#44 完了

backend/app/controllers/wiki_pages_controller.rb

@@ -28,6 +28,7 @@ class WikiPagesController < ApplicationController
 
   def update
     return head :unauthorized unless current_user
+    return head :forbidden unless ['admin', 'member'].include?(current_user.role)
 
     wiki_page = WikiPage.find(params[:id])
     return head :not_found unless wiki_page
@@ -37,4 +38,15 @@ class WikiPagesController < ApplicationController
     wiki_page.save!
     head :ok
   end
+
+  def search
+    q = WikiPage.all
+
+    if params[:title].present?
+      title = params[:title].to_s.strip
+      q = q.where('title LIKE ?', "%#{ WikiPage.sanitize_sql_like(title) }%")
+    end
+
+    render json: q.limit(20)
+  end
 end

backend/config/routes.rb

@@ -5,6 +5,7 @@ Rails.application.routes.draw do
   get 'preview/title', to: 'preview#title'
   get 'preview/thumbnail', to: 'preview#thumbnail'
   get 'wiki/title/:title', to: 'wiki_pages#show_by_title'
+  get 'wiki/search', to: 'wiki_pages#search'
   get 'wiki/:id', to: 'wiki_pages#show'
   post 'wiki', to: 'wiki_pages#create'
   put 'wiki/:id', to: 'wiki_pages#update'