performance optimization on cost attributes

Depending on whether the associations are already eager loaded or not it might be faster to do the permission check in the rails world or in the DB

lib/open_project/costs/attributes_helper.rb

@@ -33,11 +33,23 @@ module OpenProject::Costs
     end
 
     def time_entries
-      @work_package.time_entries.visible(@user, @work_package.project)
+      if @work_package.time_entries.loaded?
+        @work_package.time_entries.select do |time_entry|
+          time_entry.visible_by?(@user)
+        end
+      else
+        @work_package.time_entries.visible(@user, @work_package.project)
+      end
     end
 
     def cost_entries
-      @cost_entries ||= @work_package.cost_entries.visible(@user, @work_package.project)
+      @cost_entries ||= if @work_package.cost_entries.loaded?
+                          @work_package.cost_entries.select do |cost_entry|
+                            cost_entry.visible_by?(@user)
+                          end
+                        else
+                          @work_package.cost_entries.visible(@user, @work_package.project)
+                        end
     end
 
     private