Add NoParamsInWorkPackageWhereId cop

[akabiru]

Catches WorkPackage.where(id: params[...]) patterns that silently drop semantic work package identifiers (e.g. "PROJ-42") because PostgreSQL casts the string to integer 0 inside where(id: ...) and the row set comes back empty. The cop suggests WorkPackage.where_display_id_in(...) (added in opf/openproject#23016), which partitions numeric and semantic inputs and consults the alias table.

Background

Self-review thread on opf/openproject#23016 raised the question of whether to extend the runtime guard already in place on WorkPackage.find_by(id: "PROJ-42") (which raises UnsupportedLookup) to WorkPackage.where(id: "PROJ-42"). The conclusion was: don't — where is AR's universal predicate primitive, composed into joins, scopes, association preloading, and Rails internals; guarding it would invert the docstring's "low-level code uses primary keys" rationale and risks subtle breakage. The actual bug class is narrow (user input flowing into where(id:)) and lints cleanly. See discussion.

Behaviour

The cop fires only when:

• the receiver chain demonstrably resolves to a WorkPackage relation — either rooted at the WorkPackage constant (WorkPackage, WorkPackage.foo.bar(:baz), ...) or passing through an association call whose method name ends in work_packages (project.work_packages, current_user.assigned_work_packages, ...). Foo::WorkPackage and unrelated associations (project.users) are correctly not matched.
• the value contains a params[...] access (direct or in any descendant)

It autocorrects where(id: X) → where_display_id_in(X) when X is a pure params[...] access or || chain of them. Cases like params[:id].to_i flag without an autocorrection (the cast defeats where_display_id_in's smart partition).

# bad
WorkPackage.where(id: params[:work_package_id])
WorkPackage.where(id: params[:work_package_id] || params[:ids])
WorkPackage.includes(:project).where(id: params[:ids])
project.work_packages.where(id: params[:work_package_id])
current_user.assigned_work_packages.where(id: params[:ids])

# good
WorkPackage.where_display_id_in(params[:work_package_id])
project.work_packages.where_display_id_in(params[:work_package_id])

# good (primary key, not user input)
WorkPackage.where(id: 42)

# good (subquery, not user input)
WorkPackage.where(id: other_scope.select(:id))

Verification

• bundle exec rake green: 38 specs, 0 failures, RuboCop self-lint clean.
• Ran the cop against the full opf/openproject tree (6,746 files): 1 real offense (app/controllers/application_controller.rb:273, the very site Resolve semantic work package id when moving a work package openproject#23016 fixes), 0 false positives.

Release plan

Marked draft pending opf/openproject#23016 merging (which introduces where_display_id_in, the autocorrect target). Once both land, cut a 0.5.0 release and bump the gem version in opf/openproject in a separate PR.

Test plan

• bundle exec rake (specs + self-lint) green
• Cop run end-to-end against opf/openproject app/, modules/, lib/ — exactly the expected offense, no false positives
• Chained-association receivers (project.work_packages.where(id: params[...])) covered by spec

[Copilot]

Pull request overview

This PR introduces a new RuboCop cop to prevent a known class of bugs where user-supplied semantic WorkPackage identifiers (e.g., PROJ-42) are passed to WorkPackage.where(id: ...) and silently fail due to PostgreSQL integer coercion, and guides developers toward where_display_id_in.

Changes:

• Add OpenProject/NoParamsInWorkPackageWhereId cop with autocorrect to where_display_id_in for direct params[...] (and params[...] || params[...]) inputs.
• Add a dedicated spec suite covering rooted/chained receivers, association receivers, and non-autocorrectable wrapped params.
• Bump gem version to 0.5.0 and register the new cop in defaults, require list, and changelog.

Reviewed changes

Copilot reviewed 6 out of 7 changed files in this pull request and generated 2 comments.

Show a summary per file

File	Description
lib/rubocop/cop/open_project/no_params_in_work_package_where_id.rb	Implements the new cop, receiver detection, params detection, and autocorrect logic.
spec/rubocop/cop/open_project/no_params_in_work_package_where_id_spec.rb	Adds coverage for offense detection and autocorrection behavior across receiver forms.
lib/rubocop/cop/open_project_cops.rb	Registers the new cop for loading.
config/default.yml	Enables the new cop by default and records VersionAdded.
CHANGELOG.md	Documents the newly added cop under Unreleased.
lib/rubocop/open_project/version.rb	Bumps gem version to 0.5.0.
Gemfile.lock	Updates lockfile to reflect the new gem version.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.