JR 0.9 ignores #records_for, crashes from nonstandard #records

We've moved our main app to JR 0.9 (yay caching!) but are facing an issue where #records_for isn't being called to get associated records for a request with include param. Instead, the associated resource's #records method is being called.

I'm inclined to call this a regression, honestly, since #records_for is still documented as a potential hookup location for authorization code. I was actually just about to override this so that certain associations would ignore our authorization code, and found that it wasn't being called at all.

It doesn't appear to be a security issue for us (due to the way our authorization works), but this behavior could potentially cause security issues in other apps, depending on how they are architected (namely, if their #records_for authorized differently from their #records)

Strongly related: if the #records call on the associated resource causes some of the associations to be nonexistent, it causes an exception, since it can't find the ID of the associated record in the Hash it's built up for preload data

Non sono indicati file o test. Inizia tracciando il percorso include/preload che chiama #records della risorsa associata, quindi confrontalo con l’hook #records_for documentato e con la gestione degli ID di associazione mancanti. Il lavoro è completato quando viene usato l’hook previsto e i record associati inesistenti non causano più l’eccezione nella ricerca di preload.