Fix find_signed for models with a composite primary key - #57245

Summary

ActiveRecord::SignedId::ClassMethods#find_signed raises an ArgumentError for any model that declares a composite primary key (e.g. self.primary_key = [:shop_id, :id]). The bang variant find_signed! works correctly. This PR makes find_signed consistent with find_signed! and find.

The bug

class Cpk::Order < ActiveRecord::Base
  self.primary_key = [:shop_id, :id]
end

order = Cpk::Order.first
token = order.signed_id

Cpk::Order.find_signed!(token)
# => #<Cpk::Order id: 75294940, shop_id: 37647470, ...>

Cpk::Order.find_signed(token)
# => ArgumentError: Expected corresponding value for ["shop_id", "id"] to be an Array

Hits anyone using find_signed on a CPK model — for example, a magic sign-in link, password reset, or email confirmation that scopes its token to such a record.

Root cause

find_signed calls

find_by primary_key => id

at signed_id.rb. For composite primary keys, primary_key is an array (["shop_id", "id"]) and the verified id is also an array of values ([37647470, 75294940]). The predicate builder treats an array key as a request for multiple records and expects the value to be an array of arrays ([[shop_id, id], [shop_id, id], ...]). It iterates the inner values, finds non-arrays, and raises:

predicate_builder.rb:

ArgumentError: Expected corresponding value for ["shop_id", "id"] to be an Array

find_signed! does not hit this because it uses find(id), which dispatches to find_one and zips primary_key with id for CPK at finder_methods.rb.

Fix

Mirror the find_one pattern in find_signed:

if id = signed_id_verifier.verified(...)
  if composite_primary_key?
    find_by(primary_key.zip(id).to_h)
  else
    find_by(primary_key => id)
  end
end

find_by (rather than find) is preserved so relation scoping via SignedId::RelationMethods#find_signed still works (e.g. Cpk::Order.where(...).find_signed(token)).

Tests

Three new tests in signed_id_test.rb cover:

• find_signed round trip with CPK
• find_signed on a relation with CPK (positive + negative scope)
• find_signed! round trip with CPK (regression guard)

Added a CHANGELOG entry.

Without the fix, the first two fail with the ArgumentError shown above; with the fix, the full file (38 tests, 56 assertions) passes. CI will exercise MySQL and PostgreSQL as well.