From e0b6b3b06a39556048cdf623356387f45b919f55 Mon Sep 17 00:00:00 2001
From: John Davis <jdavcs@gmail.com>
Date: Tue, 26 Sep 2023 17:02:49 -0400
Subject: [PATCH] Fix bug (replace str with model attrs in join clauses), fix
 SA2.0 requirements

SA2.0: add unique() to joinedload result
---
 lib/galaxy/model/security.py | 18 ++++++++----------
 1 file changed, 8 insertions(+), 10 deletions(-)

diff --git a/lib/galaxy/model/security.py b/lib/galaxy/model/security.py
index 1f318dd556af..48f966e0a9f5 100644
--- a/lib/galaxy/model/security.py
+++ b/lib/galaxy/model/security.py
@@ -25,6 +25,7 @@
     HistoryDatasetAssociationDisplayAtAuthorization,
     Library,
     LibraryDataset,
+    LibraryDatasetDatasetAssociation,
     LibraryDatasetPermissions,
     LibraryPermissions,
     Role,
@@ -1535,17 +1536,14 @@ def check_folder_contents(self, user, roles, folder, hidden_folder_ids=""):
             return True, ""
         action = self.permitted_actions.DATASET_ACCESS
 
-        lddas = (
-            self.sa_session.query(self.model.LibraryDatasetDatasetAssociation)
-            .join("library_dataset")
-            .filter(self.model.LibraryDataset.folder == folder)
-            .join("dataset")
-            .options(
-                joinedload(self.model.LibraryDatasetDatasetAssociation.dataset).joinedload(self.model.Dataset.actions)
-            )
-            .all()
+        stmt = (
+            select(LibraryDatasetDatasetAssociation)
+            .join(LibraryDatasetDatasetAssociation.library_dataset)
+            .where(LibraryDataset.folder == folder)
+            .join(Dataset)
+            .options(joinedload(LibraryDatasetDatasetAssociation.dataset).joinedload(Dataset.actions))
         )
-
+        lddas = self.sa_session.scalars(stmt).unique()
         for ldda in lddas:
             ldda_access_permissions = self.get_item_actions(action, ldda.dataset)
             if not ldda_access_permissions: