#434

backend/spec/models/history_access_spec.rb

@@ -67,3 +67,64 @@ RSpec.describe HistoryAccess do
     end
   end
 end
+
+RSpec.describe 'Counts artifact policy and external references' do
+  it 'rejects files created before the masked-summary policy' do
+    HistoryAccess.set(user: nil) do
+      metadata = HistoryAccess.authority.except('artifact_policy')
+      expect(HistoryAccess.authorised_artifact?(metadata)).to be(false)
+    end
+  end
+
+  it 'does not expose a private linked tag name through an external history snapshot' do
+    tag = create(:tag, primary_name: 'private-linked-name')
+    TagVersion.create!(tag:, version_no: 1, event_type: 'discard', name: 'private-linked-name',
+        category: 'general', aliases: '', parent_tag_ids: '', created_at: Time.utc(2024),
+        names: { ja: { name: 'private-linked-name', script_code: 'Jpan',
+                       auto_generated: false, aliases: [] } })
+    external = create(:external_tag, name: 'public-external')
+    row = NicoTagVersion.create!(external_tag: external, version_no: 1, event_type: 'create',
+        name: 'nico:public-external', linked_tags: 'private-linked-name',
+        created_at: Time.utc(2024))
+    post = create(:post)
+    snapshot = PostVersion.create!(post:, version_no: 1, event_type: 'create',
+        title: 'external reference', url: post.url, tags: '',
+        tags_json: [{ external_tag_id: external.id }], parent_post_ids: '',
+        created_at: Time.utc(2024, 2))
+    HistoryAccess.set(user: nil) do
+      expect(HistoryAccess.visible(NicoTagVersion.where(id: row.id))).to be_empty
+      expect(HistoryAccess.visible(PostVersion.where(id: snapshot.id))).to be_empty
+    end
+    HistoryAccess.set(user: create(:user, :admin)) do
+      expect(HistoryAccess.visible(NicoTagVersion.where(id: row.id))).to exist
+    end
+    public_row = NicoTagVersion.create!(external_tag: external, version_no: 2, event_type: 'update',
+        name: 'nico:public-external', linked_tags: 'private-linked-name-extra',
+        created_at: Time.utc(2024, 7))
+    HistoryAccess.set(user: nil) do
+      expect(HistoryAccess.visible(NicoTagVersion.where(id: public_row.id))).to exist
+      expect(HistoryAccess.visible(PostVersion.where(id: snapshot.id))).to be_empty
+    end
+  end
+
+  it 'propagates the recorded tag version policy to its post snapshot' do
+    parent = create(:tag, primary_name: 'private parent')
+    child = create(:tag, primary_name: 'referencing child')
+    [[parent, 'discard', '', 'private parent'],
+     [child, 'create', parent.id.to_s, 'referencing child']].each do |tag, event, parents, name|
+      TagVersion.create!(tag:, version_no: 1, event_type: event, name:,
+          category: 'general', aliases: '', parent_tag_ids: parents, created_at: Time.utc(2023),
+          names: { ja: { name:, script_code: 'Jpan',
+                         auto_generated: false, aliases: [] } })
+    end
+    post = create(:post)
+    row = PostVersion.create!(post:, version_no: 1, event_type: 'create', title: 'snapshot',
+        url: post.url, tags: '', parent_post_ids: '',
+        tags_json: [{ tag_id: child.id, version_no: 1, name: 'referencing child', sections: [] }],
+        created_at: Time.utc(2024))
+    HistoryAccess.set(user: nil) do
+      expect(HistoryAccess.visible(PostVersion.where(id: row.id))).to be_empty
+    end
+  end
+
+end