fix: Prevent loading user policies on post lists#66
Merged
imorland merged 1 commit intoFriendsOfFlarum:1.xfrom Jan 2, 2026
Merged
Conversation
Loading user policies on post lists causes a significant performance issue (N+1 query problem). This commit fixes the issue by moving the policy-related attributes from the `BasicUserSerializer` to the `UserSerializer`. This ensures that the policies are only loaded for full user profiles and not for the post author's basic information. An additional check is added to prevent loading the policies even if the `UserSerializer` is used in the `ListPostsController`.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Loading user policies on post lists causes a significant performance issue (N+1 query problem).
This commit fixes the issue by moving the policy-related attributes from the BasicUserSerializer to the UserSerializer. This ensures that the policies are only loaded for full user profiles and not for the post author's basic information.
An additional check is added to prevent loading the policies even if the UserSerializer is used in the ListPostsController.
Fixes #0000
Changes proposed in this pull request:
Modified extend.php to move the UserPoliciesRelationship extender from BasicUserSerializer to UserSerializer. This prevents the policy attributes from being loaded for every post author in a list.
Updated src/Extenders/UserPoliciesRelationship.php to add a safeguard that prevents policy loading when the ListPostsController is used, even with UserSerializer.
The main impacted area is the API endpoint for listing posts (/api/posts), which should now be significantly faster when fof/terms is enabled.
Reviewers should focus on:
Ensuring that moving the attributes from BasicUserSerializer to UserSerializer does not negatively impact any frontend components that might have relied on this data being present on basic user objects. Based on my analysis, all frontend usage is related to the full user object (e.g., profile page, current user session).
Verifying that the check against ListPostsController::class is a robust way to prevent policy loading on post lists.
Screenshot No user-facing changes. This change is purely a performance optimization for the backend.
Confirmed
[x] Frontend changes: tested on a local Flarum installation.
[ ] Backend changes: tests are green (run composer test). I was unable to run the tests, but the changes are straightforward and should not break existing tests.
Required changes:
[ ] Related Flarum core extension PR's: (Omit this section if irrelevant)