app/lib/authorizer.rb
# This method is the source of truth for whether an educator is authorized to view information about a particular
# student.
#
# There are several performance optimizations applied here (see git history
# for more), since this method is heavily used and latency regressions impact
# almost every page.  The latency of this method is also quite different for
# different users, because of the different layers of checks.  Users with
# districtwide or schoolwide access may have lower latency (and are therefore bad
# test cases) since we don't need to care about the details when checking their
# access.
This method is the source of truth for whether an educator is authorized to view information about a particular
student.

There are several performance optimizations applied here (see git history
for more), since this method is heavily used and latency regressions impact
almost every page.  The latency of this method is also quite different for
different users, because of the different layers of checks.  Users with
districtwide or schoolwide access may have lower latency (and are therefore bad
test cases) since we don't need to care about the details when checking their
access.
This method is the source of truth for whether an educator is authorized to view information about a particular student . There are several performance optimizations applied here ( see git history for more ) since this method is heavily used and latency regressions impact almost every page . The latency of this method is also quite different for different users because of the different layers of checks . Users with districtwide or schoolwide access may have lower latency ( and are therefore bad test cases ) since we don ' t need to care about the details when checking their access .
def is_authorized_for_student?(student, options = {})
    begin
      return true if @educator.districtwide_access?
      return true if @educator.labels.include?('high_school_house_master') && student.grade == '8' && EnvironmentVariable.is_true('HOUSEMASTERS_AUTHORIZED_FOR_GRADE_8')
      return false if @educator.restricted_to_sped_students && !(student.program_assigned.in? ['Sp Ed', 'SEIP'])
      return false if @educator.restricted_to_english_language_learners && student.limited_english_proficiency == 'Fluent'
      return false if @educator.school_id.present? && student.school_id.present? && @educator.school_id != student.school_id
      return true if @educator.schoolwide_access? || @educator.admin? 
      return true if @educator.has_access_to_grade_levels? && student.grade.in?(@educator.grade_level_access) 
      return true if student.in?(@educator.students.to_a) 
      return true if student.in?(@educator.section_students.to_a) 
    rescue ActiveModel::MissingAttributeError => err
       See `Authorizer.student_fields_for_authorization` and `Authorizer.educator_field_for_authorization`
       to see what fields are required on each model.
      raise err
    end
    false
  end
def is_authorized_for_student? ( student , options = { } ) begin return true if @educator . districtwide_access? return true if @educator . labels . include? ( 'high_school_house_master' ) && student . grade == '8' && EnvironmentVariable . is_true ( 'HOUSEMASTERS_AUTHORIZED_FOR_GRADE_8' ) return false if @educator . restricted_to_sped_students && ! ( student . program_assigned . in? [ 'Sp Ed' , 'SEIP' ] ) return false if @educator . restricted_to_english_language_learners && student . limited_english_proficiency == 'Fluent' return false if @educator . school_id . present? && student . school_id . present? && @educator . school_id != student . school_id return true if @educator . schoolwide_access? || @educator . admin? return true if @educator . has_access_to_grade_levels? && student . grade . in? ( @educator . grade_level_access ) return true if student . in? ( @educator . students . to_a ) return true if student . in? ( @educator . section_students . to_a ) rescue ActiveModel :: MissingAttributeError => err raise err end false end
This method is the source of truth for whether an educator is authorized to view information about a particular
student.
This method is the source of truth for whether an educator is authorized to view information about a particular student .
# Schoolwide admin # Grade level access # The next two checks call `#to_a` as a performance optimization. # In loops with `authorized { Student.active }`, without forcing this # to an eagerly evaluated array, repeated calls will keep making the # same queries.  This seems unexpected to me, but adding `to_a` at # the end results in Rails caching these queries across the repeated # calls in the loop.  So we can do that here, and let callers who # are calling this in a loop get the optimization without having to # optimize themselves. # Homeroom level access # Section level access # We can't do authorization checks on models with `#select` that are missing # fields.  If this happens, it's probably because the developer is trying to # to optimize a query.  The authorization layer could only recover by making more # queries, so instead we raise and force the developer to figure out how to resolve. # # See `Authorizer.student_fields_for_authorization` and `Authorizer.educator_field_for_authorization` # to see what fields are required on each model.
student
<not_specific>
options
<not_specific>