- trash_clause = if !include_trash then "trashed = 0 AND" else "" end
-
- # Can read object (evidently a group or user) whose UUID is listed
- # explicitly in user_uuids.
- sql_conds += ["#{sql_table}.uuid IN (:user_uuids)"]
-
- direct_permission_check = "EXISTS(SELECT 1 FROM permission_view
- WHERE user_uuid IN (:user_uuids) AND perm_level >= 1 AND #{trash_clause}
- (#{sql_table}.uuid = target_uuid))"
-
- if self.column_names.include? "owner_uuid"
- # if an explicit permission row exists for the uuid in question, apply
- # the "direct_permission_check"
- # if not, check for permission to read the owner instead
- sql_conds += ["CASE
- WHEN EXISTS(select 1 FROM permission_view where target_uuid = #{sql_table}.uuid)
- THEN #{direct_permission_check}
- ELSE EXISTS(SELECT 1 FROM permission_view
- WHERE user_uuid IN (:user_uuids) AND perm_level >= 1 AND #{trash_clause}
- (#{sql_table}.owner_uuid = target_uuid AND target_owner_uuid is NOT NULL))
- END"]
- # Can also read if one of the users is the owner of the object.
- trash_clause = if !include_trash
- "1 NOT IN (SELECT trashed
- FROM permission_view
- WHERE #{sql_table}.uuid = target_uuid) AND"
- else
- ""
- end
- sql_conds += ["(#{trash_clause} #{sql_table}.owner_uuid IN (:user_uuids))"]
- else
- sql_conds += [direct_permission_check]
+ trashed_check = ""
+ if !include_trash then
+ trashed_check = "AND trashed = 0"
+ end
+
+ # Note: it is possible to combine the direct_check and
+ # owner_check into a single EXISTS() clause, however it turns
+ # out query optimizer doesn't like it and forces a sequential
+ # table scan. Constructing the query with separate EXISTS()
+ # clauses enables it to use the index.
+ #
+ # see issue 13208 for details.
+
+ # Match a direct read permission link from the user to the record uuid
+ direct_check = "EXISTS(SELECT 1 FROM #{PERMISSION_VIEW} "+
+ "WHERE user_uuid IN (:user_uuids) AND perm_level >= 1 #{trashed_check} AND target_uuid = #{sql_table}.uuid)"
+
+ # Match a read permission link from the user to the record's owner_uuid
+ owner_check = ""
+ if sql_table != "api_client_authorizations" and sql_table != "groups" then
+ owner_check = "OR EXISTS(SELECT 1 FROM #{PERMISSION_VIEW} "+
+ "WHERE user_uuid IN (:user_uuids) AND perm_level >= 1 #{trashed_check} AND target_uuid = #{sql_table}.owner_uuid AND target_owner_uuid IS NOT NULL) "