diff --git a/app/policies/champ_policy.rb b/app/policies/champ_policy.rb index 81d2eb11b..2df555cbd 100644 --- a/app/policies/champ_policy.rb +++ b/app/policies/champ_policy.rb @@ -5,16 +5,18 @@ class ChampPolicy < ApplicationPolicy return scope.none end - # Users can access public champs on their own dossiers. - resolved_scope = scope + # The join must be the same for all elements of the WHERE clause. + joined_scope = scope .left_outer_joins(dossier: { groupe_instructeur: [:instructeurs] }) + + # Users can access public champs on their own dossiers. + resolved_scope = joined_scope .where('dossiers.user_id': user.id, private: false) if instructeur.present? # Additionnaly, instructeurs can access private champs # on dossiers they are allowed to instruct. - instructeur_clause = scope - .left_outer_joins(dossier: { groupe_instructeur: [:instructeurs] }) + instructeur_clause = joined_scope .where('instructeurs.id': instructeur.id, private: true) resolved_scope = resolved_scope.or(instructeur_clause) end