AI: address review on PR #466

backend/app/controllers/material_versions_controller.rb

@@ -5,6 +5,7 @@ class MaterialVersionsController < ApplicationController
 
     page = 1 if page < 1
     limit = 1 if limit < 1
+    limit = 100 if limit > 100
 
     offset = (page - 1) * limit
 

backend/app/controllers/materials_controller.rb

@@ -14,6 +14,7 @@ class MaterialsController < ApplicationController
 
     page = 1 if page < 1
     limit = 1 if limit < 1
+    limit = 100 if limit > 100
 
     offset = (page - 1) * limit
 

backend/app/controllers/nico_tags_controller.rb

@@ -15,6 +15,7 @@ class NicoTagsController < ApplicationController
 
     page = 1 if page < 1
     limit = 1 if limit < 1
+    limit = 100 if limit > 100
 
     post_tag_max_sql =
         PostExternalTag

backend/app/controllers/post_versions_controller.rb

@@ -11,6 +11,7 @@ class PostVersionsController < ApplicationController
 
     page = 1 if page < 1
     limit = 1 if limit < 1
+    limit = 100 if limit > 100
 
     offset = (page - 1) * limit
 

backend/app/controllers/posts_controller.rb

@@ -34,6 +34,7 @@ class PostsController < ApplicationController
 
     page = 1 if page < 1
     limit = 1 if limit < 1
+    limit = 100 if limit > 100
 
     offset = (page - 1) * limit
 

backend/app/controllers/tag_versions_controller.rb

@@ -7,6 +7,7 @@ class TagVersionsController < ApplicationController
 
     page = 1 if page < 1
     limit = 1 if limit < 1
+    limit = 100 if limit > 100
 
     offset = (page - 1) * limit
 

backend/app/controllers/tags_controller.rb

@@ -33,6 +33,7 @@ class TagsController < ApplicationController
 
     page = 1 if page < 1
     limit = 1 if limit < 1
+    limit = 100 if limit > 100
 
     offset = (page - 1) * limit
 

backend/app/controllers/theatre_comments_controller.rb

@@ -2,6 +2,7 @@ class TheatreCommentsController < ApplicationController
   def index
     limit = params[:limit].to_i
     limit = 20 if limit <= 0
+    limit = 100 if limit > 100
 
     no_gt = params[:no_gt].to_i
     no_gt = 0 if no_gt < 0
@@ -9,6 +10,7 @@ class TheatreCommentsController < ApplicationController
     comments = TheatreComment
                .where(theatre_id: params[:theatre_id])
                .where('no > ?', no_gt)
+               .includes(:user)
                .order(no: :desc)
                .limit(limit)
 

backend/app/controllers/theatre_programmes_controller.rb

@@ -2,6 +2,7 @@ class TheatreProgrammesController < ApplicationController
   def index
     limit = params[:limit].to_i
     limit = 100 if limit <= 0
+    limit = 100 if limit > 100
 
     position_gt = params[:position_gt].to_i
     position_gt = 0 if position_gt < 0
@@ -10,7 +11,7 @@ class TheatreProgrammesController < ApplicationController
                  .where(theatre_id: params[:theatre_id])
                  .where('position > ?', position_gt)
                  .includes(:post)
-                 .order(position: :desc).limit(100)
+                 .order(position: :desc)
                  .limit(limit)
 
     render json: programmes.map { |programme|

backend/app/controllers/theatre_skip_events_controller.rb

@@ -2,6 +2,7 @@ class TheatreSkipEventsController < ApplicationController
   def index
     limit = params[:limit].to_i
     limit = 50 if limit <= 0
+    limit = 100 if limit > 100
 
     events =
         TheatreSkipEvent

backend/spec/requests/list_limits_spec.rb

@@ -0,0 +1,174 @@
+require 'rails_helper'
+
+RSpec.describe 'List API limits', type: :request do
+  shared_examples 'a capped list' do |default_count, minimum_count, paginated|
+    def response_rows
+      body = json
+      body.is_a?(Array) ? body : body.fetch(collection_key)
+    end
+
+    it 'caps oversized limits at 100 and preserves the 100 boundary' do
+      get path, params: { locale: 'ja', limit: 100 }
+      expect(response).to have_http_status(:ok)
+      expect(response_rows.size).to eq(100)
+      boundary_rows = response_rows
+
+      [101, 10_000].each do |limit|
+        get path, params: { locale: 'ja', limit: }
+        expect(response).to have_http_status(:ok)
+        expect(response_rows).to eq(boundary_rows)
+      end
+    end
+
+    it 'preserves the default, nonpositive and small positive limits' do
+      get path, params: { locale: 'ja' }
+      expect(response).to have_http_status(:ok)
+      expect(response_rows.size).to eq(default_count)
+
+      [0, -1].each do |limit|
+        get path, params: { locale: 'ja', limit: }
+        expect(response).to have_http_status(:ok)
+        expect(response_rows.size).to eq(minimum_count)
+      end
+
+      get path, params: { locale: 'ja', limit: 2 }
+      expect(response).to have_http_status(:ok)
+      expect(response_rows.size).to eq(2)
+    end
+
+    if paginated
+      it 'uses the capped limit for page offsets and preserves total count' do
+        get path, params: { locale: 'ja', limit: 100 }
+        first_page = response_rows
+        expect(response).to have_http_status(:ok)
+        expect(json.fetch('count')).to eq(101)
+
+        get path, params: { locale: 'ja', limit: 100, page: 2 }
+        expect(response).to have_http_status(:ok)
+        expect(response_rows.size).to eq(1)
+        second_page = response_rows
+        expect(first_page & second_page).to be_empty
+
+        get path, params: { locale: 'ja', limit: 101, page: 2 }
+        expect(response).to have_http_status(:ok)
+        expect(response_rows).to eq(second_page)
+        expect(json.fetch('count')).to eq(101)
+      end
+    end
+  end
+
+  context 'posts' do
+    let(:path) { '/posts' }
+    let(:collection_key) { 'posts' }
+    before { create_list(:post, 101) }
+
+    include_examples 'a capped list', 20, 1, true
+  end
+
+  context 'tags' do
+    let(:path) { '/tags' }
+    let(:collection_key) { 'tags' }
+    before { create_list(:tag, 101) }
+
+    include_examples 'a capped list', 20, 1, true
+  end
+
+  context 'nico tags' do
+    let(:path) { '/tags/nico' }
+    let(:collection_key) { 'tags' }
+    before { create_list(:external_tag, 101) }
+
+    include_examples 'a capped list', 20, 1, true
+  end
+
+  context 'materials' do
+    let(:path) { '/materials' }
+    let(:collection_key) { 'materials' }
+    before do
+      101.times { |index| Material.create!(url: "https://example.com/material-#{ index }") }
+    end
+
+    include_examples 'a capped list', 20, 1, true
+  end
+
+  context 'post versions' do
+    let(:path) { '/posts/versions' }
+    let(:collection_key) { 'versions' }
+    let(:post) { create(:post) }
+    before do
+      101.times do |index|
+        PostVersion.create!(post:, version_no: index + 1, event_type: 'update',
+                            url: post.url, tags: '', tags_json: [], parent_post_ids: '')
+      end
+    end
+
+    include_examples 'a capped list', 20, 1, true
+  end
+
+  context 'tag versions' do
+    let(:path) { '/tags/versions' }
+    let(:collection_key) { 'versions' }
+    let(:tag) { create(:tag) }
+    before do
+      101.times do |index|
+        TagVersion.create!(tag:, version_no: index + 1, event_type: 'update',
+                           name: 'limit tag', category: 'general', aliases: '',
+                           parent_tag_ids: '', names: {
+                               ja: { name: 'limit tag', script_code: 'Jpan',
+                                     auto_generated: false, aliases: [] } })
+      end
+    end
+
+    include_examples 'a capped list', 20, 1, true
+  end
+
+  context 'material versions' do
+    let(:path) { '/materials/versions' }
+    let(:collection_key) { 'versions' }
+    let(:material) { Material.create!(url: 'https://example.com/material') }
+    before do
+      101.times do |index|
+        MaterialVersion.create!(material:, version_no: index + 1,
+                                event_type: 'update', url: material.url)
+      end
+    end
+
+    include_examples 'a capped list', 20, 1, true
+  end
+
+  context 'theatre lists' do
+    let(:theatre) { create(:theatre) }
+    let(:post) { create(:post) }
+
+    context 'comments' do
+      let(:path) { "/theatres/#{ theatre.id }/comments" }
+      before { create_list(:theatre_comment, 101, theatre:, user: theatre.created_by_user) }
+
+      include_examples 'a capped list', 20, 20, false
+    end
+
+    context 'programmes' do
+      let(:path) { "/theatres/#{ theatre.id }/programmes" }
+      before do
+        101.times do |index|
+          TheatreProgramme.create!(theatre:, post:, position: index + 1)
+        end
+      end
+
+      include_examples 'a capped list', 100, 100, false
+    end
+
+    context 'skip events' do
+      let(:path) { "/theatres/#{ theatre.id }/skip_events" }
+      before do
+        101.times do |index|
+          TheatreSkipEvent.create!(theatre:, post:,
+                                   skipped_by_user: theatre.created_by_user,
+                                   created_at: Time.utc(2026, 1, 1) + index.seconds)
+        end
+      end
+
+      include_examples 'a capped list', 50, 50, false
+    end
+  end
+end

frontend/src/components/PostEditForm.test.tsx

@@ -1,13 +1,11 @@
-import { act, fireEvent, screen, waitFor } from '@testing-library/react'
+import { fireEvent, screen, waitFor } from '@testing-library/react'
-import { beforeEach, describe, expect, it, vi } from 'vitest'
+import { describe, expect, it, vi } from 'vitest'
 
 import { textContentOf } from '@/test/text'
 import PostEditForm from '@/components/PostEditForm'
 import { buildPost, buildTag } from '@/test/factories'
 import { renderWithProviders as render } from '@/test/render'
 
-import type { DialogueAPI } from '@/lib/dialogues/useDialogue'
-
 const postsApi = vi.hoisted (() => ({
   updatePost: vi.fn (),
 }))
@@ -20,27 +18,18 @@ const toastApi = vi.hoisted (() => ({
   toast: vi.fn (),
 }))
 
-const dialogue = vi.hoisted (() => ({
-    confirm: vi.fn<DialogueAPI['confirm']> (),
-    choice: vi.fn () }))
-
 vi.mock ('@/lib/posts', () => postsApi)
 vi.mock ('@/lib/api', () => api)
 vi.mock ('@/components/ui/use-toast', () => toastApi)
 vi.mock ('@/lib/dialogues/useDialogue', async importOriginal => ({
   ...await importOriginal<typeof import ('@/lib/dialogues/useDialogue')> (),
-    default: () => dialogue }))
+  default: () => ({
+    choice: vi.fn (),
+  }),
+}))
 
 describe ('PostEditForm', () => {
-  beforeEach (() => {
-    vi.resetAllMocks ()
-  })
-
   it ('submits edited post fields with the current base version', async () => {
-    const confirm = vi.fn<(value: boolean) => void> ()
-    dialogue.confirm.mockReturnValueOnce (new Promise<boolean> (resolve => {
-      confirm.mockImplementation (resolve)
-    }))
     const onSave = vi.fn ()
     const post = buildPost ({
       id:        8,
@@ -66,16 +55,6 @@ describe ('PostEditForm', () => {
     fireEvent.change (parentIds, { target: { value: '3 4' } })
     fireEvent.submit (screen.getByRole ('button', { name: '更新' }).closest ('form')!)
 
-    expect (postsApi.updatePost).not.toHaveBeenCalled ()
-    expect (dialogue.confirm).toHaveBeenCalledTimes (1)
-    const difference = textContentOf (
-	dialogue.confirm.mock.calls[0][0].description)
-    expect (difference).toContain ('oldnew')
-    expect (difference).toContain ('23 4')
-    expect (difference).not.toContain ('general-tag')
-
-    await act (async () => { confirm (true) })
-
     await waitFor (() => {
       expect (postsApi.updatePost).toHaveBeenCalledWith (
           expect.objectContaining ({
@@ -92,28 +71,6 @@ describe ('PostEditForm', () => {
     expect (textContentOf (toastApi.toast.mock.calls[0][0].description)).toBe ('更新しました．')
   })
 
-  it ('keeps edited fields without submitting when confirmation is cancelled', async () => {
-    const onSave = vi.fn ()
-    dialogue.confirm.mockResolvedValueOnce (false)
-    render (<PostEditForm post={buildPost ()} onSave={onSave}/>)
-
-    const [title, parentIds] = screen.getAllByRole ('textbox')
-    fireEvent.change (title, { target: { value: 'new' } })
-    fireEvent.change (parentIds, { target: { value: '3 4' } })
-    const button = screen.getByRole ('button', { name: '更新' })
-    fireEvent.submit (button.closest ('form')!)
-
-    await waitFor (() => {
-      expect (button).toBeEnabled ()
-    })
-    expect (dialogue.confirm).toHaveBeenCalledTimes (1)
-    expect (postsApi.updatePost).not.toHaveBeenCalled ()
-    expect (onSave).not.toHaveBeenCalled ()
-    expect (toastApi.toast).not.toHaveBeenCalled ()
-    expect (title).toHaveValue ('new')
-    expect (parentIds).toHaveValue ('3 4')
-  })
-
   it ('preserves duration while the video tag is temporarily removed', () => {
     const post = buildPost ({
       videoMs: 180_500,
@@ -143,7 +100,6 @@ describe ('PostEditForm', () => {
       'shows deduplicated original-created endpoint errors on the shared datetime field',
       async () => {
     const post = buildPost ()
-    dialogue.confirm.mockResolvedValueOnce (true)
     api.isApiError.mockReturnValue (true)
     postsApi.updatePost.mockRejectedValueOnce ({
       response: {

frontend/src/components/PostEditForm.tsx

@@ -15,7 +15,7 @@ import { msToTime } from '@/lib/utils'
 import { useValidationErrors } from '@/lib/useValidationErrors'
 import { useUITranslation } from '@/lib/useUITranslation'
 
-import type { FC, FormEvent, ReactNode } from 'react'
+import type { FC, FormEvent } from 'react'
 
 import type { Post, TagWithSections } from '@/types'
 
@@ -23,8 +23,6 @@ type PostFormField =
     'parentPostIds' | 'tags' | 'videoMs'
     | 'originalCreatedAt' | 'originalCreatedFrom' | 'originalCreatedBefore'
 
-type PostEditData = Omit<Parameters<typeof updatePost>[0], 'id'>
-
 const groupedMessages = (...values: (string[] | undefined)[]): string[] =>
     [...new Set (values.flatMap (value => value ?? []))]
 
@@ -152,63 +150,12 @@ const PostEditForm: FC<Props> = ({ post, onSave }) => {
   const handleSubmit = async (e: FormEvent) => {
     e.preventDefault ()
 
-    if (disabled) return
-
     setDisabled (true)
     try
     {
-      const current: PostEditData = {
+      await update ({ id: post.id, title, tags, parentPostIds,
-	  title, tags, parentPostIds,
 		      duration: videoFlg ? duration : null,
-	  originalCreatedFrom, originalCreatedBefore }
+		      originalCreatedFrom, originalCreatedBefore },
-      const fields: {
-	  [Key in keyof PostEditData]-?: {
-	      name: ReactNode
-	      prev: PostEditData[Key] } } = {
-	  title: { name: label ('shared:labels.title'), prev: post.title },
-	  parentPostIds: {
-	      name: label ('shared:labels.parentPosts'),
-	      prev: (post.parentPosts ?? []).map (parent => parent.id).join (' ') },
-	  tags: { name: label ('tags:title'), prev: tagsToStr (post.tags) },
-	  duration: {
-	      name: label ('shared:labels.duration'),
-	      prev: videoMsToDurationValue (post.videoMs) },
-	  originalCreatedFrom: {
-	      name: <>{label ('shared:labels.originalCreatedAt')}{' '}
-			{label ('shared:labels.since')}</>,
-	      prev: post.originalCreatedFrom },
-	  originalCreatedBefore: {
-	      name: <>{label ('shared:labels.originalCreatedAt')}{' '}
-			{label ('shared:labels.before')}</>,
-	      prev: post.originalCreatedBefore } }
-      const differences = (Object.keys (fields) as (keyof PostEditData)[])
-	  .map (key => ({ key, name: fields[key].name,
-	      prev: fields[key].prev ?? '', current: current[key] ?? '' }))
-	  .filter (row => row.prev !== row.current)
-
-      if (!(await dialogue.confirm ({
-	  title: label ('shared:actions.diff'),
-	  confirmText: label ('shared:actions.update'),
-	  description: (
-	      <dl className="max-h-[60dvh] overflow-y-auto space-y-3 text-left">
-		{differences.map (row => (
-		    <div key={row.key}>
-		      <dt className="font-semibold">{row.name}</dt>
-		      <dd className="whitespace-pre-wrap break-words">
-			{row.prev && (
-			    <del className="block text-red-600 dark:text-red-400">
-			      {row.prev}
-			    </del>)}
-			{row.current && (
-			    <ins className="block text-green-700 dark:text-green-400">
-			      {row.current}
-			    </ins>)}
-		      </dd>
-		    </div>))}
-	      </dl>) })))
-	return
-
-      await update ({ id: post.id, ...current },
 		    { baseVersionNo: post.versionNo })
     }
     finally