AI: address review on PR #466

backend/app/controllers/material_versions_controller.rb

@@ -5,6 +5,7 @@ class MaterialVersionsController < ApplicationController
 
     page = 1 if page < 1
     limit = 1 if limit < 1
+    limit = 100 if limit > 100
 
     offset = (page - 1) * limit
 

backend/app/controllers/materials_controller.rb

@@ -14,6 +14,7 @@ class MaterialsController < ApplicationController
 
     page = 1 if page < 1
     limit = 1 if limit < 1
+    limit = 100 if limit > 100
 
     offset = (page - 1) * limit
 

backend/app/controllers/nico_tags_controller.rb

@@ -15,6 +15,7 @@ class NicoTagsController < ApplicationController
 
     page = 1 if page < 1
     limit = 1 if limit < 1
+    limit = 100 if limit > 100
 
     post_tag_max_sql =
         PostExternalTag

backend/app/controllers/post_versions_controller.rb

@@ -11,6 +11,7 @@ class PostVersionsController < ApplicationController
 
     page = 1 if page < 1
     limit = 1 if limit < 1
+    limit = 100 if limit > 100
 
     offset = (page - 1) * limit
 

backend/app/controllers/posts_controller.rb

@@ -34,6 +34,7 @@ class PostsController < ApplicationController
 
     page = 1 if page < 1
     limit = 1 if limit < 1
+    limit = 100 if limit > 100
 
     offset = (page - 1) * limit
 

backend/app/controllers/tag_versions_controller.rb

@@ -7,6 +7,7 @@ class TagVersionsController < ApplicationController
 
     page = 1 if page < 1
     limit = 1 if limit < 1
+    limit = 100 if limit > 100
 
     offset = (page - 1) * limit
 

backend/app/controllers/tags_controller.rb

@@ -33,6 +33,7 @@ class TagsController < ApplicationController
 
     page = 1 if page < 1
     limit = 1 if limit < 1
+    limit = 100 if limit > 100
 
     offset = (page - 1) * limit
 

backend/app/controllers/theatre_comments_controller.rb

@@ -2,6 +2,7 @@ class TheatreCommentsController < ApplicationController
   def index
     limit = params[:limit].to_i
     limit = 20 if limit <= 0
+    limit = 100 if limit > 100
 
     no_gt = params[:no_gt].to_i
     no_gt = 0 if no_gt < 0
@@ -9,6 +10,7 @@ class TheatreCommentsController < ApplicationController
     comments = TheatreComment
                .where(theatre_id: params[:theatre_id])
                .where('no > ?', no_gt)
+               .includes(:user)
                .order(no: :desc)
                .limit(limit)
 

backend/app/controllers/theatre_programmes_controller.rb

@@ -2,6 +2,7 @@ class TheatreProgrammesController < ApplicationController
   def index
     limit = params[:limit].to_i
     limit = 100 if limit <= 0
+    limit = 100 if limit > 100
 
     position_gt = params[:position_gt].to_i
     position_gt = 0 if position_gt < 0
@@ -10,7 +11,7 @@ class TheatreProgrammesController < ApplicationController
                  .where(theatre_id: params[:theatre_id])
                  .where('position > ?', position_gt)
                  .includes(:post)
-                 .order(position: :desc).limit(100)
+                 .order(position: :desc)
                  .limit(limit)
 
     render json: programmes.map { |programme|

backend/app/controllers/theatre_skip_events_controller.rb

@@ -2,6 +2,7 @@ class TheatreSkipEventsController < ApplicationController
   def index
     limit = params[:limit].to_i
     limit = 50 if limit <= 0
+    limit = 100 if limit > 100
 
     events =
         TheatreSkipEvent

backend/spec/requests/list_limits_spec.rb

@@ -0,0 +1,174 @@
+require 'rails_helper'
+
+RSpec.describe 'List API limits', type: :request do
+  shared_examples 'a capped list' do |default_count, minimum_count, paginated|
+    def response_rows
+      body = json
+      body.is_a?(Array) ? body : body.fetch(collection_key)
+    end
+
+    it 'caps oversized limits at 100 and preserves the 100 boundary' do
+      get path, params: { locale: 'ja', limit: 100 }
+      expect(response).to have_http_status(:ok)
+      expect(response_rows.size).to eq(100)
+      boundary_rows = response_rows
+
+      [101, 10_000].each do |limit|
+        get path, params: { locale: 'ja', limit: }
+        expect(response).to have_http_status(:ok)
+        expect(response_rows).to eq(boundary_rows)
+      end
+    end
+
+    it 'preserves the default, nonpositive and small positive limits' do
+      get path, params: { locale: 'ja' }
+      expect(response).to have_http_status(:ok)
+      expect(response_rows.size).to eq(default_count)
+
+      [0, -1].each do |limit|
+        get path, params: { locale: 'ja', limit: }
+        expect(response).to have_http_status(:ok)
+        expect(response_rows.size).to eq(minimum_count)
+      end
+
+      get path, params: { locale: 'ja', limit: 2 }
+      expect(response).to have_http_status(:ok)
+      expect(response_rows.size).to eq(2)
+    end
+
+    if paginated
+      it 'uses the capped limit for page offsets and preserves total count' do
+        get path, params: { locale: 'ja', limit: 100 }
+        first_page = response_rows
+        expect(response).to have_http_status(:ok)
+        expect(json.fetch('count')).to eq(101)
+
+        get path, params: { locale: 'ja', limit: 100, page: 2 }
+        expect(response).to have_http_status(:ok)
+        expect(response_rows.size).to eq(1)
+        second_page = response_rows
+        expect(first_page & second_page).to be_empty
+
+        get path, params: { locale: 'ja', limit: 101, page: 2 }
+        expect(response).to have_http_status(:ok)
+        expect(response_rows).to eq(second_page)
+        expect(json.fetch('count')).to eq(101)
+      end
+    end
+  end
+
+  context 'posts' do
+    let(:path) { '/posts' }
+    let(:collection_key) { 'posts' }
+    before { create_list(:post, 101) }
+
+    include_examples 'a capped list', 20, 1, true
+  end
+
+  context 'tags' do
+    let(:path) { '/tags' }
+    let(:collection_key) { 'tags' }
+    before { create_list(:tag, 101) }
+
+    include_examples 'a capped list', 20, 1, true
+  end
+
+  context 'nico tags' do
+    let(:path) { '/tags/nico' }
+    let(:collection_key) { 'tags' }
+    before { create_list(:external_tag, 101) }
+
+    include_examples 'a capped list', 20, 1, true
+  end
+
+  context 'materials' do
+    let(:path) { '/materials' }
+    let(:collection_key) { 'materials' }
+    before do
+      101.times { |index| Material.create!(url: "https://example.com/material-#{ index }") }
+    end
+
+    include_examples 'a capped list', 20, 1, true
+  end
+
+  context 'post versions' do
+    let(:path) { '/posts/versions' }
+    let(:collection_key) { 'versions' }
+    let(:post) { create(:post) }
+    before do
+      101.times do |index|
+        PostVersion.create!(post:, version_no: index + 1, event_type: 'update',
+                            url: post.url, tags: '', tags_json: [], parent_post_ids: '')
+      end
+    end
+
+    include_examples 'a capped list', 20, 1, true
+  end
+
+  context 'tag versions' do
+    let(:path) { '/tags/versions' }
+    let(:collection_key) { 'versions' }
+    let(:tag) { create(:tag) }
+    before do
+      101.times do |index|
+        TagVersion.create!(tag:, version_no: index + 1, event_type: 'update',
+                           name: 'limit tag', category: 'general', aliases: '',
+                           parent_tag_ids: '', names: {
+                               ja: { name: 'limit tag', script_code: 'Jpan',
+                                     auto_generated: false, aliases: [] } })
+      end
+    end
+
+    include_examples 'a capped list', 20, 1, true
+  end
+
+  context 'material versions' do
+    let(:path) { '/materials/versions' }
+    let(:collection_key) { 'versions' }
+    let(:material) { Material.create!(url: 'https://example.com/material') }
+    before do
+      101.times do |index|
+        MaterialVersion.create!(material:, version_no: index + 1,
+                                event_type: 'update', url: material.url)
+      end
+    end
+
+    include_examples 'a capped list', 20, 1, true
+  end
+
+  context 'theatre lists' do
+    let(:theatre) { create(:theatre) }
+    let(:post) { create(:post) }
+
+    context 'comments' do
+      let(:path) { "/theatres/#{ theatre.id }/comments" }
+      before { create_list(:theatre_comment, 101, theatre:, user: theatre.created_by_user) }
+
+      include_examples 'a capped list', 20, 20, false
+    end
+
+    context 'programmes' do
+      let(:path) { "/theatres/#{ theatre.id }/programmes" }
+      before do
+        101.times do |index|
+          TheatreProgramme.create!(theatre:, post:, position: index + 1)
+        end
+      end
+
+      include_examples 'a capped list', 100, 100, false
+    end
+
+    context 'skip events' do
+      let(:path) { "/theatres/#{ theatre.id }/skip_events" }
+      before do
+        101.times do |index|
+          TheatreSkipEvent.create!(theatre:, post:,
+                                   skipped_by_user: theatre.created_by_user,
+                                   created_at: Time.utc(2026, 1, 1) + index.seconds)
+        end
+      end
+
+      include_examples 'a capped list', 50, 50, false
+    end
+  end
+end

frontend/src/components/PostEditForm.tsx

@@ -1,8 +1,6 @@
-import { useQuery } from '@tanstack/react-query'
 import { useEffect, useMemo, useState } from 'react'
 
 import { useLocale } from '@/lib/useLocale'
-import PostList from '@/components/PostList'
 import PostOriginalCreatedTimeField from '@/components/PostOriginalCreatedTimeField'
 import FieldError from '@/components/common/FieldError'
 import PostDurationField from '@/components/posts/PostDurationField'
@@ -12,15 +10,14 @@ import { Button } from '@/components/ui/button'
 import { toast } from '@/components/ui/use-toast'
 import { isApiError } from '@/lib/api'
 import useDialogue from '@/lib/dialogues/useDialogue'
-import { fetchPosts, updatePost } from '@/lib/posts'
-import { postsKeys } from '@/lib/queryKeys'
+import { updatePost } from '@/lib/posts'
 import { msToTime } from '@/lib/utils'
 import { useValidationErrors } from '@/lib/useValidationErrors'
 import { useUITranslation } from '@/lib/useUITranslation'
 
 import type { FC, FormEvent } from 'react'
 
-import type { FetchPostsParams, Post, TagWithSections } from '@/types'
+import type { Post, TagWithSections } from '@/types'
 
 type PostFormField =
     'parentPostIds' | 'tags' | 'videoMs'
@@ -71,33 +68,6 @@ const PostEditForm: FC<Props> = ({ post, onSave }) => {
   const [tags, setTags] = useState<string> (() => tagsToStr (post.tags))
   const [title, setTitle] = useState (post.title)
 
-  const [importVisible, setImportVisible] = useState (false)
-  const [sourceTitle, setSourceTitle] = useState ('')
-  const [sourcePage, setSourcePage] = useState (1)
-  const sourceParams: FetchPostsParams = {
-      title: sourceTitle, page: sourcePage, limit: 20,
-      url: '', tags: '', match: 'all', order: 'original_created_at:desc',
-      originalCreatedFrom: '', originalCreatedTo: '',
-      createdFrom: '', createdTo: '', updatedFrom: '', updatedTo: '' }
-  const { data: sources, isError: sourceError } = useQuery ({
-      queryKey: postsKeys.index (sourceParams, locale),
-      queryFn: () => fetchPosts (sourceParams, locale),
-      enabled: importVisible && !disabled })
-
-  const importTags = (source: Post) => {
-    if (disabled)
-      return
-    setTags (current => {
-      const existing = new Set (current.split (/\s+/))
-      const additions = tagsToStr (source.tags).split (/\s+/)
-	  .filter (tag => tag !== '' && !existing.has (tag))
-      return additions.length > 0
-	  ? `${current}${current.trim () === '' ? '' : ' '}${additions.join (' ')}`
-	  : current
-    })
-    setImportVisible (false)
-  }
-
   const videoFlg =
       useMemo (() => tags.split (/\s+/).some (tag => tag.replace (/\[.*\]$/, '') === '動画'),
 	       [tags])
@@ -222,48 +192,6 @@ const PostEditForm: FC<Props> = ({ post, onSave }) => {
 	    setTags={setTags}
 	    errors={fieldErrors.tags}/>
 
-	<Button
-	    type="button"
-	    variant="outline"
-	    disabled={disabled}
-	    aria-expanded={importVisible}
-	    onClick={() => setImportVisible (visible => !visible)}>
-	  {label ('edit.import')}
-	</Button>
-	{importVisible && (
-	    <div className="space-y-2" onKeyDown={event => {
-	      if (event.key === 'Enter' && event.target instanceof HTMLInputElement)
-		event.preventDefault ()
-	    }}>
-	      <PostTextField
-		  label={label ('shared:labels.title')}
-		  type="search"
-		  value={sourceTitle}
-		  disabled={disabled}
-		  onChange={value => {
-		    setSourceTitle (value)
-		    setSourcePage (1)
-		  }}/>
-	      <FieldError messages={sourceError ? [label ('common:fetchError')] : []}/>
-	      {!disabled && <PostList posts={sources?.posts ?? []} onSelect={importTags}/>}
-	      <div className="flex flex-col gap-2 md:flex-row">
-		<Button
-		    type="button"
-		    variant="outline"
-		    disabled={disabled || sourcePage <= 1}
-		    onClick={() => setSourcePage (page => page - 1)}>
-		  {label ('common:pagination.previous')}
-		</Button>
-		<Button
-		    type="button"
-		    variant="outline"
-		    disabled={disabled || sourcePage * 20 >= (sources?.count ?? 0)}
-		    onClick={() => setSourcePage (page => page + 1)}>
-		  {label ('common:pagination.next')}
-		</Button>
-	      </div>
-	    </div>)}
-
 	{/* オリジナルの作成日時 */}
 	<PostOriginalCreatedTimeField
 	    disabled={disabled}

frontend/src/components/PostList.tsx

@@ -3,7 +3,6 @@ import { useRef } from 'react'
 import { useLocation } from 'react-router-dom'
 
 import PrefetchLink from '@/components/PrefetchLink'
-import { Button } from '@/components/ui/button'
 import { useUITranslation } from '@/lib/useUITranslation'
 import { useClientBehaviourSettings } from '@/lib/useClientBehaviourSettings'
 import { cn } from '@/lib/utils'
@@ -14,11 +13,10 @@ import type { FC, MouseEvent } from 'react'
 import type { Post } from '@/types'
 
 type Props = { posts:     Post[]
-	       onSelect?: (post: Post) => void
 	       onClick?:  (event: MouseEvent<HTMLElement>) => void }
 
 
-const PostList: FC<Props> = ({ posts, onClick, onSelect }) => {
+const PostList: FC<Props> = ({ posts, onClick }) => {
   const { label } = useUITranslation ('shared')
   const location = useLocation ()
   const behaviourSettings = useClientBehaviourSettings ()
@@ -41,63 +39,7 @@ const PostList: FC<Props> = ({ posts, onClick, onSelect }) => {
 	  const sharedId = `page-${ post.id }`
 	  const layoutId = sharedId
 
-	  const card = (
-	      <motion.div
-		  ref={cardRef}
-		  layout={animationMode === 'off' ? false : true}
-		  layoutId={(onSelect || animationMode === 'off') ? undefined : layoutId}
-		  className={cn ('w-full h-full overflow-hidden rounded-xl shadow',
-				 'transform-gpu will-change-transform',
-				 (post.childPosts ?? []).length > 0 && 'ring-4 ring-green-500',
-				 (post.parentPosts ?? []).length > 0 && 'ring-4 ring-yellow-500')}
-		  whileHover={{ scale: 1.02 }}
-		  onLayoutAnimationStart={() => {
-		    if (!(cardRef.current))
-		      return
-
-		    cardRef.current.style.position = 'relative'
-		    cardRef.current.style.zIndex = '9999'
-		  }}
-		  onLayoutAnimationComplete={() => {
-		    if (!(cardRef.current))
-		      return
-
-		    cardRef.current.style.zIndex = ''
-		    cardRef.current.style.position = ''
-		  }}
-		  transition={{ layout: cardLayoutTransition }}>
-		{thumbnailMode === 'off'
-		 ? (
-		    <div className="flex h-full w-full items-center justify-center
-				    bg-muted text-center text-xs text-muted-foreground">
-		      {label ('labels.noThumbnail')}
-		    </div>)
-		 : (
-		    <img
-			src={post.thumbnail || post.thumbnailBase || undefined}
-			alt={post.title || post.url}
-			title={post.title || post.url || undefined}
-			loading={
-			    thumbnailMode === 'light'
-			    ? 'lazy'
-			    : (i < 12 ? 'eager' : 'lazy')
-			}
-			decoding="async"
-			className="object-cover w-full h-full"/>)}
-	      </motion.div>)
-
-	  return onSelect
-	  ? (
-	      <Button
-		  key={post.id}
-		  type="button"
-		  variant="ghost"
-		  className="w-40 h-40 p-0"
-		  aria-label={post.title || post.url}
-		  onClick={() => onSelect (post)}>
-		{card}
-	      </Button>)
-	  : (
+	  return (
 	      <PrefetchLink
 		  to={`/posts/${ post.id }`}
 		  key={post.id}
@@ -107,7 +49,51 @@ const PostList: FC<Props> = ({ posts, onClick, onSelect }) => {
 		    setForLocationKey (location.key, sharedId)
 		    onClick?.(e)
 		  }}>
-		{card}
+		<motion.div
+		    ref={cardRef}
+		    layout={animationMode === 'off' ? false : true}
+		    layoutId={animationMode === 'off' ? undefined : layoutId}
+		    className={cn ('w-full h-full overflow-hidden rounded-xl shadow',
+				   'transform-gpu will-change-transform',
+				   (post.childPosts ?? []).length > 0 && 'ring-4 ring-green-500',
+				   (post.parentPosts ?? []).length > 0 && 'ring-4 ring-yellow-500')}
+		    whileHover={{ scale: 1.02 }}
+		    onLayoutAnimationStart={() => {
+		      if (!(cardRef.current))
+			return
+
+		      cardRef.current.style.position = 'relative'
+		      cardRef.current.style.zIndex = '9999'
+		    }}
+		    onLayoutAnimationComplete={() => {
+		      if (!(cardRef.current))
+			return
+
+		      cardRef.current.style.zIndex = ''
+		      cardRef.current.style.position = ''
+		    }}
+		    transition={{ layout: cardLayoutTransition }}>
+		  {thumbnailMode === 'off'
+		   ? (
+		      <div className="flex h-full w-full items-center justify-center
+				      bg-muted text-center text-xs text-muted-foreground">
+			{label ('labels.noThumbnail')}
+		      </div>)
+		   : (
+		      <img
+			  src={post.thumbnail || post.thumbnailBase || undefined}
+			  alt={post.title || post.url}
+			  title={post.title || post.url || undefined}
+			  loading={
+			      thumbnailMode === 'light'
+			      ? 'lazy'
+			      : i < 12
+				? 'eager'
+				: 'lazy'
+			  }
+			  decoding="async"
+			  className="object-cover w-full h-full"/>)}
+		</motion.div>
 	      </PrefetchLink>)
 	})}
       </div>)

frontend/src/locales/ain-Kana/posts.json

@@ -1,5 +1,4 @@
 {
-  "_untranslated": ["edit.import"],
   "list": {
     "tagline": "{{brand}}",
     "empty": "ミンタㇻ　タ　ネン　カ　イサㇺ",
@@ -32,7 +31,6 @@
     "showExternal": "ソイタㇰ　ソㇱ　アヌカレ"
   },
   "edit": {
-    "import": "インポート",
     "validationFailed": "アシㇼ　カㇻ　カ　エアイカㇷ゚……",
     "conflictTitle": "モㇱマ　クㇽ　アシㇼ　カㇻ　ワ　アン！",
     "conflictDescription": "モㇱマ　イカㇻ　クㇽ　エエトコ　アシㇼ　カㇻ　ワ　アン。",

frontend/src/locales/ja/posts.json

@@ -22,7 +22,6 @@
     "question": "表示しますか?", "showExternal": "外部ページを表示"
   },
   "edit": {
-    "import": "インポート",
     "validationFailed": "更新はできなかったよ……",
     "conflictTitle": "競合が発生しました．",
     "conflictDescription": "ほかの耕作員が先に更新してゐます．",