1 files changed, 20 insertions, 10 deletions
diff --git a/app/finders/releases_finder.rb b/app/finders/releases_finder.rb
index 78240e0a050..c7d35f62673 100644
--- a/app/finders/releases_finder.rb
+++ b/app/finders/releases_finder.rb
@@ -6,18 +6,19 @@ class ReleasesFinder
   attr_reader :parent, :current_user, :params
 
   def initialize(parent, current_user = nil, params = {})
-    @parent = parent
+    @parent = Array.wrap(parent)
     @current_user = current_user
     @params = params
 
     params[:order_by] ||= 'released_at'
+    params[:order_by_for_latest] ||= 'released_at'
     params[:sort] ||= 'desc'
   end
 
   def execute(preload: true)
-    return Release.none if projects.empty?
+    return Release.none if authorized_projects.empty?
 
-    releases = get_releases
+    releases = params[:latest] ? get_latest_releases : get_releases
     releases = by_tag(releases)
     releases = releases.preloaded if preload
     order_releases(releases)
@@ -26,17 +27,22 @@ class ReleasesFinder
   private
 
   def get_releases
-    Release.where(project_id: projects).where.not(tag: nil) # rubocop: disable CodeReuse/ActiveRecord
+    Release.where(project_id: authorized_projects).where.not(tag: nil) # rubocop: disable CodeReuse/ActiveRecord
   end
 
-  def projects
-    strong_memoize(:projects) do
-      if parent.is_a?(Project)
-        Ability.allowed?(current_user, :read_release, parent) ? [parent] : []
-      end
-    end
+  def get_latest_releases
+    Release.latest_for_projects(authorized_projects, order_by: params[:order_by_for_latest]).where.not(tag: nil) # rubocop: disable CodeReuse/ActiveRecord
   end
 
+  def authorized_projects
+    # Preload policy for all projects to avoid N+1 queries
+    projects = Project.id_in(parent.map(&:id)).include_project_feature
+    Preloaders::ProjectPolicyPreloader.new(projects, current_user).execute
+
+    projects.select { |project| authorized?(project) }
+  end
+  strong_memoize_attr :authorized_projects
+
   # rubocop: disable CodeReuse/ActiveRecord
   def by_tag(releases)
     return releases unless params[:tag].present?
@@ -48,4 +54,8 @@ class ReleasesFinder
   def order_releases(releases)
     releases.sort_by_attribute("#{params[:order_by]}_#{params[:sort]}")
   end
+
+  def authorized?(project)
+    Ability.allowed?(current_user, :read_release, project)
+  end
 end