Prevent serializing huge graphs of relationships between users and companies

This prevents humongous payloads for situations where users are part of many companies which again have many users. The previous implementation would continue serializing until the entire graph has been serialized.

Author: benedikt

CHANGELOG.md

@@ -2,6 +2,8 @@
 
 ## Unreleased (main)
 
+- Prevents serializing of large graphs of relationships between users and companies
+
 ## v1.1.0 (2025-10-17)
 
 - Allow specifying companies in messages

lib/userlist/push/serializer.rb

@@ -28,25 +28,23 @@ def serialize?(resource)
     private
 
       def serialize_resource(resource)
-        return resource.identifier if serialized_resources.include?(resource)
+        preventing_circular_serialization(resource, fallback: resource.identifier) do
+          return unless serialize?(resource)
 
-        serialized_resources << resource
+          serialized = {}
 
-        return unless serialize?(resource)
+          resource.attribute_names.each do |name|
+            serialized[name] = resource.send(name)
+          end
 
-        serialized = {}
+          resource.association_names.each do |name|
+            next unless result = serialize_association(resource.send(name))
 
-        resource.attribute_names.each do |name|
-          serialized[name] = resource.send(name)
-        end
-
-        resource.association_names.each do |name|
-          next unless result = serialize_association(resource.send(name))
+            serialized[name] = result
+          end
 
-          serialized[name] = result
+          serialized
         end
-
-        serialized
       end
 
       def serialize_association(association)
@@ -74,6 +72,23 @@ def serialize_collection(collection)
       def serialized_resources
         @serialized_resources ||= Set.new
       end
+
+      def serialized_types
+        @serialized_types ||= Set.new
+      end
+
+      def preventing_circular_serialization(resource, fallback: nil)
+        return fallback if serialized_types.include?(resource.class) || serialized_resources.include?(resource)
+
+        serialized_types.add(resource.class)
+        serialized_resources.add(resource)
+
+        begin
+          yield
+        ensure
+          serialized_types.delete(resource.class)
+        end
+      end
     end
   end
 end

spec/userlist/push/serializer_spec.rb

@@ -170,19 +170,7 @@
                 company: {
                   identifier: 'company-identifier',
                   name: 'Example, Inc.',
-                  signed_up_at: nil,
-                  relationships: [
-                    {
-                      company: 'company-identifier',
-                      user: {
-                        identifier: 'other-user-identifier',
-                        email: 'bar@example.com'
-                      },
-                      properties: {
-                        role: 'member'
-                      }
-                    }
-                  ]
+                  signed_up_at: nil
                 },
                 properties: {
                   role: 'admin'
@@ -384,19 +372,7 @@
             company: {
               identifier: 'company-identifier',
               name: 'Example, Inc.',
-              signed_up_at: nil,
-              relationships: [
-                {
-                  company: 'company-identifier',
-                  user: {
-                    identifier: 'other-user-identifier',
-                    email: 'bar@example.com'
-                  },
-                  properties: {
-                    role: 'member'
-                  }
-                }
-              ]
+              signed_up_at: nil
             },
             properties: {
               role: 'admin'
@@ -509,19 +485,7 @@
                   company: {
                     identifier: 'company-identifier',
                     name: 'Example, Inc.',
-                    signed_up_at: nil,
-                    relationships: [
-                      {
-                        company: 'company-identifier',
-                        user: {
-                          identifier: 'other-user-identifier',
-                          email: 'bar@example.com'
-                        },
-                        properties: {
-                          role: 'member'
-                        }
-                      }
-                    ]
+                    signed_up_at: nil
                   },
                   properties: {
                     role: 'admin'