Preload nested RBAC associations to reduce N+1 queries

app/controllers/api/base_controller/renderer.rb

@@ -611,7 +611,7 @@ def determine_include_for_find(klass)
           if klass.virtual_includes(attr_name) && !klass.attribute_supported_by_sql?(attr_name) && attr_base.blank?
             attr_name
           # Case 2: Direct association (e.g., "snapshots", "storage", "ems_cluster")
-          # Not dot notation, check if the requested attribute is a direct association and include it
+          # Eager load associations (RBAC participating or not) to reduce N+1 queries.
           elsif attr_base.blank?
             reflection = klass.reflect_on_association(attr_name.to_sym)
             if reflection && [:has_many, :has_one, :has_and_belongs_to_many, :belongs_to].include?(reflection.macro)
@@ -620,11 +620,10 @@ def determine_include_for_find(klass)
               next
             end
           # Case 3: Nested attribute (e.g., "hardware.host.name")
-          # Include the base path for eager loading with specific exceptions
+          # Eager load nested associations (RBAC participating or not) to reduce N+1 queries.
+          # Exception: custom virtual_attribute_accessor (handled via accessor).
           else
             next if virtual_attribute_accessor(type, attr_name)
-            next if attr_base_uses_rbac?(attr_base)
-
             attr_base
           end
         end

spec/requests/vms_spec.rb

@@ -369,7 +369,6 @@ def query_match_regexp(*tables)
   end
 
   context "Vm index with nested indirect virtual attribute that participates in Rbac ('hardware.host.name')" do
-    # Can't have `expect(Rbac).to receive(:filtered_object).never` in this block
     before do
       # Preload records
       _vms = [vm, vm1, vm2, vm_openstack, vm_openstack1, vm_openstack2]
@@ -383,12 +382,17 @@ def query_match_regexp(*tables)
       api_basic_authorize action_identifier(:vms, :read, :resource_actions, :get)
       query_match = query_match_regexp("vms", "hardwares", "hosts")
 
+      # After fix: 9 queries (3 base + 6 RBAC re-filtering for 6 VMs)
+      # Before fix: was 21 queries (N+1 for each host access without preloading)
+      # Note: RBAC associations are preloaded (visible in LEFT OUTER JOIN) but
+      # ManageIQ core RBAC re-filters them when accessed, causing additional queries.
+      # This is still better than the original N+1 (21 queries).
       expect {
         get api_vms_url, :params => {
           :expand     => "resources",
           :attributes => "hardware.host.name,name"
         }
-      }.to make_database_queries(:count => 21, :matching => query_match)
+      }.to make_database_queries(:count => 9, :matching => query_match)
 
       expected = {
         "resources" => a_collection_including(
@@ -415,6 +419,60 @@ def query_match_regexp(*tables)
     end
   end
 
+  # Query count expectations for eager loading RBAC associations:
+  # - RBAC associations (host, ems, cluster, storage) are preloaded via LEFT OUTER JOINs
+  # - ManageIQ core RBAC re-filters associations when accessed, causing additional queries
+  # - Query count: ~15 queries (base queries + RBAC re-filtering)
+  # - Without preloading: Would be ~20+ queries per VM (N+1 pattern)
+  context "eager loads RBAC-participating associations" do
+    before { add_hardware_and_os_to_vms }
+
+    it "host" do
+      api_basic_authorize action_identifier(:vms, :read, :resource_actions, :get)
+      query_match = query_match_regexp("vms", "hosts")
+
+      expect do
+        get api_vms_url, :params => {:expand => "resources", :attributes => "host"}
+      end.to make_database_queries(:count => be <= 15, :matching => query_match)
+    end
+
+    it "ext_management_system" do
+      api_basic_authorize action_identifier(:vms, :read, :resource_actions, :get)
+      query_match = query_match_regexp("vms", "ext_management_systems")
+
+      expect do
+        get api_vms_url, :params => {:expand => "resources", :attributes => "ext_management_system"}
+      end.to make_database_queries(:count => be <= 15, :matching => query_match)
+    end
+
+    it "ems_cluster" do
+      api_basic_authorize action_identifier(:vms, :read, :resource_actions, :get)
+      query_match = query_match_regexp("vms", "ems_clusters")
+
+      expect do
+        get api_vms_url, :params => {:expand => "resources", :attributes => "ems_cluster"}
+      end.to make_database_queries(:count => be <= 15, :matching => query_match)
+    end
+
+    it "storage" do
+      api_basic_authorize action_identifier(:vms, :read, :resource_actions, :get)
+      query_match = query_match_regexp("vms", "storages")
+
+      expect do
+        get api_vms_url, :params => {:expand => "resources", :attributes => "storage"}
+      end.to make_database_queries(:count => be <= 15, :matching => query_match)
+    end
+
+    it "multiple RBAC associations" do
+      api_basic_authorize action_identifier(:vms, :read, :resource_actions, :get)
+      query_match = query_match_regexp("vms", "hosts", "ext_management_systems", "ems_clusters", "storages")
+
+      expect do
+        get api_vms_url, :params => {:expand => "resources", :attributes => "host,ext_management_system,ems_cluster,storage"}
+      end.to make_database_queries(:count => be <= 15, :matching => query_match)
+    end
+  end
+
   context 'Vm edit' do
     let(:new_vms) { FactoryBot.create_list(:vm_openstack, 2) }