fix(api): mitigate slow queries

api/src/Doctrine/Filter/ContentNodePeriodFilter.php

@@ -71,8 +71,7 @@ protected function filterProperty(
         $queryBuilder
             ->join("{$rootAlias}.root", $rootJoinAlias)
             ->join(Activity::class, $activityJoinAlias, Join::WITH, "{$activityJoinAlias}.rootContentNode = {$rootJoinAlias}.id")
-            ->join("{$activityJoinAlias}.scheduleEntries", $scheduleEntryJoinAlias)
-            ->andWhere($queryBuilder->expr()->eq("{$scheduleEntryJoinAlias}.period", ":{$periodParameterName}"))
+            ->join("{$activityJoinAlias}.scheduleEntries", $scheduleEntryJoinAlias, Join::WITH, $queryBuilder->expr()->eq("{$scheduleEntryJoinAlias}.period", ":{$periodParameterName}"))
         ;
 
         $queryBuilder->setParameter($periodParameterName, $period);

api/src/Repository/FiltersByCampCollaboration.php

@@ -4,6 +4,7 @@
 
 use App\Entity\CampCollaboration;
 use App\Entity\User;
+use Doctrine\ORM\Query\Expr\Join;
 use Doctrine\ORM\QueryBuilder;
 
 trait FiltersByCampCollaboration {
@@ -14,14 +15,19 @@ trait FiltersByCampCollaboration {
      * the alias of the camp as the third argument if it's anything other than "camp".
      */
     public function filterByCampCollaboration(QueryBuilder $queryBuilder, User $user, string $campAlias = 'camp'): void {
-        $queryBuilder->leftJoin("{$campAlias}.collaborations", "filter_{$campAlias}_campCollaboration");
+        $queryBuilder->leftJoin(
+            "{$campAlias}.collaborations",
+            "filter_{$campAlias}_campCollaboration",
+            Join::WITH,
+            $queryBuilder->expr()->andX(
+                $queryBuilder->expr()->eq("filter_{$campAlias}_campCollaboration.user", ':current_user'),
+                $queryBuilder->expr()->eq("filter_{$campAlias}_campCollaboration.status", ':established'),
+            )
+        );
         $queryBuilder->andWhere(
             $queryBuilder->expr()->orX(
                 // user is established collaborator in the camp
-                $queryBuilder->expr()->andX(
-                    $queryBuilder->expr()->eq("filter_{$campAlias}_campCollaboration.user", ':current_user'),
-                    $queryBuilder->expr()->eq("filter_{$campAlias}_campCollaboration.status", ':established'),
-                ),
+                $queryBuilder->expr()->isNotNull("filter_{$campAlias}_campCollaboration.id"),
 
                 // camp is a Prototype = all Prototypes are readable
                 $queryBuilder->expr()->eq("{$campAlias}.isPrototype", ':true'),

api/tests/Api/ContentNodes/ContentNode/ListContentNodesTest.php

@@ -8,9 +8,18 @@
  * @internal
  */
 class ListContentNodesTest extends ECampApiTestCase {
-    // TODO security tests when not logged in or not collaborator
+    // TODO add tests for filtering by contentType and root
 
-    public function testListContentNodesIsAllowedForCollaborator() {
+    public function testListContentNodesIsDeniedForAnonymousUser() {
+        static::createBasicClient()->request('GET', '/content_nodes');
+        $this->assertResponseStatusCodeSame(401);
+        $this->assertJsonContains([
+            'code' => 401,
+            'message' => 'JWT Token not found',
+        ]);
+    }
+
+    public function testListContentNodesIsAllowedForLoggedInUserButFiltered() {
         $response = static::createClientWithCredentials()->request('GET', '/content_nodes');
         $this->assertResponseStatusCodeSame(200);
         $this->assertJsonContains([
@@ -46,4 +55,79 @@ public function testListContentNodesIsAllowedForCollaborator() {
             ['href' => $this->getIriFor('responsiveLayout1')],
         ], $response->toArray()['_links']['items']);
     }
+
+    public function testListContentNodesFilteredByPeriodIsAllowedForCollaborator() {
+        $period = static::getFixture('period1');
+        $response = static::createClientWithCredentials()->request('GET', '/content_nodes?period=%2Fperiods%2F'.$period->getId());
+        $this->assertResponseStatusCodeSame(200);
+        $this->assertJsonContains([
+            'totalItems' => 12,
+            '_links' => [
+                'items' => [],
+            ],
+            '_embedded' => [
+                'items' => [],
+            ],
+        ]);
+        $this->assertEqualsCanonicalizing([
+            ['href' => $this->getIriFor('columnLayout1')],
+            ['href' => $this->getIriFor('columnLayoutChild1')],
+            ['href' => $this->getIriFor('columnLayout3')],
+            ['href' => $this->getIriFor('singleText1')],
+            ['href' => $this->getIriFor('singleText2')],
+            ['href' => $this->getIriFor('safetyConcept1')],
+            ['href' => $this->getIriFor('materialNode1')],
+            ['href' => $this->getIriFor('storyboard1')],
+            ['href' => $this->getIriFor('storyboard2')],
+            ['href' => $this->getIriFor('multiSelect1')],
+            ['href' => $this->getIriFor('multiSelect2')],
+            ['href' => $this->getIriFor('responsiveLayout1')],
+        ], $response->toArray()['_links']['items']);
+    }
+
+    public function testListContentNodesFilteredByPeriodIsDeniedForUnrelatedUser() {
+        $period = static::getFixture('period1');
+        $response = static::createClientWithCredentials(['email' => static::$fixtures['user4unrelated']->getEmail()])
+            ->request('GET', '/content_nodes?period=%2Fperiods%2F'.$period->getId())
+        ;
+
+        $this->assertResponseStatusCodeSame(400);
+
+        $this->assertJsonContains([
+            'title' => 'An error occurred',
+            'detail' => 'Item not found for "'.$this->getIriFor('period1').'".',
+        ]);
+    }
+
+    public function testListContentNodesFilteredByPeriodIsDeniedForInactiveCollaborator() {
+        $period = static::getFixture('period1');
+        $response = static::createClientWithCredentials(['email' => static::$fixtures['user5inactive']->getEmail()])
+            ->request('GET', '/content_nodes?period=%2Fperiods%2F'.$period->getId())
+        ;
+
+        $this->assertResponseStatusCodeSame(400);
+
+        $this->assertJsonContains([
+            'title' => 'An error occurred',
+            'detail' => 'Item not found for "'.$this->getIriFor('period1').'".',
+        ]);
+    }
+
+    public function testListContentNodesFilteredByPeriodInCampPrototypeIsAllowedForCollaborator() {
+        $period = static::getFixture('period1campPrototype');
+        $response = static::createClientWithCredentials()->request('GET', '/content_nodes?period=%2Fperiods%2F'.$period->getId());
+        $this->assertResponseStatusCodeSame(200);
+        $this->assertJsonContains([
+            'totalItems' => 1,
+            '_links' => [
+                'items' => [],
+            ],
+            '_embedded' => [
+                'items' => [],
+            ],
+        ]);
+        $this->assertEqualsCanonicalizing([
+            ['href' => $this->getIriFor('columnLayout1campPrototype')],
+        ], $response->toArray()['_links']['items']);
+    }
 }

api/tests/Doctrine/Filter/ContentNodePeriodFilterTest.php

@@ -130,11 +130,6 @@ public function testAddsFilterForPeriodProperty() {
             ->will($this->returnValue($period))
         ;
 
-        $this->queryBuilderMock
-            ->expects($this->once())
-            ->method('andWhere')
-        ;
-
         $this->queryBuilderMock
             ->expects($this->once())
             ->method('setParameter')