fix: Blueprinter adoption + query performance hardening

[aaronlippold]

Summary

• Production /stigs endpoint crashed dynos (R14/R15 memory, H12 timeout) due to loading multi-MB xml blobs
• Code review found the same pattern across search, show pages, and rule serialization (N+1 queries)
• Adopted Blueprinter as the standard JSON serialization layer, replacing all model as_json overrides

Changes

Performance fixes (critical)

• C3: Eliminate N+1 SecurityRequirementsGuide.find_by in Rule#as_json (200+ queries → 0)
• C1: Add .select() to search_stigs/search_srgs (excludes multi-MB xml from search)
• C2: Exclude xml from STIG/SRG show HTML to_json serialization

Blueprinter adoption (architectural)

• 15 blueprint classes in app/blueprints/ with context-specific views
• RuleBlueprint (:navigator, :viewer, :editor), ComponentBlueprint (:index, :show, :editor)
• StigBlueprint, SrgBlueprint (xml structurally excluded — never declared)
• ProjectBlueprint, ProjectIndexBlueprint (batched access_request lookup)
• Leaf blueprints: Check, DisaRuleDescription, RuleDescription, AdditionalAnswer
• Supporting: Review, Membership, User (compact)

Controller migration

• All controllers migrated from to_json(methods: [...]) to Blueprint.render
• ApplicationController#check_access_request_notifications rewritten as single query (was N+1 per project)
• Component jbuilder uses RuleBlueprint for rules
• Rules index HAML uses pre-rendered blueprint JSON

Cleanup

• Removed as_json overrides from BaseRule, Rule, Review, Membership
• Rake task migrated from as_json.compact to .attributes
• Oj configured as JSON backend (2x faster)
• blueprinter-activerecord auto-preloader for N+1 prevention

Test plan

• 2018 frontend tests (vitest) — all passing
• 1772 backend tests (parallel_rspec) — all passing
• 53 new blueprint specs with N+1 verification
• RuboCop clean (394 files)
• Brakeman clean (0 warnings)
• Deploy to staging and verify /stigs loads without timeout
• Verify component show page loads in < 5s
• Verify search doesn't spike memory
• Live test STIG/SRG export still works (uses separate find, not blueprint)

Beads epic

vulcan-v3.x-0uf — all 8 cards closed (BP-1 through BP-8)

🤖 Generated with Claude Code

[Copilot]

Pull request overview

Note

Copilot was unable to run its full agentic suite in this review.

Migrates JSON serialization from model as_json overrides to Blueprinter while hardening key endpoints against memory/timeouts caused by loading multi‑MB XML columns and N+1 queries.

Changes:

• Introduces Blueprinter + Oj + auto-preloading, adding model-specific blueprints with context views.
• Updates controllers/views to render blueprint JSON (and excludes XML from search/show paths).
• Adds request/model/blueprint specs to lock in performance and output shape.

Reviewed changes

Copilot reviewed 49 out of 50 changed files in this pull request and generated 5 comments.

Show a summary per file

File	Description
spec/requests/stigs_spec.rb	Adds regression coverage to ensure STIG HTML doesn’t embed XML blob
spec/requests/api/search_spec.rb	Adds query-level checks to ensure search excludes XML columns
spec/models/rules_spec.rb	Updates rule serialization expectations to use RuleBlueprint
spec/models/rule_as_json_performance_spec.rb	Adds performance spec around SRG query behavior during serialization
spec/blueprints/stig_srg_blueprints_spec.rb	Adds blueprint contract tests for STIG/SRG output + XML exclusion
spec/blueprints/rule_blueprint_spec.rb	Adds RuleBlueprint contract + N+1 assertions
spec/blueprints/review_membership_blueprints_spec.rb	Adds tests for review/membership/user blueprint shapes
spec/blueprints/leaf_blueprints_spec.rb	Adds tests for leaf blueprints and nested-attrs compatibility
spec/blueprints/component_blueprint_spec.rb	Adds tests for component blueprint views and nested serialization
lib/tasks/stig_and_srg_puller.rake	Stops relying on as_json for DB updates; uses .attributes
config/initializers/blueprinter.rb	Configures Blueprinter generator (Oj), sorting, and AR preloader
app/views/stigs/index.html.haml	Switches STIG list prop from to_json to pre-rendered blueprint JSON
app/views/security_requirements_guides/index.html.haml	Switches SRG list prop from to_json to pre-rendered blueprint JSON
app/views/rules/index.html.haml	Switches component/rules props to pre-rendered blueprint JSON
app/views/components/show.json.jbuilder	Replaces rule as_json merge with RuleBlueprint rendering
app/models/rule.rb	Removes Rule as_json override; documents blueprint ownership
app/models/review.rb	Removes Review as_json override; documents blueprint ownership
app/models/membership.rb	Removes Membership as_json override; documents blueprint ownership
app/models/base_rule.rb	Removes BaseRule as_json override; documents blueprint ownership
app/javascript/components/users/EditUserModal.vue	Adjusts password management section rendering
app/controllers/stigs_controller.rb	Uses StigBlueprint for HTML JSON payloads
app/controllers/security_requirements_guides_controller.rb	Uses SrgBlueprint for HTML JSON payloads
app/controllers/rules_controller.rb	Uses Rule/Component blueprints; updates related-rules endpoint
app/controllers/projects_controller.rb	Batches access-request lookup; uses Project blueprints
app/controllers/components_controller.rb	Uses Component/Rule blueprints for HTML and JSON rendering
app/controllers/application_controller.rb	Rewrites access-request notifications to a single query
app/controllers/api/search_controller.rb	Adds .select to SRG/STIG search to exclude XML columns
app/blueprints/user_blueprint.rb	Adds compact user blueprint
app/blueprints/stig_rule_blueprint.rb	Adds STIG rule blueprint for show views
app/blueprints/stig_blueprint.rb	Adds STIG blueprint with XML excluded by design
app/blueprints/srg_rule_blueprint.rb	Adds SRG rule blueprint for nested SRG data
app/blueprints/srg_blueprint.rb	Adds SRG blueprint with XML excluded by design
app/blueprints/satisfied_by_blueprint.rb	Adds satisfied-by specialization blueprint
app/blueprints/satisfaction_blueprint.rb	Adds base satisfaction relationship blueprint
app/blueprints/rule_description_blueprint.rb	Adds rule description leaf blueprint
app/blueprints/rule_blueprint.rb	Adds RuleBlueprint with :navigator/:viewer/:editor views
app/blueprints/review_blueprint.rb	Adds ReviewBlueprint to control review payload shape
app/blueprints/project_index_blueprint.rb	Adds ProjectIndexBlueprint with per-user computed fields
app/blueprints/project_blueprint.rb	Adds ProjectBlueprint with :show view + nested associations
app/blueprints/membership_blueprint.rb	Adds MembershipBlueprint including delegated user fields
app/blueprints/disa_rule_description_blueprint.rb	Adds DISA rule description leaf blueprint
app/blueprints/component_blueprint.rb	Adds ComponentBlueprint with :index/:show/:editor views
app/blueprints/check_blueprint.rb	Adds check leaf blueprint with _destroy support
app/blueprints/additional_answer_blueprint.rb	Adds additional answer leaf blueprint
Gemfile.lock	Adds blueprinter, blueprinter-activerecord, and oj dependencies
Gemfile	Adds blueprinter, blueprinter-activerecord, and oj gems

Comments suppressed due to low confidence (8)

app/views/components/show.json.jbuilder:1

• This does a JSON encode + JSON.parse round-trip inside the Jbuilder template, adding avoidable CPU and memory overhead. Prefer RuleBlueprint.render_as_hash(@component.rules, view: :editor) (or equivalent) so Jbuilder receives Ruby hashes/arrays directly and you avoid parsing potentially large payloads.
  spec/requests/api/search_spec.rb:1
• The SQL detection is overly broad: sql.include?('.*') can match unrelated SELECT \"users\".* queries, and sql.include?('stigs') / security_requirements_guides will also match JOINs where the selected columns are not from those tables. This can cause false positives/flaky failures. Tighten the matcher to specifically detect selecting \"stigs\".* / \"security_requirements_guides\".* or selecting the xml column for those tables (ideally via a regex), and consider excluding schema/cached queries similar to other specs.
  spec/requests/api/search_spec.rb:1
• The SQL detection is overly broad: sql.include?('.*') can match unrelated SELECT \"users\".* queries, and sql.include?('stigs') / security_requirements_guides will also match JOINs where the selected columns are not from those tables. This can cause false positives/flaky failures. Tighten the matcher to specifically detect selecting \"stigs\".* / \"security_requirements_guides\".* or selecting the xml column for those tables (ideally via a regex), and consider excluding schema/cached queries similar to other specs.
  spec/requests/stigs_spec.rb:1
• This failure message references except: [:xml] in to_json, but the implementation is now blueprint-based (StigBlueprint). Update the message to reflect the current mechanism (e.g., 'ensure StigBlueprint does not declare :xml / ensure controller uses StigBlueprint :show') so future failures point to the right fix.
  spec/models/rule_as_json_performance_spec.rb:1
• This spec is still framed around Rule#as_json, but the PR removes the custom as_json overrides and shifts the performance-critical serialization to RuleBlueprint. As written, it primarily asserts default ActiveRecord as_json behavior (which is less relevant) and may give a false sense of coverage for blueprint serialization. Consider renaming/re-scoping the spec to RuleBlueprint and measuring RuleBlueprint.render_as_hash(..., view: :editor) instead of rule.as_json.
  spec/models/rule_as_json_performance_spec.rb:1
• This spec is still framed around Rule#as_json, but the PR removes the custom as_json overrides and shifts the performance-critical serialization to RuleBlueprint. As written, it primarily asserts default ActiveRecord as_json behavior (which is less relevant) and may give a false sense of coverage for blueprint serialization. Consider renaming/re-scoping the spec to RuleBlueprint and measuring RuleBlueprint.render_as_hash(..., view: :editor) instead of rule.as_json.
  spec/models/rule_as_json_performance_spec.rb:1
• This spec is still framed around Rule#as_json, but the PR removes the custom as_json overrides and shifts the performance-critical serialization to RuleBlueprint. As written, it primarily asserts default ActiveRecord as_json behavior (which is less relevant) and may give a false sense of coverage for blueprint serialization. Consider renaming/re-scoping the spec to RuleBlueprint and measuring RuleBlueprint.render_as_hash(..., view: :editor) instead of rule.as_json.
  config/initializers/blueprinter.rb:1
• The comment says fields are sorted alphabetically by name, but config.sort_fields_by = :definition reads as sorting by definition order (not name). Align the configuration with the stated intent (or update the comment to match the actual behavior) so readers don’t misinterpret output ordering guarantees.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[Copilot]

For non-super-admins, this plucks membership_id from a polymorphic Membership without constraining membership_type. If the user is an admin of any non-Project membership (e.g., Component), those IDs can be incorrectly treated as project_ids when querying ProjectAccessRequest. Filter the membership query to membership_type: 'Project' (and ideally pluck project IDs via an explicit join/scope) so only project IDs are used.

Suggested change

	Membership.where(user_id: current_user.id, role: 'admin')
	Membership.where(user_id: current_user.id, role: 'admin', membership_type: 'Project')

[aaronlippold]

Fixed in commit b24bb7c — added membership_type: 'Project' filter. Already addressed.

[Copilot]

The second block used to be v-else but is now unconditional, so when smtpEnabled is true both the 'send reset email' UI and the 'generate link or set password' UI will render together. If the intent is to show one or the other, restore mutually-exclusive rendering (or add an explicit condition matching the comment, e.g., admin-only).

[aaronlippold]

Intentional — this is a deliberate UX change. Admins should always see all password management options (send email + generate link + set directly) regardless of SMTP. Previously, admins with no SMTP had no way to help users reset passwords. Both blocks rendering together is correct.

[Copilot]

Pull request overview

Copilot reviewed 49 out of 50 changed files in this pull request and generated 6 comments.

Comments suppressed due to low confidence (7)

spec/models/rule_as_json_performance_spec.rb:1

• This spec is now validating as_json, but the PR explicitly moves serialization to RuleBlueprint. As written, it may pass even if the blueprint regresses into N+1s (since default ActiveRecord as_json likely won’t traverse SRG associations). Update the spec description and assertions to measure RuleBlueprint.render_as_hash(..., view: :editor) instead of as_json, and consider renaming the file to reflect the blueprint.
  spec/models/rule_as_json_performance_spec.rb:1
• This spec is now validating as_json, but the PR explicitly moves serialization to RuleBlueprint. As written, it may pass even if the blueprint regresses into N+1s (since default ActiveRecord as_json likely won’t traverse SRG associations). Update the spec description and assertions to measure RuleBlueprint.render_as_hash(..., view: :editor) instead of as_json, and consider renaming the file to reflect the blueprint.
  spec/models/rule_as_json_performance_spec.rb:1
• This spec is now validating as_json, but the PR explicitly moves serialization to RuleBlueprint. As written, it may pass even if the blueprint regresses into N+1s (since default ActiveRecord as_json likely won’t traverse SRG associations). Update the spec description and assertions to measure RuleBlueprint.render_as_hash(..., view: :editor) instead of as_json, and consider renaming the file to reflect the blueprint.
  spec/models/rule_as_json_performance_spec.rb:1
• This spec is now validating as_json, but the PR explicitly moves serialization to RuleBlueprint. As written, it may pass even if the blueprint regresses into N+1s (since default ActiveRecord as_json likely won’t traverse SRG associations). Update the spec description and assertions to measure RuleBlueprint.render_as_hash(..., view: :editor) instead of as_json, and consider renaming the file to reflect the blueprint.
  spec/models/rule_as_json_performance_spec.rb:1
• This spec is now validating as_json, but the PR explicitly moves serialization to RuleBlueprint. As written, it may pass even if the blueprint regresses into N+1s (since default ActiveRecord as_json likely won’t traverse SRG associations). Update the spec description and assertions to measure RuleBlueprint.render_as_hash(..., view: :editor) instead of as_json, and consider renaming the file to reflect the blueprint.
  spec/requests/stigs_spec.rb:1
• The failure message references the old to_json(except: [:xml]) approach, but the implementation now uses Blueprints. Updating this message to reference StigBlueprint/blueprint views will make failures easier to diagnose and keep the spec aligned with the new architecture.
  docker-compose.dev.yml:1
• Running yarn build:watch in the background (&) without an init/supervisor means failures in the watcher may go unnoticed, and the container won’t stop if the background process dies. Also, without exec for the Rails server, signal handling (stop/restart) can be less reliable. A more robust approach is to use a process manager (foreman/bin/dev) or ensure the shell execs the main process and manages the watcher lifecycle (e.g., wait).

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[Copilot]

RuleBlueprint.render(...) returns a JSON string. Passing a string to render json: will cause Rails to JSON-encode the string again (responding with a quoted/escaped JSON string), which breaks API consumers expecting an object. Use render json: RuleBlueprint.render_as_hash(@rule, view: :editor) (preferred) or render body: RuleBlueprint.render(...), content_type: 'application/json'.

[aaronlippold]

Good catch — fixed. Changed to render_as_hash to avoid double-encoding.

[Copilot]

Same double-encoding issue as above: data: will become a JSON string inside the JSON response rather than a nested object. Switch to RuleBlueprint.render_as_hash(rule, view: :editor) for data: so the response shape stays consistent.

Suggested change

	data: RuleBlueprint.render(rule, view: :editor) }
	data: RuleBlueprint.render_as_hash(rule, view: :editor) }

[aaronlippold]

Fixed — changed to render_as_hash.

[Copilot]

This will double-encode because RuleBlueprint.render(...) returns a JSON string. Return a Ruby object to render json: (e.g., RuleBlueprint.render_as_hash(rules, view: :editor)) or render the string as the response body with JSON content type.

Suggested change

	render json: RuleBlueprint.render(rules, view: :editor)
	render json: RuleBlueprint.render_as_hash(rules, view: :editor)

[aaronlippold]

Fixed — changed to render_as_hash.

[Copilot]

ProjectBlueprint.render(...) returns a JSON string, so render json: @project_json will respond with an escaped JSON string (quoted) rather than an object. Either render the hash (ProjectBlueprint.render_as_hash(@project, view: :show)) or use render body: with JSON content type for the already-rendered string.

Suggested change

	format.json { render json: @project_json }
	format.json { render body: @project_json, content_type: 'application/json' }

[aaronlippold]

Fixed — changed to render body: @project_json, content_type: 'application/json' since @project_json is pre-rendered for the HTML view too.

[Copilot]

For current_user.admin?, Project.pluck(:id) loads all project IDs on every HTML request (navbar), which can become expensive as the table grows. Since you only need access requests, consider querying ProjectAccessRequest directly for admins (no project-id pluck), and for non-admins consider a join/subquery from memberships to access requests to avoid materializing large ID arrays.

Suggested change

	# Single query: find all access requests for projects where current user is admin.
	# Replaces N+1 loop that called can_admin_project? + eager_load per project.
	admin_project_ids = if current_user.admin?
	Project.pluck(:id)
	else
	Membership.where(user_id: current_user.id, role: 'admin',
	membership_type: 'Project')
	.pluck(:membership_id)
	end
	return @access_requests if admin_project_ids.empty?
	@access_requests = ProjectAccessRequest.where(project_id: admin_project_ids)
	.eager_load(:user, :project)
	.map do |ar|
	# Query access requests directly to avoid materializing large project ID arrays.
	access_requests = if current_user.admin?
	ProjectAccessRequest.all
	else
	ProjectAccessRequest.where(
	project_id: Membership.where(user_id: current_user.id, role: 'admin',
	membership_type: 'Project')
	.select(:membership_id)
	)
	end
	@access_requests = access_requests.eager_load(:user, :project)
	.map do |ar|

[aaronlippold]

Valid concern but low priority for this PR. The admin path hits Project.pluck(:id) but: (1) admins are rare (1-3 per instance), (2) projects table is small (typically <100 rows), (3) this only runs on HTML requests with pending access requests. Filed as a follow-up optimization candidate.

[wdower]

Code review

Found 5 issues:

1. N+1 in SatisfactionBlueprint: satisfies/satisfied_by missing nested :srg_rule eager load. The blueprint accesses rule.srg_rule&.version per entry, but the controller eager-loads satisfies and satisfied_by without their nested srg_rule. Fix: change the eager load to satisfies: :srg_rule, satisfied_by: :srg_rule.

vulcan/app/controllers/rules_controller.rb

Lines 17 to 20 in 602d96f

	def index
	@rules = @component.rules.eager_load(:reviews, :disa_rule_descriptions, :rule_descriptions, :checks,
	:additional_answers, :satisfies, :satisfied_by,
	srg_rule: %i[disa_rule_descriptions rule_descriptions checks])

vulcan/app/blueprints/satisfaction_blueprint.rb

Lines 7 to 9 in 602d96f

	field :srg_id do |rule, _options|
	rule.srg_rule&.version
	end

2. related_rules drops project from component parents, breaking Vue consumer. The old code serialized component parents with as_json(methods: %i[project]). The new code uses ComponentBlueprint :index which does not include project. RelatedRulesModal.vue:372 reads parent.project.name and will throw a TypeError at runtime.

vulcan/app/controllers/rules_controller.rb

Lines 55 to 57 in 602d96f

	stig_parents = StigBlueprint.render_as_hash(stig_rules.map(&:stig).uniq, view: :index)
	component_parents = ComponentBlueprint.render_as_hash(rules.map(&:component).uniq, view: :index)
	parents = (stig_parents + component_parents)

vulcan/app/javascript/components/rules/RelatedRulesModal.vue

Lines 371 to 373 in 602d96f

	const comp_rules = this.relatedRules.filter((r) => r.component_id == parent.id);
	parent.name = `${parent.project.name} / ${parent.name} - Ver ${parent.version}, Rel ${parent.release}`;
	comp_rules.forEach((r) => {

3. available_components .select() omits :released and :updated_at. These columns are rendered by ComponentBlueprint :index (used via ProjectBlueprint :show), so they will appear as nil in the JSON output.

vulcan/app/models/project.rb

Lines 86 to 88 in 602d96f

	# Assumption that released components are publicly available within vulcan
	Component.where(released: true).where.not(id: reject_component_ids)
	.select(:id, :name, :prefix, :version, :release, :project_id, :security_requirements_guide_id)

vulcan/app/blueprints/component_blueprint.rb

Lines 31 to 34 in 602d96f

	# === Index view: listing page ===
	view :index do
	fields :updated_at, :released
	end

4. create_or_duplicate find_by(ident: 'CCI-000366') uses exact match on a multi-value column. The ident column stores comma-separated CCIs (e.g., "CCI-000366, CCI-001234"), confirmed by base_rule.rb from_mapping joining with ', ' and rule.rb splitting on /, */. Exact match will return nil for any SRG rule with multiple CCIs, silently creating a rule with empty SRG fields.

vulcan/app/controllers/rules_controller.rb

Lines 189 to 191 in 602d96f

	srg = SecurityRequirementsGuide.find_by(id: @component.security_requirements_guide_id)
	db_srg_rule = srg.srg_rules.eager_load(:disa_rule_descriptions, :checks, :rule_descriptions)
	.find_by(ident: 'CCI-000366')

5. create_or_duplicate drops references association. The old code path via BaseRule.from_mapping built references records (line 75 of base_rule.rb). The new DB-lookup path manually builds disa_rule_descriptions and checks but never builds references, silently dropping them.

vulcan/app/controllers/rules_controller.rb

Lines 193 to 216 in 602d96f

	rule = Rule.new(
	component: @component,
	srg_rule: db_srg_rule,
	rule_id: (@component.rules.order(:rule_id).pluck(:rule_id).last.to_i + 1).to_s.rjust(6, '0'),
	status: 'Not Yet Determined',
	rule_severity: 'unknown',
	rule_weight: db_srg_rule&.rule_weight || '10.0',
	version: db_srg_rule&.version,
	title: db_srg_rule&.title,
	ident: db_srg_rule&.ident || 'CCI-000366',
	ident_system: db_srg_rule&.ident_system,
	fixtext: db_srg_rule&.fixtext,
	fixtext_fixref: db_srg_rule&.fixtext_fixref,
	fix_id: db_srg_rule&.fix_id
	)
	rule.disa_rule_descriptions.build(db_srg_rule.disa_rule_descriptions.map { |d| d.attributes.except('id', 'base_rule_id') }) if db_srg_rule&.disa_rule_descriptions&.any?
	rule.checks.build(db_srg_rule.checks.map { |c| c.attributes.except('id', 'base_rule_id') }) if db_srg_rule&.checks&.any?
	rule.audits.build(Audited.audit_class.create_initial_rule_audit_from_mapping(@component.id))
	rule
	end
	end
	def rule_create_params

🤖 Generated with Claude Code

_{- If this code review was useful, please react with 👍. Otherwise, react with 👎.}

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud