer configuration, including the field list. Therefore if there are two user views only (with and without the private fields), then each user record should have at most two active cache entries.

edit: Argh I made a mistake here! Please see comment below @NuckChorris

[lgebhardt]

@DavidMikeSimon Thanks for the correction. I hadn't focused on the implication of including the field list, which would be generated from the context. Now a question, if the context is variable (contains a current user) won't that result in a cached version for each user since it's used in the key (https://github.com/cerebris/jsonapi-resources/blob/master/lib/jsonapi/cached_resource_fragment.rb#L113)?

[DavidMikeSimon]

@lgebhardt Nope, because the context variable is not directly included in the cache key.

The cache key calculated in CachedResourceFragment.write includes context_key, which is created by hashing whatever the resource class's attribute_caching_context method returns when given the context. However, the default implementation of Resource.attribute_caching_context just returns nil.

The reason that CachedResourceFragment holds on to the context is the to_real_resource method, which is used by ResourceSerializer#cached_relationships_hash when preloading cached chunks fails for whatever reason, e.g. the situation from #889.

[DavidMikeSimon]

@NuckChorris I should learn to read my own documentation better! :-( The advice I gave in the comment above is not correct. The default configuration does deal correctly with different fieldsets being requested by the client (i.e. using a sparse fieldset option) but does not deal correctly with the context determining which fields are fetchable via YourResource#fetchable_fields.

You would need to implement attribute_caching_context for this situation. Except, as you pointed out above, attribute_caching_context does not have access to the individual record or resource; it's only equipped to deal with situations that apply universally to all records of a type, such as user roles. Giving the method that access would unfortunately defeat the point of caching, since you'd have to do basically all the expensive stuff we're trying to avoid (building the ActiveRecord and Resource instances) before even being able to determine if the cached entry is out of date.

So yeah, the problem you described in your original issue is indeed a problem. I'd really like JR to be able to handle this, since your scenario (clients being able to see certain fields only on records they own) is very common. But I'm not sure at the moment how to approach this.

For now, your best bet is probably to disable caching on UserResource.

[lgebhardt]

@DavidMikeSimon Thanks! You have cleared up two misconceptions of mine.

[DavidMikeSimon]

@lgebhardt Okay, so here's a possible way to deal with this situation:

Right now, in order to determine the record cache ids to look up, Resource methods do SQL queries selecting two fields: the primary key and the cache field (which defaults to updated_at). To handle NuckChorris's situation, maybe we should allow the user to specify additional Arel expressions for that query in their Resource configuration. For example, a UserResource that only shows email addresses if the context user's id equals the resource's id might be implemented something like:

class UserResource
  caching
  attributes :name, :email

  def fetchable_fields
    return super if context.user.id == self.id
    return super - [:email]
  end

  def self.cache_context_expressions(context)
    [
      User.arel_table[:id].eq(context.user.id) # User record same as context user
    ]
  end
end

This would replace attribute_caching_context with something more flexible; any SQL expression could be used. However, it also is a bit clunky, and a more difficult API. :-\

[lgebhardt]

@DavidMikeSimon I think that would work, but I agree it's a bit clunky. Documenting it will likely be a challenge. I find testing the caching features in a project somewhat opaque, and I think this won't help.