AI: address review on PR #462

backend/spec/requests/counts_history_boundaries_spec.rb

@@ -14,7 +14,7 @@ RSpec.describe 'History boundaries shared with Counts', type: :request do
     end
   end
 
-  it 'denies the same discarded description through Counts, the facade and the ordinary API' do
+  it 'keeps discarded history private while exposing the current description' do
     get '/counts/query', params: { resource: 'tag_descriptions', definition: 'history',
         mode: 'details', locale: 'ja', execution_at: '2025-01-01T00:00:00Z' }
     expect(response).to have_http_status(:ok)
@@ -22,8 +22,8 @@ RSpec.describe 'History boundaries shared with Counts', type: :request do
         'excluded_count' => 2, 'versions' => [])
     ["/wiki/#{ description.id }", "/tags/#{ tag.id }/description"].each do |path|
       get path, params: { locale: 'ja' }
-      expect(response).to have_http_status(:not_found)
-      expect(response.body).not_to include('private body')
+      expect(response).to have_http_status(:ok)
+      expect(response.parsed_body.fetch('body')).to eq(description.body)
     end
     get '/sitemap_entries/descriptions', params: { locale: 'ja' }
     expect(response).to have_http_status(:ok)

backend/spec/requests/post_history_privacy_spec.rb

@@ -69,40 +69,38 @@ RSpec.describe 'Post history privacy', type: :request do
         sign_in_as(create(:user, role.to_sym)) unless role == 'anonymous'
       end
 
-      it 'uses only authorised history timestamps for display' do
+      it 'uses the latest version timestamp for display regardless of role' do
         get '/posts'
         expect(response).to have_http_status(:ok)
         row = response.parsed_body.fetch('posts').find { _1.fetch('id') == post_record.id }
-        expected = origin + (role == 'admin' ? 4 : 3).days
+        expected = origin + 4.days
         expect(Time.zone.parse(row.fetch('updated_at'))).to eq(expected)
       end
 
-      it 'uses the same visibility for date bounds and count' do
+      it 'uses the latest version timestamp for date bounds and count regardless of role' do
         get '/posts', params: { updated_from: (origin + 4.days).iso8601,
                                 updated_to: (origin + 4.days).iso8601 }
         expect(response).to have_http_status(:ok)
         ids = response.parsed_body.fetch('posts').pluck('id')
-        expect(ids).to eq(role == 'admin' ? [post_record.id] : [])
+        expect(ids).to eq([post_record.id])
         expect(response.parsed_body.fetch('count')).to eq(ids.length)
       end
 
-      it 'sorts using authorised timestamps in both directions' do
+      it 'sorts using the latest version timestamps in both directions regardless of role' do
         ['asc', 'desc'].each do |direction|
           get '/posts', params: { order: "updated_at:#{ direction }" }
           expect(response).to have_http_status(:ok)
-          expected = role == 'admin' ? [other_post.id, post_record.id] :
-              [post_record.id, other_post.id]
+          expected = [other_post.id, post_record.id]
           expected.reverse! if direction == 'desc'
           expect(response.parsed_body.fetch('posts').pluck('id')).to eq(expected)
         end
       end
 
-      it 'applies authorised timestamp ordering before pagination' do
+      it 'applies latest version timestamp ordering before pagination regardless of role' do
         get '/posts', params: { order: 'updated_at:desc', limit: 1 }
 
         expect(response).to have_http_status(:ok)
-        expected = role == 'admin' ? post_record.id : other_post.id
-        expect(response.parsed_body.fetch('posts').pluck('id')).to eq([expected])
+        expect(response.parsed_body.fetch('posts').pluck('id')).to eq([post_record.id])
         expect(response.parsed_body.fetch('count')).to eq(2)
       end