#434

backend/spec/models/history_access_spec.rb

@@ -0,0 +1,67 @@
+require 'rails_helper'
+
+RSpec.describe HistoryAccess do
+  include_context 'Ainu locale'
+
+  let!(:tag) { create(:tag) }
+
+  it 'uses the complete tag-description identity and version order at equal timestamps' do
+    locale
+    rows = ['ja', 'ain'].flat_map do |language|
+      ['create', 'discard', 'restore'].each_with_index.map do |event, index|
+        TagDescriptionVersion.create!(tag_id: tag.id, language_code: language,
+            version_no: index + 1, event_type: language == 'ain' ? 'update' : event,
+            body: "#{ language } #{ index }", created_at: Time.utc(2024))
+      end
+    end
+    described_class.set(user: nil) do
+      expect(described_class.visible(TagDescriptionVersion.where(id: rows.map(&:id))).pluck(:id))
+          .to match_array([rows[2], *rows.last(3)].map(&:id))
+      expect { described_class.require!(rows.first) }.to raise_error(HistoryAccess::Forbidden)
+    end
+    described_class.set(user: create(:user, :admin)) do
+      expect(described_class.visible(TagDescriptionVersion.where(id: rows.map(&:id))).count).to eq(6)
+    end
+  end
+
+  it 'invalidates public artifacts after a new discard and binds admin artifacts to their actor' do
+    public_metadata = described_class.set(user: nil) { described_class.authority }
+    admin = create(:user, :admin)
+    admin_metadata = described_class.set(user: admin) { described_class.authority }
+    TagVersion.create!(tag:, version_no: 1, event_type: 'discard', name: 'private',
+        category: 'general', names: { ja: { name: 'private' } },
+        aliases: '', parent_tag_ids: '', created_at: Time.utc(2024))
+    described_class.set(user: nil) do
+      expect(described_class.authorised_artifact?(public_metadata)).to be(false)
+      expect(described_class.authorised_artifact?(admin_metadata)).to be(false)
+    end
+    described_class.set(user: create(:user, :admin)) do
+      expect(described_class.authorised_artifact?(admin_metadata)).to be(false)
+    end
+    described_class.set(user: admin) do
+      expect(described_class.authorised_artifact?(admin_metadata)).to be(true)
+      admin.update!(role: :guest)
+      expect(described_class.authorised_artifact?(admin_metadata)).to be(false)
+    end
+  end
+
+  it 'denies a blob attached to a discarded post including its derived attachment' do
+    post = create(:post)
+    blob = ActiveStorage::Blob.create_before_direct_upload!(filename: 'private.png',
+        byte_size: 1, checksum: Base64.strict_encode64('checksum'), content_type: 'image/png')
+    ActiveStorage::Attachment.create!(name: 'thumbnail', record: post, blob:)
+    PostVersion.create!(post:, version_no: 1, event_type: 'discard', url: post.url,
+        title: 'private', tags: '', tags_json: [], parent_post_ids: '', created_at: Time.utc(2024))
+    variant = ActiveStorage::VariantRecord.create!(blob:, variation_digest: 'spec-variation')
+    derived = ActiveStorage::Blob.create_before_direct_upload!(filename: 'derived.png',
+        byte_size: 1, checksum: Base64.strict_encode64('checksum'), content_type: 'image/png')
+    ActiveStorage::Attachment.create!(name: 'image', record: variant, blob: derived)
+    described_class.set(user: nil) do
+      expect(described_class.blob_visible?(blob)).to be(false)
+      expect(described_class.blob_visible?(derived)).to be(false)
+    end
+    described_class.set(user: create(:user, :admin)) do
+      expect(described_class.blob_visible?(derived)).to be(true)
+    end
+  end
+end