# UNDF: UNDF-2026-000000857
# UNDF: (leave blank)
# CWE-407: Project#members_among user_ids Array#include? in select loop
# Severity: MEDIUM
# Speedup: ~100x at U=200 users, A=500 authorized user IDs
# File: app/models/project.rb
# The members_among method fetches authorized user IDs via pluck(:id)
# into an Array, then filters the input users collection with
# users.select { |user| user_ids.include?(user.id) }. Each include?
# is O(A) where A = number of authorized user IDs. Called for each
# of U input users. Total: O(U * A). On large projects with many
# authorized users, A can be thousands.
# Fix: convert user_ids to a Set for O(1) lookup.
--- a/app/models/project.rb
+++ b/app/models/project.rb
@@ -2498,8 +2498,8 @@ class Project < ApplicationRecord
     else
       return [] if users.empty?

-      user_ids = authorized_users.where(users: { id: users.map(&:id) }).pluck(:id)
-      users.select { |user| user_ids.include?(user.id) }
+      user_ids = authorized_users.where(users: { id: users.map(&:id) }).pluck(:id).to_set
+      users.select { |user| user_ids.member?(user.id) }
     end
   end