#414

backend/spec/services/counts_pivot_security_spec.rb

@@ -13,7 +13,9 @@ RSpec.describe 'Counts masked pivot contracts' do
   let!(:tags) do
     ['A', 'B', 'C'].map do |name|
       tag = create(:tag, primary_name: name)
-      TagVersion.create!(tag:, version_no: 1, event_type: 'create', name:,
+      TagVersion.create!(
+          event_id: create_event!(event_type: 'unknown').id,
+          tag:, version_no: 1, event_type: 'create', name:,
           category: 'general', aliases: '', parent_tag_ids: '',
           names: { ja: { name:, script_code: 'Jpan', auto_generated: false, aliases: [] } },
           created_at: Time.utc(2023))
@@ -25,12 +27,16 @@ RSpec.describe 'Counts masked pivot contracts' do
     [[0, 1], [0], [1, 2]].each_with_index do |indexes, index|
       post = create(:post)
       snapshot = indexes.map { { tag_id: tags[_1].id, version_no: 1, sections: [] } }
-      PostVersion.create!(post:, version_no: 1, event_type: 'create',
+      PostVersion.create!(
+          event_id: create_event!(event_type: 'unknown').id,
+          post:, version_no: 1, event_type: 'create',
           title: "hidden-title-#{ index }", url: post.url, tags: '', tags_json: snapshot,
           parent_post_ids: '', created_by_user: member, created_at: Time.utc(2024, 1))
       next if index == 2
 
-      PostVersion.create!(post:, version_no: 2, event_type: 'discard',
+      PostVersion.create!(
+          event_id: create_event!(event_type: 'unknown').id,
+          post:, version_no: 2, event_type: 'discard',
           title: "private-discard-#{ index }", url: post.url, tags: '', tags_json: [],
           parent_post_ids: '', created_by_user: member, created_at: Time.utc(2024, 2))
     end
@@ -98,12 +104,16 @@ RSpec.describe 'Counts masked pivot contracts' do
 
   it 'uses changed-record membership for totals and hides changes to private predecessors' do
     post = PostVersion.order(:id).last.post
-    PostVersion.create!(post:, version_no: 2, event_type: 'update', title: 'changed-public-title',
+    PostVersion.create!(
+        event_id: create_event!(event_type: 'unknown').id,
+        post:, version_no: 2, event_type: 'update', title: 'changed-public-title',
         url: post.url, tags: '',
         tags_json: [{ tag_id: tags.last.id, version_no: 1, sections: [] }],
         parent_post_ids: '', created_at: Time.utc(2024, 3))
     restored = PostVersion.order(:id).first.post
-    PostVersion.create!(post: restored, version_no: 3, event_type: 'restore',
+    PostVersion.create!(
+        event_id: create_event!(event_type: 'unknown').id,
+        post: restored, version_no: 3, event_type: 'restore',
         title: 'restored-public-title', url: restored.url, tags: '',
         tags_json: [{ tag_id: tags.first.id, version_no: 1, sections: [] }], parent_post_ids: '',
         created_at: Time.utc(2024, 4))
@@ -134,7 +144,9 @@ RSpec.describe 'Counts masked pivot contracts' do
 
   it 'keeps NULL as a public data value rather than treating it as a rollup' do
     post = create(:post)
-    PostVersion.create!(post:, version_no: 1, event_type: 'create', title: 'public bot',
+    PostVersion.create!(
+        event_id: create_event!(event_type: 'unknown').id,
+        post:, version_no: 1, event_type: 'create', title: 'public bot',
         url: post.url, tags: '', tags_json: [], parent_post_ids: '', created_at: Time.utc(2024, 5))
     page = result(nil, 'rows' => 'user', 'cols' => 'event_type')
     expect(page[:cells].select { _1[:values].first.nil? }.sum { _1[:count] }).to eq(1)
@@ -145,7 +157,9 @@ RSpec.describe 'Counts masked pivot contracts' do
   it 'sorts public numeric values numerically alongside a masked group' do
     post = PostVersion.order(:id).last.post
     [2, 10].each do |number|
-      PostVersion.create!(post:, version_no: number, event_type: 'update',
+      PostVersion.create!(
+          event_id: create_event!(event_type: 'unknown').id,
+          post:, version_no: number, event_type: 'update',
           title: 'public numeric sort', url: post.url, tags: '', tags_json: [],
           parent_post_ids: '', created_at: Time.utc(2024, 5))
     end