#434

backend/app/controllers/application_controller.rb

@@ -1,4 +1,5 @@
 class ApplicationController < ActionController::API
+  include RequestAccess
   include ActionController::Cookies
   include ActionController::RequestForgeryProtection
 
@@ -8,34 +9,46 @@ class ApplicationController < ActionController::API
 
   rescue_from ActiveRecord::RecordInvalid, with: :render_record_invalid
   rescue_from ActiveRecord::RecordNotUnique, with: :render_record_not_unique
+  rescue_from(ActiveRecord::RecordNotFound) { head :not_found }
   rescue_from(UnsupportedLocale) { head :not_found }
 
   before_action :reject_banned_ip_address!
   before_action :authenticate_user
   before_action :reject_banned_user!
   before_action :validate_explicit_locale!
+  before_action :enforce_query_contract!
+  around_action :with_history_authority
+  rescue_from(HistoryAccess::Forbidden) { head :not_found }
   protect_from_forgery with: :exception
   self.forgery_protection_origin_check = true
   rescue_from ActionController::InvalidAuthenticityToken, with: :reject_invalid_csrf
   after_action :prevent_authenticated_caching
 
-  def current_user = @current_user
-
   private
 
+  def enforce_query_contract!
+    pairs = URI.decode_www_form(request.query_string)
+    return head :bad_request if pairs.length > 1000 || pairs.map(&:first).uniq.length != pairs.length
+    return head :bad_request if request.query_parameters.values.any? { !_1.is_a?(String) }
+    if (controller_name.start_with?('counts_') &&
+        (request.query_parameters.keys & ['headers', 'labels']).any?)
+      return head :bad_request
+    end
+  rescue ArgumentError
+    head :bad_request
+  end
+
+  def with_history_authority(&action)
+    response.headers['Cache-Control'] = 'private, no-store'
+    HistoryAccess.set(user: current_user, &action)
+  end
+
   def reject_invalid_csrf
     response.headers['X-CSRF-Invalid'] = '1'
     response.headers['Cache-Control'] = 'private, no-store'
     head :forbidden
   end
 
-  def authenticate_user
-    code = session[:inheritance_code]
-    return if code.blank?
-
-    @current_user = User.find_by(inheritance_code: code)
-  end
-
   def prevent_authenticated_caching
     response.headers['Cache-Control'] = 'private, no-store' if current_user
   end
@@ -79,19 +92,6 @@ class ApplicationController < ActionController::API
     render_validation_error base: ['すでに存在してゐます．']
   end
 
-  def reject_banned_ip_address!
-    ip_address = IpAddress.find_by(ip_address: IPAddr.new(request.remote_ip).hton)
-    return unless ip_address&.banned?
-
-    head :forbidden
-  end
-
-  def reject_banned_user!
-    return unless current_user&.banned?
-
-    head :forbidden
-  end
-
   def render_validation_error record = nil, fields: { }, base: [], status: :unprocessable_entity
     errors = { }
 

backend/app/controllers/concerns/counts_listing.rb

@@ -6,7 +6,7 @@ module CountsListing
     resource = is_a?(CountsPostsController) ? 'posts' : 'tags'
     query = CountsQuery.new(version_scope, resource, request.query_parameters.except('locale')
         .merge('locale' => locale.code))
-    result = { count: query.count, page: query.page, limit: query.limit,
+    result = { population_count_scope: 'all_recorded_versions', population_count: HistoryAccess.population_count(query.relation.klass), count: query.count, page: query.page, limit: query.limit,
                at: request.query_parameters['at'].presence || Time.current.utc.iso8601(6) }
     if query.mode == 'summary'
       result.merge!(query.summary)

backend/app/controllers/concerns/history_storage_access.rb

@@ -0,0 +1,52 @@
+# Permanent storage URLs must not bypass a resource's later discard boundary.
+module HistoryStorageAccess
+  extend ActiveSupport::Concern
+
+  included do
+    include RequestAccess
+    prepend_before_action :authorise_history_storage!
+  end
+
+  private
+
+  def authorise_history_storage!
+    response.headers['Cache-Control'] = 'private, no-store'
+    return unless request.get? || request.head?
+
+    reject_banned_ip_address!
+    return if performed?
+
+    authenticate_user
+    reject_banned_user!
+    return if performed?
+
+    signed = params[:signed_blob_id] || params[:signed_id]
+    blob = if signed
+             ActiveStorage::Blob.find_signed(signed)
+           elsif params[:encoded_key]
+             payload = ActiveStorage.verifier.verified(params[:encoded_key], purpose: :blob_key)
+             key = payload && (payload[:key] || payload['key'])
+             if key
+               original = key.start_with?('variants/') ? key.split('/')[1] : key
+               ActiveStorage::Blob.find_by(key: original)
+             end
+           end
+    return head :not_found unless blob
+
+    allowed = HistoryAccess.set(user: current_user) { HistoryAccess.blob_visible?(blob) }
+    head :not_found unless allowed
+  rescue ActiveSupport::MessageVerifier::InvalidSignature
+    head :not_found
+  end
+
+  # Override the engine's public-forever caching before a streaming response commits.
+  def http_cache_forever(**_options)
+    response.headers['Cache-Control'] = 'private, no-store'
+    yield
+  end
+
+  def expires_in(*arguments, **options)
+    super
+    response.headers['Cache-Control'] = 'private, no-store'
+  end
+end

backend/app/controllers/concerns/request_access.rb

@@ -0,0 +1,28 @@
+# Canonical read-side session and BAN boundary, shared by API and storage controllers.
+module RequestAccess
+  extend ActiveSupport::Concern
+
+  def current_user = @current_user
+
+  private
+
+  def authenticate_user
+    code = session[:inheritance_code]
+    return if code.blank?
+
+    @current_user = User.find_by(inheritance_code: code)
+  end
+
+  def reject_banned_ip_address!
+    ip_address = IpAddress.find_by(ip_address: IPAddr.new(request.remote_ip).hton)
+    return unless ip_address&.banned?
+
+    head :forbidden
+  end
+
+  def reject_banned_user!
+    return unless current_user&.banned?
+
+    head :forbidden
+  end
+end

backend/app/controllers/counts_exports_controller.rb

@@ -68,15 +68,15 @@ class CountsExportsController < ApplicationController
         .merge(request.query_parameters)
     exporter = CountsExporter.new(payload,
                                   language_code: locale.language_code)
-    response.headers['Content-Type'] = exporter.format == 'json' ?
-        'application/json; charset=utf-8' : 'text/csv; charset=utf-8'
-    response.headers['Content-Disposition'] =
-        "attachment; filename=\"counts-#{ exporter.resource }.#{ exporter.format }\""
-    response.headers['Cache-Control'] = 'private, no-store'
-    response.headers['X-Accel-Buffering'] = 'no'
-    # Rack::ETag otherwise materialises the response to calculate a digest.
-    response.headers['Last-Modified'] = Time.current.httpdate
-    self.response_body = exporter.body
+    session[:counts_export_owner] ||= SecureRandom.hex(32)
+    token = CountsExportDownload.prepare(exporter, session[:counts_export_owner])
+    file = CountsExportDownload.find(token, session[:counts_export_owner])
+    return head :not_found unless file
+
+    send_file file.fetch('path'),
+        filename: "counts-#{ exporter.resource }.#{ exporter.format }",
+        type: exporter.format == 'json' ? 'application/json' : 'text/csv',
+        disposition: 'attachment'
   rescue ArgumentError, TypeError, KeyError, JSON::ParserError
     head :bad_request
   end

backend/app/controllers/material_versions_controller.rb

@@ -8,7 +8,7 @@ class MaterialVersionsController < ApplicationController
 
     offset = (page - 1) * limit
 
-    q = MaterialVersion.includes(:created_by_user)
+    q = HistoryAccess.visible(MaterialVersion.includes(:created_by_user))
     q = q.where(material_id: params[:material_id]) if params[:material_id].present?
     q = q.where(tag_name: params[:tag].to_s.strip) if params[:tag].present?
     q = q.where(event_type: params[:event_type]) if params[:event_type].present?
@@ -20,7 +20,7 @@ class MaterialVersionsController < ApplicationController
         .limit(limit)
         .offset(offset)
 
-    render json: { versions: serialise_versions(versions), count: }
+    render json: { versions: serialise_versions(versions), count:, population_count: HistoryAccess.population_count(MaterialVersion) }
   end
 
   private

backend/app/controllers/post_versions_controller.rb

@@ -14,7 +14,7 @@ class PostVersionsController < ApplicationController
 
     offset = (page - 1) * limit
 
-    q = version_scope
+    q = HistoryAccess.visible(version_scope)
     q = q.where('post_versions.post_id = ?', post_id) if post_id
     if external_tag_id || (tag_id && !(Tag.exists?(id: tag_id)))
       q = q.where('JSON_CONTAINS(post_versions.tags_json,' +
@@ -32,7 +32,7 @@ class PostVersionsController < ApplicationController
                 .limit(limit)
                 .offset(offset)
 
-    render json: { versions: serialise_versions(versions, locale.language_code), count: }
+    render json: { versions: serialise_versions(versions, locale.language_code), count:, population_count: HistoryAccess.population_count(PostVersion) }
   end
 
   private
@@ -101,7 +101,7 @@ class PostVersionsController < ApplicationController
     }
     missing_ids = ids - names.keys
 
-    NicoTagVersion
+    HistoryAccess.visible(NicoTagVersion.all)
         .where(tag_id: missing_ids)
         .order(:tag_id, version_no: :desc)
         .pluck(:tag_id, :name)

backend/app/controllers/posts_controller.rb

@@ -38,7 +38,7 @@ class PostsController < ApplicationController
     offset = (page - 1) * limit
 
     pt_max_sql =
-        PostVersion
+        HistoryAccess.visible(PostVersion.all)
         .select('post_id, MAX(created_at) AS max_updated_at')
         .group('post_id')
         .to_sql
@@ -344,6 +344,7 @@ class PostsController < ApplicationController
       unless force
         base_version = post.post_versions.find_by!(version_no: base_version_no)
 
+        HistoryAccess.require!(base_version)
         base_snapshot = post_snapshot_from_version(base_version)
         current_snapshot = post_snapshot_from_record(post, locale)
       end
@@ -449,7 +450,7 @@ class PostsController < ApplicationController
   private
 
   def tag_filter_references literals
-    PostTagSearch.parse_references(params[:tag_refs], literals)
+    PostTagSearch.parse_references(params.to_unsafe_h, literals)
   rescue ArgumentError, JSON::ParserError, TypeError
     raise ActionController::BadRequest
   end

backend/app/controllers/sitemap_entries_controller.rb

@@ -42,7 +42,7 @@ class SitemapEntriesController < ApplicationController
     when 'descriptions'
       TagDescription.where(language_code: locale.language_code, tag_id: named_tags)
           .where.not(body: [nil, ''])
-          .where(TagDescriptionVersion
+          .where(HistoryAccess.visible(TagDescriptionVersion.all)
               .where('tag_description_versions.tag_id = tag_descriptions.tag_id')
               .where('tag_description_versions.language_code = tag_descriptions.language_code')
               .where('tag_description_versions.version_no = tag_descriptions.version_no')
@@ -50,6 +50,7 @@ class SitemapEntriesController < ApplicationController
     when 'tag_groups'
       TagGroup.joins(:versions)
           .where('tag_group_versions.version_no = tag_groups.version_no')
+          .where(Arel.sql(HistoryAccess.sql(TagGroupVersion)))
     when 'theatres'
       Theatre.kept
     end

backend/app/controllers/tag_descriptions_controller.rb

@@ -49,6 +49,7 @@ class TagDescriptionsController < ApplicationController
   private
 
   def representation description
+    HistoryAccess.require_current!(description, TagDescriptionVersion)
     description.as_json(only: [
         :tag_id,
         :language_code,

backend/app/controllers/tag_groups_controller.rb

@@ -1,7 +1,7 @@
 class TagGroupsController < ApplicationController
   def index
     locale = resolve_locale!
-    groups = TagGroup.includes(:created_by_user, :updated_by_user).order(:id)
+    groups = HistoryAccess.current(TagGroup.all, TagGroupVersion).includes(:created_by_user, :updated_by_user).order(:id)
     render json: TagGroupRepr.many(locale, groups.to_a)
   end
 

backend/app/controllers/tag_versions_controller.rb

@@ -10,7 +10,7 @@ class TagVersionsController < ApplicationController
 
     offset = (page - 1) * limit
 
-    q = version_scope
+    q = HistoryAccess.visible(version_scope)
     q = q.where('tag_versions.tag_id = ?', tag_id) if tag_id
 
     count = q.except(:select, :order, :limit, :offset).count
@@ -19,7 +19,7 @@ class TagVersionsController < ApplicationController
                 .limit(limit)
                 .offset(offset)
 
-    render json: { versions: serialise_versions(versions, locale.language_code), count: }
+    render json: { versions: serialise_versions(versions, locale.language_code), count:, population_count: HistoryAccess.population_count(TagVersion) }
   end
 
   private
@@ -31,6 +31,7 @@ class TagVersionsController < ApplicationController
             ON
               prev.tag_id = tag_versions.tag_id
               AND prev.version_no = tag_versions.version_no - 1
+              AND #{ HistoryAccess.sql(TagVersion, 'prev') }
         SQL
       .select('tag_versions.*', 'prev.name AS prev_name', 'prev.category AS prev_category',
               'prev.deprecated_at AS prev_deprecated_at',

backend/app/controllers/wiki_pages_controller.rb

@@ -8,12 +8,12 @@ class WikiPagesController < ApplicationController
 
     title = params[:title].to_s.strip
     descriptions =
-        TagDescription
+        HistoryAccess.current(TagDescription.all, TagDescriptionVersion)
         .where(language_code: locale.language_code)
         .includes(tag: :tag_names)
 
     descriptions = descriptions.order(updated_at: :desc, id: :asc)
-    tag_groups = TagGroup.order(updated_at: :desc, id: :asc)
+    tag_groups = HistoryAccess.current(TagGroup.all, TagGroupVersion).order(updated_at: :desc, id: :asc)
     if title.present?
       pattern = "%#{ ApplicationRecord.sanitize_sql_like(title) }%"
       descriptions =
@@ -41,13 +41,13 @@ class WikiPagesController < ApplicationController
     return head :not_found unless language.is_a?(String)
     return head :not_found unless Language.exists?(code: language)
 
-    names = TagDescription.joins(tag: :tag_names)
+    names = HistoryAccess.current(TagDescription.all, TagDescriptionVersion).joins(tag: :tag_names)
         .where(language_code: locale.language_code, tag_names: { language_code: language })
         .pluck('tag_descriptions.tag_id', 'tag_descriptions.id', 'tag_names.name')
     candidates = names.map do |tag_id, description_id, name|
       WikiPageRepr.autolink_tag(locale, tag_id:, description_id:, name:, language:)
     end
-    candidates.concat(TagGroup.order(:id).pluck(:id, :name).map do |id, name|
+    candidates.concat(HistoryAccess.current(TagGroup.all, TagGroupVersion).order(:id).pluck(:id, :name).map do |id, name|
       WikiPageRepr.autolink_group(locale, id:, name:, language:)
     end)
     render json: candidates
@@ -286,12 +286,12 @@ class WikiPagesController < ApplicationController
 
     tag_group = id && TagGroup.find_by(id:)
     if tag_group
-      return render json: tag_group_changes(TagGroupVersion.where(tag_group_id: tag_group.id))
+      return render json: tag_group_changes(HistoryAccess.visible(TagGroupVersion.all).where(tag_group_id: tag_group.id))
     end
 
     json = []
     unless id
-      json.concat(tag_group_changes(TagGroupVersion.all))
+      json.concat(tag_group_changes(HistoryAccess.visible(TagGroupVersion.all)))
       json.concat(description_changes(locale,
                                       TagDescription.where(language_code: locale.language_code)))
       json = json.each_with_index.sort_by do |row, index|
@@ -327,7 +327,7 @@ class WikiPagesController < ApplicationController
 
   def render_group_representation representation, version, body: nil, status: :ok
     body ||= TagGroupMarkdownRenderer.render(representation)
-    versions = TagGroupVersion.where(tag_group_id: version.tag_group_id)
+    versions = HistoryAccess.visible(TagGroupVersion.all).where(tag_group_id: version.tag_group_id)
     pred = versions.find_by(version_no: version.version_no - 1)&.id
     succ = versions.find_by(version_no: version.version_no + 1)&.id
     updated_at = version.created_at
@@ -346,11 +346,11 @@ class WikiPagesController < ApplicationController
   end
 
   def current_group_version group
-    TagGroupVersion.find_by(tag_group_id: group.id, version_no: group.version_no)
+    HistoryAccess.visible(TagGroupVersion.all).find_by(tag_group_id: group.id, version_no: group.version_no)
   end
 
   def group_version group, version_id
-    TagGroupVersion.find_by(tag_group_id: group.id, id: version_id)
+    HistoryAccess.visible(TagGroupVersion.all).find_by(tag_group_id: group.id, id: version_id)
   end
 
   def wiki_diff from_body, to_body
@@ -373,7 +373,7 @@ class WikiPagesController < ApplicationController
   def tag_group_changes versions
     rows = versions.includes(:created_by_user).order(id: :desc).limit(200).to_a
     groups = TagGroup.where(id: rows.map(&:tag_group_id).uniq).index_by(&:id)
-    predecessors = TagGroupVersion.where(tag_group_id: groups.keys,
+    predecessors = HistoryAccess.visible(TagGroupVersion.all).where(tag_group_id: groups.keys,
                                          version_no: rows.map { _1.version_no - 1 })
         .pluck(:tag_group_id, :version_no, :id)
         .to_h { |group_id, number, version_id| [[group_id, number], version_id] }
@@ -406,18 +406,18 @@ class WikiPagesController < ApplicationController
   end
 
   def description_versions description
-    TagDescriptionVersion.where(tag_id: description.tag_id,
+    HistoryAccess.visible(TagDescriptionVersion.all).where(tag_id: description.tag_id,
                                 language_code: description.language_code)
   end
 
   def tag_description_by_title locale, title
-    TagDescription.joins(tag: :tag_names)
+    HistoryAccess.current(TagDescription.all, TagDescriptionVersion).joins(tag: :tag_names)
         .find_by(language_code: locale.language_code,
                  tag_names: { language_code: locale.language_code, name: title })
   end
 
   def description_changes locale, descriptions
-    versions = TagDescriptionVersion.where(language_code: locale.language_code,
+    versions = HistoryAccess.visible(TagDescriptionVersion.all).where(language_code: locale.language_code,
                                            tag_id: descriptions.select(:tag_id))
         .order(id: :desc).limit(200).to_a
     return [] if versions.empty?
@@ -425,7 +425,7 @@ class WikiPagesController < ApplicationController
     by_tag = descriptions.where(tag_id: versions.map(&:tag_id))
         .includes(tag: :tag_names).index_by(&:tag_id)
     users = User.where(id: versions.map(&:created_by_user_id)).index_by(&:id)
-    predecessors = TagDescriptionVersion.where(
+    predecessors = HistoryAccess.visible(TagDescriptionVersion.all).where(
         language_code: locale.language_code, tag_id: by_tag.keys,
         version_no: versions.map { |version| version.version_no - 1 })
         .pluck(:tag_id, :version_no, :id)