#434

backend/app/services/counts_population.rb

@@ -2,7 +2,8 @@
 class CountsPopulation
   attr_reader :definition, :params, :at, :history, :scope, :timezone
 
-  def initialize(params)
+  def initialize(params, authorisation_flg: true)
+    @authorisation_flg = authorisation_flg
     @params = params
     @definition = CountsResourceDefinition.new(params.fetch('resource', 'posts'))
     @history = params.fetch('definition', 'latest') == 'history'
@@ -14,7 +15,7 @@ class CountsPopulation
 
     @scope = definition.model.all
     make_population
-    @scope = HistoryAccess.visible(@scope, 'v')
+    @scope = HistoryAccess.visible(@scope, 'v') if @authorisation_flg
     apply_filters
   rescue TZInfo::InvalidTimezoneIdentifier
     raise ArgumentError
@@ -56,6 +57,11 @@ class CountsPopulation
     "(previous.id IS NOT NULL AND NOT (v.#{ column } <=> previous.#{ column }))"
   end
 
+  # Unrestricted predicates are used only for numerical totals, never record output.
+  def access_sql(model, row)
+    @authorisation_flg ? HistoryAccess.sql(model, row) : 'TRUE'
+  end
+
   private
 
   def make_population
@@ -64,7 +70,7 @@ class CountsPopulation
     keys = definition.keys.map { "previous.#{ _1 } = v.#{ _1 }" }.join(' AND ')
     @scope = @scope.joins("LEFT JOIN #{ table } previous ON #{ keys } " +
         'AND previous.version_no = v.version_no - 1 AND ' +
-        HistoryAccess.sql(definition.model, 'previous'))
+        access_sql(definition.model, 'previous'))
     @scope = @scope.where("v.#{ definition.time_column } <= ?", at)
     unless history
       point = timestamp(params['at']) || at