Fix #4867: random=true in api only returns one post.

Pundit 2.1.1 changed it so that if the first argument to `authorize` is
an Array, then the `authorize` call returns the last element of the
array. This broke order:random, because in that case we returned an
Array of posts. The fix is to return an ActiveRecord::Relation of posts,
which is more correct anyway.

app/logical/post_sets/post.rb

@@ -115,7 +115,7 @@ module PostSets
         @post_count = get_post_count
 
         if is_random?
-          get_random_posts
+          get_random_posts.paginate(page, search_count: false, limit: per_page, max_limit: max_per_page).load
         else
           normalized_query.build.paginate(page, count: post_count, search_count: !post_count.nil?, limit: per_page, max_limit: max_per_page).load
         end

app/models/post.rb

@@ -1145,11 +1145,18 @@ class Post < ApplicationRecord
   end
 
   module SearchMethods
+    # Return a set of up to N random posts. May return less if there aren't
+    # enough posts.
+    #
+    # @param n [Integer] The maximum number of posts to return
+    # @return [ActiveRecord::Relation<Post>]
     def random(n = 1)
-      n.times.map do
+      posts = n.times.map do
         key = SecureRandom.hex(16)
         random_up(key) || random_down(key)
       end.compact.uniq
+
+      find_ordered(posts.map(&:id))
     end
 
     def random_up(key)

test/functional/posts_controller_test.rb

@@ -322,6 +322,15 @@ class PostsControllerTest < ActionDispatch::IntegrationTest
           get posts_path, params: { random: "1" }
           assert_response :success
         end
+
+        should "return all posts for a .json response" do
+          create_list(:post, 2, tag_string: "honk_honk")
+          get posts_path, params: { tags: "honk_honk order:random" }, as: :json
+
+          assert_response :success
+          assert_equal(true, response.parsed_body.is_a?(Array))
+          assert_equal(2, response.parsed_body.size)
+        end
       end
 
       context "with the .atom format" do