Jobでpartialを読み込んだ時に、user_signed_in? や current_userが効かない。

Question

Rails 6.0.3
ruby 2.6.5p114

ActionCableでチャットアプリを作っています。

とある脆弱性が見つかってしまいました..

↓　ActionCableでテストさんがメッセージを発信して、ActionJobで読み込んだ時。

↓　サイトをリロードしたとき。

コード一覧

room_channel.rb

class RoomChannel < ApplicationCable::Channel

  def subscribed
    
      stream_from "room_channel_#{params['room'].to_s}"
  end

  def unsubscribed
    # Any cleanup needed when channel is unsubscribed
  end

  def speak(data)
    ActionCable.server.broadcast 'room_channel', room_id: params['room'].to_s
    # NGワード集
    ng_word_params = [...省略] 
    ip = self.connection.ip_addr
    # puts "==========================" + current_user.name
    # user_signed_in? = self.connection.signed_in
    now = Time.now
    secondsAgo = now - 10
    if current_user.present?
      if Usermanager.where(user_id: current_user.id, room_ban: true, room_id: params['room'], login: true).exists?
        return false
      end
    else
      if Usermanager.where(ip_id: ip, room_ban: true, room_id: params['room'], login: false).exists?
        return false
      end
    end
    ng_word_params.each do |ng|
      unless current_user.present?
        if Usermanager.where(ip_id: ip,user_id: nil, room_ban: false, room_id: params['room'].to_s, login: false, ng_word: true).exists?
          unless data['message'].nil?
            if data['message'].include?(ng)
              return false
            end
          end
        end
      else
        if Usermanager.where(user_id: current_user.id, room_ban: false, room_id: params['room'].to_s, login: true, ng_word: true).exists?
          unless data['message'].nil?
            if data['message'].include?(ng)
              return false
            end
          end
        end
      end
    end



    if data['message'].include?("https://www.youtube.com/watch?v=")
      urll = data['message'].gsub(/http.+v=/, "")
      url = urll.gsub(/&.+./, "")
    elsif data['message'].include?("https://youtu.be/")
      url = data['message'].gsub(/http.+be./, "")
    end
    messagesCount = Message.where(ip_id: ip).where('created_at > ?', secondsAgo).count
  	
    unless current_user.present?
      p "===========ログインしてない======="
      if messagesCount <= 8
        unless data['message'].nil?
          if Usermanager.where(ip_id: ip, room_ban: false, message_limit: false, room_id: params['room'].to_s, login: false).exists?
             if data['message'].length <= 1000
          		 Message.create! content: data['message'], room_id: params['room'].to_s,username: "名無し",ip_id: ip, login: false, youtube_id: url, user_id: nil
        	   end
          end
         end
      end
    else
      p "===========ログインしてる======="

      if messagesCount <= 8
        unless data['message'].nil?
          if Usermanager.where(user_id: current_user.id, room_ban: false, room_id: params['room'].to_s,  message_limit: false, login: true).exists?
            if data['message'].length <= 1000
    		      Message.create! content: data['message'], user_id: current_user.id, room_id: params['room'].to_s,username: current_user.name, ip_id: ip, login: true, youtube_id: url
    	      end
          end
        end
      end
    end
  end
end

message_broadcast_job.rb

class MessageBroadcastJob < ApplicationJob
  queue_as :default

  def perform(message)
  	p "------ROOMCHANNELROADCAST-------------"
  	ActionCable.server.broadcast "room_channel_#{message.room_id}", message: render_message(message)
  end
  private

  def render_message(message)
  	# ApplicationController.renderer.render(partial: 'messages/message', locals: { message: message })
     ApplicationController.render_with_signed_in_user(message.user, partial: 'messages/message', locals: { message: message })
    
  end


end

message.rb

class Message < ApplicationRecord
	belongs_to :user, optional: true
	belongs_to :room
	belongs_to :usermanager, optional: true
	after_update_commit { EditBroadcastJob.perform_later self }
	after_create_commit { MessageBroadcastJob.perform_later self }

	# after_update_commit { EditBroadcastJob.perform_later self }
	# has_rich_text :content
	validates :content, length: {maximum: 1000 }
	mount_uploader :image, ImageUploader
	
	validate :image_size
	private

	def image_size
		if image.size > 5.megabytes
			errors.add(:image, "容量が大きすぎます。5MB未満のファイルにしてください。")
		end
	end
end

_message.html.erb

<div class="message-support" id="message-support-<%= message.id %>">
	<div class="message" id="message-<%= message.id %>">
		<div class="usernameAndTimeBox">
			<% unless message.user_id.nil? %>
				<%= link_to message.username, user_path(message.user_id),class: "message_username" %>
			<% else %>
				<p class="message_username"><%= message.username %></p>
			<% end %>
			<div class="usettimeAndDeleteBox">
				<p class="agomessage"><%= time_ago_in_words(message.created_at) + "前" %></p>
				<% if user_signed_in? %>
					messageUserId: <%= message.user_id %>
					CurrentUserId: <%= current_user.id %>
					<% if message.user_id == current_user.id %>
						<button id="<%= message.id %>" class="delete_btn">
							<%= image_tag "ゴミ箱のアイコン素材.png", class: "deleteBtnImage", id: "#{message.id}" %>
						</button>
						<button id="edit_click-<%= message.id %>" class="edit_click">
							<%= image_tag "鉛筆のアイコン素材.png"%>
						</button>
					<% end %>
				<% end %>
			</div>
		</div>
		<div id="message-<%= message.id %>-box">
			<%= raw Rinku.auto_link simple_format h(message.content), class: "message_content", id: "message-link-#{message.id}" %>
		</div>
		<% unless message.youtube_id.nil? %>
			<% iframe = content_tag(
				:iframe,
				'',
				width: 560,
				height: 315,
				src: "https://www.YouTube.com/embed/#{message.youtube_id}",
				frameborder: 0,
				allowfullscreen: true,
				class: "youtube-container"
			) %>
			<%= content_tag(:div, iframe, class: "youtube-container2") %>
		<% end %>
		<% if message.image? %>
			<%= image_tag message.image.url %>
		<% end %>
		<!-- <div class="d" -->
	<!-- 	<div class="editBox">
			<div class="formchat">
				<%#= form_with model: message, url: message_path(message)  do |f| %>
					<%#= f.rich_text_area :content %>
					<%#= f.submit %>
				<%# end %>
			</div>
		</div> -->
		<% if user_signed_in? %>
			<% if current_user.id == message.user_id %>
				<div id="edit_form_box_<%= message.id %>" class="editform">
					<%= text_area_tag :content,nil,data: {behavior: "edit_speaker"},id: "message-#{message.id} form-message-#{message.id}", class: "edit_form" %>
					<%= submit_tag "編集", class: "edit_submit" %>
				</div>
			<% end %>
		<% end %>
	</div>
</div>

<script>
	// var message_value = document.getElementById("message-link-<%= message.id %>");
	// console.log(message_value)
	// $('.edit_form').val(message_value.value) 
	var click = true

	$("#edit_click-<%= message.id %>").click(function(){

		if(click == true){

			$('#edit_form_box_<%= message.id %>').fadeIn('slow');
			click = false
		}else{
			console.log("hi")
			$('#edit_form_box_<%= message.id %>').fadeOut('slow');
			click = true
		}
	});
</script>

application.controller.rb

class ApplicationController < ActionController::Base
	protect_from_forgery
	# ApplicationController.render 'messages/message'
	before_action :configure_permitted_parameters, if: :devise_controller?
	before_action :search
	def configure_permitted_parameters
		devise_parameter_sanitizer.permit(:sign_up, keys: [:name])
	end

	def self.render_with_signed_in_user(user, *args)
	   ActionController::Renderer::RACK_KEY_TRANSLATION['warden'] ||= 'warden'
	   proxy = Warden::Proxy.new({}, Warden::Manager.new({})).tap{|i| i.set_user(user, scope: :user) }
	   renderer = self.renderer.new('warden' => proxy)
	   renderer.render(*args)
	 end
	 
	def search
		@q = Room.ransack(params[:q])
		@rooms = @q.result(distinct: true).where(public: true)
	end
end