Index: openacs-4/packages/notifications/tcl/sweep-procs.tcl
===================================================================
RCS file: /usr/local/cvsroot/openacs-4/packages/notifications/tcl/sweep-procs.tcl,v
diff -u -r1.28.2.4 -r1.28.2.5
--- openacs-4/packages/notifications/tcl/sweep-procs.tcl	6 Mar 2021 19:36:36 -0000	1.28.2.4
+++ openacs-4/packages/notifications/tcl/sweep-procs.tcl	17 Aug 2021 09:54:15 -0000	1.28.2.5
@@ -29,7 +29,7 @@
                            and     num.notification_id = n.notification_id
                            and     num.user_id = user_id))
 
-               or not acs_permission.permission_p(object_id, user_id, 'read')
+               -- or not acs_permission.permission_p(object_id, user_id, 'read')
         }] {
             notification::request::delete -request_id $request_id
         }
@@ -50,33 +50,59 @@
     } {
         This sweeps for notifications in a particular interval
     } {
-        # Look for notifications joined against the requests they may match with the right interval_id
-        # order it by user_id
-        # make sure the users have not yet received this notification with outer join
-        # on the mapping table and a null check
+        #
+        # Look for notifications joined against the requests they may
+        # match with the right interval_id order it by user_id.  Make
+        # sure the users have not yet received this notification with
+        # outer join on the mapping table and a null check.
+        #
         set notifications [db_list_of_ns_sets select_notifications {
             select notification_id,
                    notif_subject,
                    notif_text,
                    notif_html,
                    file_ids,
                    user_id,
+                   request_id,
                    type_id,
                    delivery_method_id,
                    response_id,
                    notif_date,
-                   notif_user
+                   notif_user,
+                   acs_permission.permission_p(notification_requests.object_id, notification_requests.user_id, 'read') as still_valid_p
             from notifications inner join notification_requests using (type_id, object_id)
               inner join acs_objects on (notification_requests.request_id = acs_objects.object_id)
               left outer join notification_user_map using (notification_id, user_id)
             where sent_date is null
               and creation_date <= notif_date
               and (notif_date is null or notif_date < current_timestamp)
               and interval_id = :interval_id
-              and acs_permission.permission_p(notification_requests.object_id, notification_requests.user_id, 'read')
-          order by user_id, type_id, notif_date
+            order by user_id, type_id, notif_date
         }]
 
+        foreach notif $notifications {
+            if {![ns_set get $notif still_valid_p]} {
+                #
+                # The user has lost permissions on the object, so
+                # delete this notification. This deletion was done
+                # before in the highly expensive query in
+                # "cleanup_notifications"
+                #
+                ns_log notice "delete notification [ns_set get $notif request_id]" \
+                    "for user_id [ns_set get $notif user_id]" \
+                    "since user has lost rights on object"
+
+                notification::request::delete \
+                    -request_id [ns_set get $notif request_id]
+                #
+                # Remove this tuple from the notification list such we
+                # do not have to double-check for this.
+                #
+                set idx [lsearch $notifications $notif]
+                set notifications [lreplace $notifications $idx $idx]
+            }
+        }
+
         if {$batched_p} {
             set prev_user_id 0
             set prev_type_id 0
@@ -104,9 +130,10 @@
                     set user_id ""
                     set type_id ""
                 }
-
-                # Check if we have a new user_id and type_id
-                # if so, batch up previous stuff and send it
+                #
+                # Check if we have a new user_id and type_id. If so,
+                # batch up previous stuff and send it.
+                #
                 if {$notif eq "STOP" || $user_id != $prev_user_id || $type_id != $prev_type_id} {
 
                     ns_log Debug "NOTIF-BATCHED: batching things up for $prev_user_id"
@@ -170,13 +197,20 @@
                 }
 
                 append summary_text "[ns_set get $notif notif_subject]\n"
-                append summary_html "<li><a href=#[ns_set get $notif notification_id]>[ns_set get $notif notif_subject]</a></li>"
+                append summary_html \
+                    "<li><a href='#[ns_set get $notif notification_id]'>" \
+                    [ns_set get $notif notif_subject] \
+                    "</a></li>"
+                append batched_content_text \
+                    "[_ notifications.SUBJECT] [ns_set get $notif notif_subject]\n" \
+                    [ns_set get $notif notif_text] \
+                    "\n=====================\n"
+                append batched_content_html \
+                    "<a name='[ns_set get $notif notification_id]'>" \
+                    "[_ notifications.SUBJECT] </a> [ns_set get $notif notif_subject]\n" \
+                    " $notif_html <hr><p>"
 
-                append batched_content_text "[_ notifications.SUBJECT] [ns_set get $notif notif_subject]\n[ns_set get $notif notif_text]\n=====================\n"
-                append batched_content_html "<a name=[ns_set get $notif notification_id]>[_ notifications.SUBJECT]</a> [ns_set get $notif notif_subject]\n $notif_html <hr><p>"
-
                 lappend batched_file_ids {*}[ns_set get $notif file_ids]
-
                 lappend list_of_notification_ids [ns_set get $notif notification_id]
 
                 # Set the vars
@@ -186,7 +220,9 @@
             }
 
         } else {
+            #
             # Unbatched
+            #
             foreach notif $notifications {
                 db_transaction {
                     # Send it
@@ -201,7 +237,7 @@
                         -reply_object_id [ns_set get $notif response_id] \
                         -delivery_method_id [ns_set get $notif delivery_method_id]
 
-                        # Mark it as sent
+                    # Mark it as sent
                     notification::mark_sent \
                         -notification_id [ns_set get $notif notification_id] \
                         -user_id [ns_set get $notif user_id]