#306

backend/app/models/material.rb

@@ -18,7 +18,7 @@ class Material < ApplicationRecord
 
   before_validation :assign_normalized_source_key
 
-  validates :tag_id, presence: true, uniqueness: true
+  validates :tag_id, uniqueness: true, allow_nil: true
   validates :source_kind,
             inclusion: { in: MaterialSyncSuppression::SOURCE_KINDS },
             allow_blank: true

backend/app/models/material_sync_source.rb

@@ -0,0 +1,43 @@
+class MaterialSyncSource < ApplicationRecord
+  belongs_to :created_by_user, class_name: 'User', optional: true
+  belongs_to :updated_by_user, class_name: 'User', optional: true
+
+  validates :name, presence: true
+  validates :source_kind,
+            presence: true,
+            inclusion: { in: MaterialSyncSuppression::SOURCE_KINDS }
+  validates :profile, presence: true, inclusion: { in: MaterialExportItem::VALID_PROFILES }
+  validate :source_value_must_be_present
+
+  scope :enabled, -> { where(enabled: true) }
+
+  def normalized_source_key
+    MaterialSyncSuppression.normalize_source_key(source_kind:,
+                                                 source_uri:,
+                                                 source_path:,
+                                                 source_file_id:)
+  end
+
+  private
+
+  def source_value_must_be_present
+    return if source_value_present?
+
+    errors.add(:base, '同期元を指定してください．')
+  end
+
+  def source_value_present?
+    case source_kind
+    when 'uri'
+      source_uri.present?
+    when 'google_drive_file'
+      source_file_id.present? || source_uri.present?
+    when 'google_drive_path'
+      source_file_id.present? || source_uri.present? || source_path.present?
+    when 'legacy_drive_path'
+      source_path.present?
+    else
+      normalized_source_key.present?
+    end
+  end
+end

backend/app/models/material_sync_suppression.rb

@@ -2,8 +2,10 @@ class MaterialSyncSuppression < ApplicationRecord
   SOURCE_KINDS = [
     'uri',
     'google_drive_path',
+    'google_drive_path_prefix',
     'google_drive_file',
-    'legacy_drive_path'
+    'legacy_drive_path',
+    'legacy_drive_path_prefix'
   ].freeze
 
   REASONS = [
@@ -25,6 +27,7 @@ class MaterialSyncSuppression < ApplicationRecord
   validates :reason, presence: true, inclusion: { in: REASONS }
   validates :normalized_source_key, presence: true, uniqueness: true
   validate :source_value_must_be_present
+  validate :drive_path_must_be_safe_relative_path
 
   def self.normalize_source_key source_kind:,
                                 source_uri: nil,
@@ -37,7 +40,8 @@ class MaterialSyncSuppression < ApplicationRecord
         case kind
         when 'uri'
           source_uri.to_s.strip
-        when 'google_drive_path', 'legacy_drive_path'
+        when 'google_drive_path', 'google_drive_path_prefix',
+             'legacy_drive_path', 'legacy_drive_path_prefix'
           (source_path || drive_path).to_s.strip.gsub(%r{/+}, '/')
         when 'google_drive_file'
           (source_file_id || drive_file_id).to_s.strip
@@ -53,6 +57,7 @@ class MaterialSyncSuppression < ApplicationRecord
   private
 
   def assign_normalized_source_key
+    normalize_path_fields!
     self.normalized_source_key =
         self.class.normalize_source_key(source_kind:,
                                         source_uri:,
@@ -65,4 +70,36 @@ class MaterialSyncSuppression < ApplicationRecord
 
     errors.add(:base, '同期元を指定してください．')
   end
+
+  def drive_path_must_be_safe_relative_path
+    return unless source_kind.in?(
+        ['google_drive_path', 'google_drive_path_prefix',
+         'legacy_drive_path', 'legacy_drive_path_prefix'])
+
+    value = drive_path.to_s
+    return if value.blank?
+
+    if value.start_with?('/') || value.match?(/\A[A-Za-z]:\//)
+      errors.add(:drive_path, '相対 path を指定してください．')
+    end
+    if value.start_with?('My Drive/', 'マイドライブ/')
+      errors.add(:drive_path, '同期元フォルダからの相対 path を指定してください．')
+    end
+    errors.add(:drive_path, 'NUL は使へません．') if value.include?("\0")
+    errors.add(:drive_path, '連続スラッシュは使へません．') if value.include?('//')
+    errors.add(:drive_path, '末尾スラッシュは使へません．') if value.end_with?('/')
+
+    parts = value.split('/')
+    if parts.any? { |part| part.in?(['.', '..']) }
+      errors.add(:drive_path, '. や .. は使へません．')
+    end
+  end
+
+  def normalize_path_fields!
+    return unless source_kind.in?(
+        ['google_drive_path', 'google_drive_path_prefix',
+         'legacy_drive_path', 'legacy_drive_path_prefix'])
+
+    self.drive_path = drive_path.to_s.tr('\\', '/').strip.presence
+  end
 end