Guard safeguarding flag request cache

Author: abcampo-iry

app/controllers/concerns/identifiable.rb

@@ -13,6 +13,8 @@ def load_current_user
     return unless token
 
     @current_user = User.from_token(token:)
+    return unless RequestStore.respond_to?(:active?) && RequestStore.active?
+
     RequestStore.store[:safeguarding_flag_users_by_token] ||= {}
     RequestStore.store[:safeguarding_flag_users_by_token][token] = @current_user
   end

app/services/safeguarding_flag_service.rb

@@ -37,10 +37,16 @@ def create_for_roles(token:, email:, school:, roles:)
     private
 
     def user_for_token(token)
+      return User.from_token(token:) unless request_store_active?
+
       cache = RequestStore.store[:safeguarding_flag_users_by_token] ||= {}
       return cache[token] if cache.key?(token)
 
       cache[token] = User.from_token(token:)
     end
+
+    def request_store_active?
+      RequestStore.respond_to?(:active?) && RequestStore.active?
+    end
   end
 end

spec/services/safeguarding_flag_service_spec.rb

@@ -58,6 +58,7 @@
 
     before do
       allow(User).to receive(:from_token).with(token:).and_return(user)
+      allow(described_class).to receive(:request_store_active?).and_return(false)
     end
 
     it 'creates flags for the user identified by the token' do
@@ -72,6 +73,7 @@
     end
 
     it 'uses a user cached for the token' do
+      allow(described_class).to receive(:request_store_active?).and_return(true)
       RequestStore.store[:safeguarding_flag_users_by_token][token] = user
 
       described_class.create_for_token(token:, school:)
@@ -86,11 +88,19 @@
     end
 
     it 'caches the user after looking it up' do
+      allow(described_class).to receive(:request_store_active?).and_return(true)
+
       2.times { described_class.create_for_token(token:, school:) }
 
       expect(User).to have_received(:from_token).once
     end
 
+    it 'does not cache token lookups outside an active request store' do
+      2.times { described_class.create_for_token(token:, school:) }
+
+      expect(User).to have_received(:from_token).twice
+    end
+
     it 'does not look up a user without a token' do
       described_class.create_for_token(token: nil, school:)