#434

backend/spec/requests/counts_table_spec.rb

@@ -232,7 +232,7 @@ RSpec.describe 'Counts table API', type: :request do
       it 'does not resolve private condition names even when the result set is empty' do
         TagVersion.create!(tag:, version_no: 2, event_type: 'discard', name: 'secret tag',
             category: 'general', aliases: '', parent_tag_ids: '',
-            names: { ja: { name: 'secret tag', script_code: 'Jpan', aliases: [] } },
+            names: { ja: { name: 'secret tag', script_code: 'Jpan', auto_generated: false, aliases: [] } },
             created_at: Time.utc(2024, 2))
         result = query(axis('tags', "internal:#{ tag.id }").merge(definition: 'latest'))
         expect(result['versions']).to be_empty
@@ -245,4 +245,25 @@ RSpec.describe 'Counts table API', type: :request do
       end
     end
   end
+  it 'includes private history in the public timeline without an exclusion count' do
+    PostVersion.create!(post: record, version_no: 4, event_type: 'discard', url: record.url,
+        title: 'hidden title', tags: '', tags_json: [], parent_post_ids: '',
+        created_at: Time.utc(2024, 3))
+    result = query(mode: 'summary', rows: 'created_at:month', cols: 'event_type')
+    expect(result['excluded_count']).to be_nil
+    expect(result['count']).to eq(4)
+    expect(result['cells'].sum { _1['count'] }).to eq(4)
+    expect(response.body).not_to include('hidden title')
+    masked = query(mode: 'summary', rows: 'resource_id', cols: '')
+    expect(masked['cells'].map { _1['values'] }).to eq([[CountsAxes::MASKED_VALUE]])
+    expect(masked['cells'].first['count']).to eq(4)
+    expect(query['versions']).to be_empty
+  end
+
+  it 'rejects private summary predicates instead of exposing a count oracle' do
+    get '/counts/query', params: base.merge(mode: 'summary', resource_id: record.id.to_s)
+    expect(response).to have_http_status(:forbidden)
+    expect(json).to eq('error' => 'private_condition')
+  end
+
 end