Combining Multiple Serializers for one response.

[ramaboo]

We have an app where a User has_many Contacts. On the front end we want to display a list of contacts however we don't want to leak sensitive information so we have two serializers. ContactsFullSerializer and ContactsLiteSerializer. What we want to do is get a list of contacts @contacts = current_user.contacts and then respond where if the user has permission to view a contact the response is is rendered with ContactFullSerializer and if the user does not have permission then it uses ContactLiteSerializer. This would give us json like this for a user that had permission for 1 of 3 contacts:

[
  {id: 1, name: 'james' },
  {id 2, name: 'bill' },
  {id 3, name: 'tom', birthday: '12/28/81, home_address: '123 main st'}
]

Is there a clever way to do this with Alba? We could loop though the contacts manually and merge everything at the end but that seems ugly.

[okuramasafumi]

I believe you can do this with:

class ContactSerializer
  include Alba::Serializer

  attributes :id, :name
  attributes :birthday, :home_address, if: proc { |contact| contact.has_permission? }
end

[ramaboo]

Thanks we looked at this approach but I am worried about two things. First are serializers in real life are a little more complicated in this way of doing things it seems to easy for someone to accidentally add a new field without checking the permissions and that would be a huge deal for our appliation. The other reason is our permission system has to start at the user object. So we have user.has_permission?(contact) but not the other way around since a contact might or might not have a user.

In the end we went with this though it feels like there should be a better way to do this:

class SafeCollectionSerializer
      def initialize(collection, account_user, feature)
        @collection = collection
        @account_user = account_user
        @feature = feature
        @permission = user_permission

        @serializer = "App::V2::#{feature.to_s.singularize.titleize}Serializer".constantize
        @safe_serializer = "App::V2::#{feature.to_s.singularize.titleize}SafeSerializer".constantize
      end

      def serialize
        @safe_collection = @collection.map do |object|
          if user_permission_view?(object)
            @serializer.new(object).to_h
          elsif user_permission_view_safe?
            @safe_serializer.new(object).to_h
          end
        end

        Oj.dump(data: @safe_collection.compact_blank)
      end

      private

      def user_permission_view?(object)
        return false if @permission.blank?

        (@permission.create_mine? && created_by_me?(object)) || @permission.view_all? || @permission.modify_all?
      end

      def user_permission_view_safe?
        return false if @permission.blank?

        @permission.view_safe?
      end

      def created_by_me?(object)
        object.created_by_user_id == @account_user.user_id
      end

      def user_permission
        raise ArgumentError, "Feature `#{@feature}` is not valid" if AccountRole::FEATURES.keys.exclude?(@feature)

        @account_user.user_permissions.with_feature_enum(@feature).take
      end
    end

[okuramasafumi]

You can use params where you can pass user object.
You can also use inheritance since it's just Ruby!

# DO NOT TOUCH THIS CLASS!
class ContactLiteSerializer
  include Alba::Serializer

  attributes :id, :name
end

class ContactFullSerializer < ContactLiteSerializer
  attributes :birthday, :home_address, if: proc { |contact| params[:user].has_permission?(contact) }
end

[okuramasafumi]

I believe this would be a somewhat ideal solution. If you don't like this way, please let me know.