#361

backend/app/controllers/gekanator_games_controller.rb

@@ -1,6 +1,6 @@
 class GekanatorGamesController < ApplicationController
   def create
-    return head :not_found unless current_user&.admin?
+    return head :unauthorized unless current_user
 
     guessed_post_id = params.require(:guessed_post_id)
     correct_post_id = params[:correct_post_id].presence
@@ -22,10 +22,8 @@ class GekanatorGamesController < ApplicationController
   end
 
   def extra_questions
-    return head :not_found unless current_user&.admin?
-
-    game = GekanatorGame.find_by(id: params[:id])
-    return head :not_found unless game
+    game = find_owned_game
+    return if performed?
 
     questions =
         GekanatorQuestion
@@ -45,10 +43,8 @@ class GekanatorGamesController < ApplicationController
   end
 
   def extra_question_answers
-    return head :not_found unless current_user&.admin?
-
-    game = GekanatorGame.find_by(id: params[:id])
-    return head :not_found unless game
+    game = find_owned_game
+    return if performed?
 
     answer_params = params.require(:answers)
     if !answer_params.is_a?(Array)
@@ -137,4 +133,16 @@ class GekanatorGamesController < ApplicationController
 
     question.priority_weight.to_f / (1.0 + sample_count * 0.15)
   end
+
+  def find_owned_game
+    return head :unauthorized unless current_user
+
+    game = GekanatorGame.find_by(id: params[:id])
+    return head :not_found unless game
+    if !current_user.admin? && game.user_id != current_user.id
+      return head :not_found
+    end
+
+    game
+  end
 end

backend/app/controllers/gekanator_posts_controller.rb

@@ -1,7 +1,5 @@
 class GekanatorPostsController < ApplicationController
   def index
-    return head :not_found unless current_user&.admin?
-
     posts =
         Post
         .preload(tags: :tag_name)

backend/app/controllers/gekanator_question_suggestions_controller.rb

@@ -1,9 +1,12 @@
 class GekanatorQuestionSuggestionsController < ApplicationController
   def create
-    return head :not_found unless current_user&.admin?
+    return head :unauthorized unless current_user
 
     game = GekanatorGame.find_by(id: params.require(:gekanator_game_id))
     return head :not_found unless game
+    if !current_user.admin? && game.user_id != current_user.id
+      return head :not_found
+    end
 
     suggestion = GekanatorQuestionSuggestion.new(
         gekanator_game: game,

backend/app/controllers/gekanator_questions_controller.rb

@@ -1,7 +1,5 @@
 class GekanatorQuestionsController < ApplicationController
   def index
-    return head :not_found unless current_user&.admin?
-
     questions =
         GekanatorQuestion
         .accepted
@@ -49,6 +47,8 @@ class GekanatorQuestionsController < ApplicationController
       "title:length-at-least:#{ condition[:length].to_i + 1 }"
     when 'title-has-ascii'
       'title:ascii'
+    when 'title-contains'
+      "title:contains:#{ condition[:text] }"
     when 'post-similarity'
       "post-similarity:#{ question.id }"
     else
@@ -77,6 +77,8 @@ class GekanatorQuestionsController < ApplicationController
     case condition[:type]
     when 'title-length-at-least'
       "タイトルは #{ condition[:length] } 文字以上?"
+    when 'title-contains'
+      "題名に「#{ condition[:text] }」が含まれる?"
     else
       question.text
     end