#434

backend/app/models/history_access.rb

@@ -4,6 +4,7 @@ require 'digest'
 class HistoryAccess < ActiveSupport::CurrentAttributes
   attribute :user
   class Forbidden < StandardError; end
+  ARTIFACT_POLICY = 'counts-masked-summary-1'.freeze
 
   KEYS = { 'post_versions' => ['post_id'], 'tag_versions' => ['tag_id'],
            'nico_tag_versions' => ['tag_id'],
@@ -18,10 +19,12 @@ class HistoryAccess < ActiveSupport::CurrentAttributes
   end
 
   def self.authority
-    { 'policy_revision' => revision, 'admin' => admin?, 'actor_id' => user&.id }
+    { 'artifact_policy' => ARTIFACT_POLICY, 'policy_revision' => revision,
+      'admin' => admin?, 'actor_id' => user&.id }
   end
 
   def self.authorised_artifact?(metadata)
+    return false unless metadata['artifact_policy'] == ARTIFACT_POLICY
     return false unless metadata['policy_revision'].is_a?(String)
     if metadata['admin']
       admin? && user.id == metadata['actor_id']
@@ -72,13 +75,47 @@ class HistoryAccess < ActiveSupport::CurrentAttributes
         "ON reference_entry.reference_id = CAST(blocked.#{ key } AS CHAR))"
   end
 
+  def self.snapshot_reference(model, row, external: false)
+    key = external ? 'external_tag_id' : 'tag_id'
+    table = model.table_name
+    source = "JSON_TABLE(COALESCE(#{ row }.tags_json, JSON_ARRAY()), '$[*]' COLUMNS (" +
+        "tag_id BIGINT PATH '$.#{ key }', version_no INT PATH '$.version_no')) tag_reference"
+    match = 'reference_version.tag_id = tag_reference.tag_id'
+    if external
+      match += " AND reference_version.created_at <= #{ row }.created_at"
+      latest = "AND NOT EXISTS (SELECT 1 FROM #{ table } later_reference " +
+          'WHERE later_reference.tag_id = reference_version.tag_id ' +
+          "AND later_reference.created_at <= #{ row }.created_at " +
+          'AND later_reference.version_no > reference_version.version_no)'
+    else
+      match += ' AND reference_version.version_no = tag_reference.version_no'
+      latest = ''
+    end
+    "NOT EXISTS (SELECT 1 FROM #{ source } JOIN #{ table } reference_version ON #{ match } " +
+        "WHERE NOT (#{ sql(model, 'reference_version') }) #{ latest })"
+  end
+
   def self.reference_sql(table, row)
     case table
     when 'post_versions'
       [['tag_versions', 'tag_id', 'tag_id'],
        ['nico_tag_versions', 'tag_id', 'external_tag_id']].map do |target, key, field|
         json_reference(target, key, "JSON_EXTRACT(#{ row }.tags_json, '$[*].#{ field }')")
-      end + [list_reference('post_versions', 'post_id', "#{ row }.parent_post_ids")]
+      end + [list_reference('post_versions', 'post_id', "#{ row }.parent_post_ids"),
+             snapshot_reference(TagVersion, row),
+             snapshot_reference(NicoTagVersion, row, external: true)]
+    when 'nico_tag_versions'
+      # Legacy linked_tags snapshots contain names, not IDs. Match recorded names
+      # conservatively; never expose a private linked name through an external tag.
+      names = "JSON_MERGE_PRESERVE(JSON_ARRAY(private_tag.name), " +
+          "COALESCE(JSON_EXTRACT(private_tag.names, '$**.name'), JSON_ARRAY()))"
+      ["NOT EXISTS (SELECT 1 FROM tag_versions private_tag " +
+          "JOIN (#{ discarded_keys('tag_versions', 'tag_id') }) blocked " +
+          "ON blocked.tag_id = private_tag.tag_id " +
+          "JOIN JSON_TABLE(#{ names }, '$[*]' COLUMNS (name TEXT PATH '$')) private_name " +
+          "WHERE private_name.name <> '' AND " +
+          "LOCATE(CONCAT(' ', private_name.name, ' '), " +
+          "CONCAT(' ', COALESCE(#{ row }.linked_tags, ''), ' ')) > 0)"]
     when 'tag_versions'
       [list_reference('tag_versions', 'tag_id', "#{ row }.parent_tag_ids")]
     when 'tag_description_versions'