WA-VERIFY-091: Audit and fix Mongoid 8 any_of scoping semantics (9 call sites)

- Fix ActivityViewModel#scoped_entries: chained any_of in a loop produced
  AND-of-ORs under Mongoid 8, silently returning no results when multiple ids
  were supplied. Collect all clauses and call any_of once.

- Fix Tax::Rate.search: pass clauses as splat (any_of(*clauses)) to match
  Mongoid 8's expected signature.

- All other 7 call sites audited: single standalone calls, semantics unchanged.

Tests added:
  - GeneratedPromoCode not_expired scope (nil vs future vs past expires_at)
  - Navigation::Redirect.search (path + destination regex branches)
  - Tax::Rate.search (region / postal_code / country clauses)
  - FeaturedProducts.changesets (changeset and original product_ids branches)
  - Expanded lint tests to cover both nil and [] variants for images/variants

Closes #1083

Author: Kit (OpenClaw)

core/test/models/workarea/featured_products_changesets_test.rb

@@ -0,0 +1,32 @@
+require 'test_helper'
+
+module Workarea
+  class FeaturedProductsChangesetsTest < TestCase
+    def test_changesets_finds_by_product_id_in_changeset_and_original
+      release = create_release
+
+      in_changeset = Release::Changeset.create!(
+        release:    release,
+        changeset:  { 'product_ids' => %w(P1 P2) },
+        original:   {}
+      )
+
+      in_original = Release::Changeset.create!(
+        release:    release,
+        changeset:  {},
+        original:   { 'product_ids' => %w(P1) }
+      )
+
+      unrelated = Release::Changeset.create!(
+        release:    release,
+        changeset:  { 'product_ids' => %w(P3) },
+        original:   { 'product_ids' => %w(P4) }
+      )
+
+      results = FeaturedProducts.changesets('P1').to_a
+      assert_includes(results, in_changeset)
+      assert_includes(results, in_original)
+      refute_includes(results, unrelated)
+    end
+  end
+end

core/test/models/workarea/navigation/redirect_test.rb

@@ -26,6 +26,17 @@ def test_sanitizing_paths
         end
       end
 
+      def test_search
+        path_match = create_redirect(path: '/foo-bar', destination: '/other')
+        dest_match = create_redirect(path: '/something', destination: '/foo-destination')
+        no_match   = create_redirect(path: '/baz', destination: '/qux')
+
+        results = Redirect.search('foo').to_a
+        assert_includes(results, path_match)
+        assert_includes(results, dest_match)
+        refute_includes(results, no_match)
+      end
+
       def test_handle_invalid_path
         path = '/category/FoalBroodmare/Supplements-Mares & Foals/20552.html'
         encoded_path = URI::DEFAULT_PARSER.escape(path)

core/test/models/workarea/pricing/discount/generated_promo_code_test.rb

@@ -8,6 +8,19 @@ def test_generated_promo_code
           code = GeneratedPromoCode.generate_code('WL-')
           assert_match(/WL-/i, code)
         end
+
+        def test_not_expired_scope
+          code_list = create_code_list
+
+          expired     = code_list.promo_codes.create!(code: 'exp',    expires_at: 1.day.ago)
+          nil_expiry  = code_list.promo_codes.create!(code: 'nilexp', expires_at: nil)
+          future      = code_list.promo_codes.create!(code: 'future', expires_at: 1.day.from_now)
+
+          results = code_list.promo_codes.not_expired.to_a
+          assert_includes(results, nil_expiry)
+          assert_includes(results, future)
+          refute_includes(results, expired)
+        end
       end
     end
   end

core/test/models/workarea/tax/rate_test.rb

@@ -0,0 +1,35 @@
+require 'test_helper'
+
+module Workarea
+  module Tax
+    class RateTest < TestCase
+      def test_search
+        category = create_tax_category(rates: [])
+
+        pa_region    = category.rates.create!(country: Country['US'], region: 'PA')
+        zip_code     = category.rates.create!(country: Country['US'], postal_code: '19106')
+        canada       = category.rates.create!(country: Country['CA'])
+        other        = category.rates.create!(country: Country['US'], region: 'NJ', postal_code: '07001')
+
+        # region match
+        results = Rate.search('PA').to_a
+        assert_includes(results, pa_region)
+        refute_includes(results, zip_code)
+        refute_includes(results, canada)
+
+        # postal code match
+        results = Rate.search('191').to_a
+        assert_includes(results, zip_code)
+        refute_includes(results, pa_region)
+
+        # country match
+        results = Rate.search('CA').to_a
+        assert_includes(results, canada)
+
+        # no match
+        results = Rate.search('NOPE').to_a
+        assert_empty(results)
+      end
+    end
+  end
+end

notes/WA-VERIFY-091-mongoid8-any-of.md

@@ -0,0 +1,65 @@
+# WA-VERIFY-091 — Mongoid 8 `any_of` scoping semantics
+
+## Background
+
+Mongoid 8 changes how repeated `Criteria#any_of` calls compose. In Mongoid 7,
+chaining `.any_of` multiple times tended to expand/merge into one `$or` selector
+(widening). In Mongoid 8 each `.any_of` call is preserved as a separate clause,
+producing `$and[$or, $or, …]` (narrowing). The main risk areas are:
+
+1. **Loop-based chaining** – calling `.any_of(…)` inside a loop produces ANDs of
+   ORs in Mongoid 8, so results progressively narrow with each iteration rather
+   than widen.
+2. **Array-as-single-arg** – `any_of(array)` vs `any_of(*array)`. Mongoid 8's
+   signature changed; splatting is safer across versions.
+
+## Call sites audited (9 total)
+
+| # | File | Pattern | Risk | Action |
+|---|------|---------|------|--------|
+| 1 | `admin/…/activity_view_model.rb` | Loop: `criteria = criteria.any_of(…)` per id | **High** – multiple ids would narrow to nothing | Fixed: collect all clauses, call `any_of` once |
+| 2 | `core/…/tax/rate.rb` | `any_of(clauses)` – array as single arg | Low–Med | Fixed: splatted to `any_of(*clauses)` |
+| 3 | `core/…/discount/generated_promo_code.rb` | `any_of({ expires_at: nil }, { :expires_at.gt => … })` | Low – single call, two hashes | OK – no change needed; behavior confirmed by new test |
+| 4 | `core/…/taxonomy_sitemap.rb` | `.any_of({ :url.ne => nil }, { :navigable_id.ne => nil })` | Low – single standalone call | OK – existing test passes |
+| 5 | `core/…/navigation/redirect.rb` | `any_of({ path: regex }, { destination: regex })` | Low – single standalone call | OK – covered by new test |
+| 6 | `core/…/featured_products.rb` | `Release::Changeset.any_of(…)` | Low – single standalone call | OK – covered by new test |
+| 7 | `core/…/tax/category.rb` | `rates.any_of(…)` | Low – single standalone call | OK – existing test passes |
+| 8 | `core/lib/…/products_missing_variants.rb` | `.any_of({ variants: nil }, { variants: [] })` | Low – single call | OK – test expanded to cover both `nil` and `[]` cases |
+| 9 | `core/lib/…/products_missing_images.rb` | `.any_of({ images: nil }, { images: [] })` | Low – single call | OK – test expanded to cover both `nil` and `[]` cases |
+
+## Changes made
+
+### `admin/app/view_models/workarea/admin/activity_view_model.rb`
+
+**Problem:** The `scoped_entries` method iterated over `options[:id]` and chained
+`criteria.any_of(…)` inside the loop. With Mongoid 8 this would produce an AND of
+ORs, returning empty results when more than one id was supplied.
+
+**Fix:** Collect all `{ audited_id: … }` and `{ 'document_path.id' => … }` clauses
+into a flat array and call `.any_of(*clauses)` once outside the loop.
+
+### `core/app/models/workarea/tax/rate.rb`
+
+**Problem:** `any_of(clauses)` — passing an Array as a single argument. Mongoid 8
+signature prefers splatted args.
+
+**Fix:** Changed to `any_of(*clauses)`.
+
+## Tests added / updated
+
+- `core/test/lib/workarea/lint/products_missing_variants_test.rb` — cover both
+  `variants: []` and `variants: nil` cases.
+- `core/test/lib/workarea/lint/products_missing_images_test.rb` — same for images.
+- `core/test/models/workarea/pricing/discount/generated_promo_code_test.rb` —
+  `test_not_expired_scope`: confirms both `nil` and future-date codes are returned,
+  expired codes are excluded.
+- `core/test/models/workarea/navigation/redirect_test.rb` — `test_search`: both
+  path and destination regex branches return expected records.
+- `core/test/models/workarea/tax/rate_test.rb` — `test_search`: region, postal
+  code, and country clause branches all return expected records.
+- `core/test/models/workarea/featured_products_changesets_test.rb` —
+  `test_changesets_finds_by_product_id_in_changeset_and_original`.
+
+## No intentional behavior differences
+
+All changes are backward-compatible and preserve the original Mongoid 7 semantics.