diff --git a/backend/spec/requests/counts_history_boundaries_spec.rb b/backend/spec/requests/counts_history_boundaries_spec.rb index 0bdb514..bf7fe75 100644 --- a/backend/spec/requests/counts_history_boundaries_spec.rb +++ b/backend/spec/requests/counts_history_boundaries_spec.rb @@ -14,7 +14,7 @@ RSpec.describe 'History boundaries shared with Counts', type: :request do end end - it 'denies the same discarded description through Counts, the facade and the ordinary API' do + it 'keeps discarded history private while exposing the current description' do get '/counts/query', params: { resource: 'tag_descriptions', definition: 'history', mode: 'details', locale: 'ja', execution_at: '2025-01-01T00:00:00Z' } expect(response).to have_http_status(:ok) @@ -22,8 +22,8 @@ RSpec.describe 'History boundaries shared with Counts', type: :request do 'excluded_count' => 2, 'versions' => []) ["/wiki/#{ description.id }", "/tags/#{ tag.id }/description"].each do |path| get path, params: { locale: 'ja' } - expect(response).to have_http_status(:not_found) - expect(response.body).not_to include('private body') + expect(response).to have_http_status(:ok) + expect(response.parsed_body.fetch('body')).to eq(description.body) end get '/sitemap_entries/descriptions', params: { locale: 'ja' } expect(response).to have_http_status(:ok) diff --git a/backend/spec/requests/post_history_privacy_spec.rb b/backend/spec/requests/post_history_privacy_spec.rb index 635fb76..9cfe553 100644 --- a/backend/spec/requests/post_history_privacy_spec.rb +++ b/backend/spec/requests/post_history_privacy_spec.rb @@ -69,40 +69,38 @@ RSpec.describe 'Post history privacy', type: :request do sign_in_as(create(:user, role.to_sym)) unless role == 'anonymous' end - it 'uses only authorised history timestamps for display' do + it 'uses the latest version timestamp for display regardless of role' do get '/posts' expect(response).to have_http_status(:ok) row = response.parsed_body.fetch('posts').find { _1.fetch('id') == post_record.id } - expected = origin + (role == 'admin' ? 4 : 3).days + expected = origin + 4.days expect(Time.zone.parse(row.fetch('updated_at'))).to eq(expected) end - it 'uses the same visibility for date bounds and count' do + it 'uses the latest version timestamp for date bounds and count regardless of role' do get '/posts', params: { updated_from: (origin + 4.days).iso8601, updated_to: (origin + 4.days).iso8601 } expect(response).to have_http_status(:ok) ids = response.parsed_body.fetch('posts').pluck('id') - expect(ids).to eq(role == 'admin' ? [post_record.id] : []) + expect(ids).to eq([post_record.id]) expect(response.parsed_body.fetch('count')).to eq(ids.length) end - it 'sorts using authorised timestamps in both directions' do + it 'sorts using the latest version timestamps in both directions regardless of role' do ['asc', 'desc'].each do |direction| get '/posts', params: { order: "updated_at:#{ direction }" } expect(response).to have_http_status(:ok) - expected = role == 'admin' ? [other_post.id, post_record.id] : - [post_record.id, other_post.id] + expected = [other_post.id, post_record.id] expected.reverse! if direction == 'desc' expect(response.parsed_body.fetch('posts').pluck('id')).to eq(expected) end end - it 'applies authorised timestamp ordering before pagination' do + it 'applies latest version timestamp ordering before pagination regardless of role' do get '/posts', params: { order: 'updated_at:desc', limit: 1 } expect(response).to have_http_status(:ok) - expected = role == 'admin' ? post_record.id : other_post.id - expect(response.parsed_body.fetch('posts').pluck('id')).to eq([expected]) + expect(response.parsed_body.fetch('posts').pluck('id')).to eq([post_record.id]) expect(response.parsed_body.fetch('count')).to eq(2) end