From 9b4169c7cae31f9edab06d0c9756f24092b6c946 Mon Sep 17 00:00:00 2001
From: Jorge Manrubia <jorge@37signals.com>
Date: Mon, 7 Apr 2025 13:09:01 +0200
Subject: [PATCH] Scope data by account

With a single database this problem is not as bad, but it feels
safer to do things right. Also, not everyone in an account has access
to all the bubbles.
---
 app/controllers/comments/reactions_controller.rb | 2 +-
 app/controllers/concerns/bubble_scoped.rb        | 3 +--
 app/models/account.rb                            | 2 ++
 app/models/event/particulars.rb                  | 2 +-
 app/models/user.rb                               | 2 ++
 5 files changed, 7 insertions(+), 4 deletions(-)

diff --git a/app/controllers/comments/reactions_controller.rb b/app/controllers/comments/reactions_controller.rb
index c362f4a2b..36f51f6f6 100644
--- a/app/controllers/comments/reactions_controller.rb
+++ b/app/controllers/comments/reactions_controller.rb
@@ -24,7 +24,7 @@ class Comments::ReactionsController < ApplicationController
 
   private
     def set_comment
-      @comment = Comment.find(params[:comment_id])
+      @comment = Current.account.comments.find(params[:comment_id])
     end
 
     def reaction_params
diff --git a/app/controllers/concerns/bubble_scoped.rb b/app/controllers/concerns/bubble_scoped.rb
index 2f422727c..a3783d9c5 100644
--- a/app/controllers/concerns/bubble_scoped.rb
+++ b/app/controllers/concerns/bubble_scoped.rb
@@ -7,8 +7,7 @@ module BubbleScoped
 
   private
     def set_bubble
-      # Finding the bubble on the root depends on checking permission by finding its bucket via Current.user
-      @bubble = Bubble.find(params[:bubble_id])
+      @bubble = Current.user.accessible_bubbles.find(params[:bubble_id])
     end
 
     def set_bucket
diff --git a/app/models/account.rb b/app/models/account.rb
index 1a6e45fde..a2b3c7e34 100644
--- a/app/models/account.rb
+++ b/app/models/account.rb
@@ -10,6 +10,8 @@ class Account < ApplicationRecord
     end
   end
 
+  has_many :comments, through: :users
+
   has_many :workflows, dependent: :destroy
   has_many :stages, through: :workflows, class_name: "Workflow::Stage"
 
diff --git a/app/models/event/particulars.rb b/app/models/event/particulars.rb
index 9584bd6d5..a9cec0452 100644
--- a/app/models/event/particulars.rb
+++ b/app/models/event/particulars.rb
@@ -10,6 +10,6 @@ module Event::Particulars
   end
 
   def comment
-    @comment ||= Comment.find_by(id: comment_id)
+    @comment ||= account.comments.find_by(id: comment_id)
   end
 end
diff --git a/app/models/user.rb b/app/models/user.rb
index 88bf2b8ec..623111447 100644
--- a/app/models/user.rb
+++ b/app/models/user.rb
@@ -6,6 +6,8 @@ class User < ApplicationRecord
   has_many :sessions, dependent: :destroy
   has_secure_password validations: false
 
+  has_many :comments, inverse_of: :creator, dependent: :destroy
+
   has_many :notifications, dependent: :destroy
 
   has_many :filters, foreign_key: :creator_id, inverse_of: :creator, dependent: :destroy