Passing an AR relation into authorize! causes it to load the relation

[tomdalling]

Tell us about your environment

Ruby Version: 2.7.3

Framework Version (Rails, whatever): Rails 6.1.3

Action Policy Version: 0.5.7

Reproduction Script: It's difficult to reproduce, but i've explained it below.

What did you do?

We have a setup similar to this:

class User < ApplicationRecord
  has_many :widgets
end

class WidgetsController < ApplicationController
  def index
    widgets = current_user.widgets
    authorize! widgets
    render locals: { widgets: paginate(widgets) }
  end
end

What did you expect to happen?

authorize! widgets should not load the widgets AR relation.

What actually happened?

Action Policy executes and loads all the records in widgets. This happens before pagination, so it causes performance problems.

This is because widgets is an ActiveRecord::AssociationRelation, and when ActionPolicy does widgets == :__undef__ as part of policy lookup, the #== method from AR executes the query.