AO3-5283 Prevent loading ModeratedWorks with missing Work (#4567)

* AO3-5283 Prevent loading ModeratedWorks with missing Work

* Use includes to combine (moderated_)work queries

app/controllers/admin/spam_controller.rb

@@ -1,5 +1,4 @@
 class Admin::SpamController < Admin::BaseController
-
   def index
     authorize ModeratedWork
 
@@ -11,7 +10,11 @@ def index
                   else
                     { reviewed: false, approved: false }
                   end
-    @works = ModeratedWork.where(conditions).order(:created_at).page(params[:page])
+    @works = ModeratedWork.where(conditions)
+      .joins(:work)
+      .includes(:work)
+      .order(:created_at)
+      .page(params[:page])
   end
 
   def bulk_update

spec/controllers/admin/spam_controller_spec.rb

@@ -41,6 +41,22 @@
         end
       end
     end
+
+    context "when a ModeratedWork has no corresponding Work" do
+      let!(:spam_with_work) { create(:moderated_work) }
+      let!(:spam_missing_work) { create(:moderated_work, work_id: -1) }
+
+      before do
+        fake_login_admin(create(:superadmin))
+      end
+
+      it "only loads the existing work" do
+        get :index
+
+        expect(assigns(:works)).to include(spam_with_work)
+        expect(assigns(:works)).not_to include(spam_missing_work)
+      end
+    end
   end
 
   describe "POST #bulk_update" do