#302

backend/app/controllers/theatre_comments_controller.rb

@@ -45,6 +45,7 @@ class TheatreCommentsController < ApplicationController
 
     comment = TheatreComment.find_by(theatre_id:, no:)
     return head :not_found unless comment
+    return head :forbidden unless comment.user == current_user
 
     comment.discard!
 

backend/app/controllers/theatre_skip_events_controller.rb

@@ -6,7 +6,7 @@ class TheatreSkipEventsController < ApplicationController
     events =
         TheatreSkipEvent
         .where(theatre_id: params[:theatre_id])
-        .includes(:skipped_by_user, :users, :tags, post: { tags: :tag_name })
+        .includes(:tags, post: { tags: :tag_name })
         .order(created_at: :desc)
         .limit(limit)
 
@@ -14,8 +14,6 @@ class TheatreSkipEventsController < ApplicationController
       { id: event.id,
         theatre_id: event.theatre_id,
         post: PostRepr.base(event.post),
-        skipped_by_user: UserRepr.base(event.skipped_by_user),
-        voters: event.users.map { |user| UserRepr.base(user) },
         tags: event.tags.map { |tag| TagRepr.inline(tag) },
         programme_position: event.programme_position,
         created_at: event.created_at }

backend/app/controllers/theatres_controller.rb

@@ -54,8 +54,11 @@ class TheatresController < ApplicationController
 
     theatre = Theatre.find_by(id: params[:id])
     return head :not_found unless theatre
+    requested_post_id = params[:post_id].to_i
+    return head :unprocessable_entity if requested_post_id <= 0
 
     skipped = false
+    conflicted = false
 
     ApplicationRecord.transaction do
       theatre.lock!
@@ -64,7 +67,12 @@ class TheatresController < ApplicationController
           _1.expires_at = 30.seconds.from_now
         }.save!
 
-        TheatreSkipVote.find_or_create_by!(theatre:, post: theatre.current_post, user: current_user)
+        if theatre.current_post_id != requested_post_id
+          conflicted = true
+          next
+        end
+
+        TheatreSkipVote.find_or_create_by!(theatre:, post_id: requested_post_id, user: current_user)
 
         vote_status = skip_vote_status(theatre)
         if vote_status[:votes_count] >= vote_status[:required_count]
@@ -76,6 +84,8 @@ class TheatresController < ApplicationController
     end
 
     theatre.reload
+    return render json: theatre_info_json(theatre, skipped: false), status: :conflict if conflicted
+
     render json: theatre_info_json(theatre, skipped:)
   end
 
@@ -84,11 +94,24 @@ class TheatresController < ApplicationController
 
     theatre = Theatre.find_by(id: params[:id])
     return head :not_found unless theatre
+    requested_post_id = params[:post_id].to_i
+    return head :unprocessable_entity if requested_post_id <= 0
 
-    if theatre.current_post
-      TheatreSkipVote.where(theatre:, post: theatre.current_post, user: current_user).delete_all
+    conflicted = false
+
+    theatre.with_lock do
+      if theatre.current_post
+        if theatre.current_post_id != requested_post_id
+          conflicted = true
+        else
+          TheatreSkipVote.where(theatre:, post_id: requested_post_id, user: current_user).delete_all
+        end
+      end
     end
 
+    theatre.reload
+    return render json: theatre_info_json(theatre, skipped: false), status: :conflict if conflicted
+
     render json: theatre_info_json(theatre, skipped: false)
   end