Deprecate using class level querying methods if the receiver scope regarded as leaked

[kamipo]

This deprecates using class level querying methods if the receiver scope
regarded as leaked, since #32380 and #35186 may cause that silently
leaking information when people upgrade the app.

We need deprecation first before making those.

[jeremy]

Tricky situation. Great fix!

[matthewd]

What are the non-"leak" ways a scope can be set after this? Is it only explicit .scoping { .. }?

[kamipo]

Yes, since .scoping { .. } is public API, I leaved the way as to inject the scope at global.

[kamipo]

Maybe I don't get the point of "What are the non-"leak" ways a scope can be set after this?".

Can you expand about your concerned situation? @matthewd

[kamipo]

Reworded.

[sgrif]

The code from the documentation for find_or_create_by now triggers this deprecation warning:

User.create_with(last_name: 'Johansson').find_or_create_by(first_name: 'Scarlett')

It seems like this deprecation is either too aggressive, or create_with is now useless and should be deprecated?

[kamipo]

We have some tests for find_or_create_by, but it won't trigger any deprecation warning.

rails/activerecord/test/cases/relations_test.rb

Lines 1415 to 1422 in 30349de

	def test_find_or_create_by
	assert_nil Bird.find_by(name: "bob")
	bird = Bird.find_or_create_by(name: "bob")
	assert_predicate bird, :persisted?
	assert_equal bird, Bird.find_or_create_by(name: "bob")
	end

rails/activerecord/test/cases/relations_test.rb

Lines 1424 to 1432 in 30349de

	def test_find_or_create_by_with_create_with
	assert_nil Bird.find_by(name: "bob")
	bird = Bird.create_with(color: "green").find_or_create_by(name: "bob")
	assert_predicate bird, :persisted?
	assert_equal "green", bird.color
	assert_equal bird, Bird.create_with(color: "blue").find_or_create_by(name: "bob")
	end

Let me know more executable information I can take a closer look at an issue around this deprecation.

[nbulaj]

It looks really aggressive 🤔 We have a models that generates slug on creation using such concern:

module Sluggable
  extend ActiveSupport::Concern

  included do
    before_create :set_slug

    def generate_slug(payload)
      slug = payload.to_slug

      if self.class.where(slug: slug).exists? # <------ ¯\_(ツ)_/¯
        "#{slug}_#{SecureRandom.hex(6)}"
      else
        slug
      end
    end

    def sluggable_value
      name
    end

    private

    def set_slug
      self.slug = generate_slug(sluggable_value) if slug.blank?
    end
  end
end

And then I got a lot of deprecation warnings on the line marked above with a comment. Don't sure which scoping self.class.where().exists? may use, BTW it would be great to hear your feedback @kamipo . When adding .unscoped to self.class - it resolves the issue, but breaks our business that tied to paranoid behavior. See the script that tries to reproduce the issue