AI: address review on PR #477

backend/app/controllers/posts_controller.rb

@@ -37,7 +37,7 @@ class PostsController < ApplicationController
 
     offset = (page - 1) * limit
 
-    history_join_required = order[0] == 'updated_at' || updated_between.any?(&:present?)
+    needs_history_join = order[0] == 'updated_at' || updated_between.any?(&:present?)
 
     q =
         filtered_posts(locale)
@@ -57,8 +57,8 @@ class PostsController < ApplicationController
     q = q.where('posts.created_at >= ?', created_between[0]) if created_between[0]
     q = q.where('posts.created_at <= ?', created_between[1]) if created_between[1]
     count_scope = q
-    if history_join_required
-      history_times = PostVersion.all
+    if needs_history_join
+      history_times = HistoryAccess.visible(PostVersion.all)
           .select('post_id, MAX(created_at) AS latest_at').group(:post_id)
       q = q.joins("LEFT JOIN (#{ history_times.to_sql }) history_times " +
                   'ON history_times.post_id = posts.id')
@@ -72,7 +72,7 @@ class PostsController < ApplicationController
       q = q.where("#{ updated_at_all_sql } <= ?", updated_between[1])
     end
     count_scope = q if updated_between.any?(&:present?)
-    if history_join_required
+    if needs_history_join
       q = q.select('posts.*', "#{ updated_at_all_sql } AS updated_at")
     end
 
@@ -92,10 +92,10 @@ class PostsController < ApplicationController
              .offset(offset)
              .to_a
     latest_version_times =
-        if history_join_required
+        if needs_history_join
           { }
         else
-          PostVersion.where(post_id: posts.map(&:id))
+          HistoryAccess.visible(PostVersion.where(post_id: posts.map(&:id)))
               .group(:post_id).maximum(:created_at)
         end
 

backend/app/controllers/tag_descriptions_controller.rb

@@ -49,6 +49,7 @@ class TagDescriptionsController < ApplicationController
   private
 
   def representation description
+    HistoryAccess.require_current!(description, TagDescriptionVersion)
     description.as_json(only: [
         :tag_id,
         :language_code,

backend/app/controllers/tag_groups_controller.rb

@@ -1,7 +1,7 @@
 class TagGroupsController < ApplicationController
   def index
     locale = resolve_locale!
-    groups = TagGroup.includes(:created_by_user, :updated_by_user).order(:id)
+    groups = HistoryAccess.current(TagGroup.all, TagGroupVersion).includes(:created_by_user, :updated_by_user).order(:id)
     render json: TagGroupRepr.many(locale, groups.to_a)
   end
 

backend/app/controllers/wiki_pages_controller.rb

@@ -6,13 +6,21 @@ class WikiPagesController < ApplicationController
   def index
     locale = resolve_locale!
 
+    resource_type = params[:resource_type]
+    unless resource_type.nil? || ['tag_description', 'tag_group'].include?(resource_type)
+      return head :bad_request
+    end
+
     title = params[:title].to_s.strip
     descriptions =
-        TagDescription.where(language_code: locale.language_code)
+        HistoryAccess.current(TagDescription.all, TagDescriptionVersion)
+        .where(language_code: locale.language_code)
         .includes(tag: :tag_names)
 
     descriptions = descriptions.order(updated_at: :desc, id: :asc)
-    tag_groups = TagGroup.order(updated_at: :desc, id: :asc)
+    tag_groups = HistoryAccess.current(TagGroup.all, TagGroupVersion).order(updated_at: :desc, id: :asc)
+    descriptions = descriptions.none if resource_type == 'tag_group'
+    tag_groups = tag_groups.none if resource_type == 'tag_description'
     if title.present?
       pattern = "%#{ ApplicationRecord.sanitize_sql_like(title) }%"
       descriptions =
@@ -40,13 +48,13 @@ class WikiPagesController < ApplicationController
     return head :not_found unless language.is_a?(String)
     return head :not_found unless Language.exists?(code: language)
 
-    names = TagDescription.joins(tag: :tag_names)
+    names = HistoryAccess.current(TagDescription.all, TagDescriptionVersion).joins(tag: :tag_names)
         .where(language_code: locale.language_code, tag_names: { language_code: language })
         .pluck('tag_descriptions.tag_id', 'tag_descriptions.id', 'tag_names.name')
     candidates = names.map do |tag_id, description_id, name|
       WikiPageRepr.autolink_tag(locale, tag_id:, description_id:, name:, language:)
     end
-    candidates.concat(TagGroup.order(:id).pluck(:id, :name).map do |id, name|
+    candidates.concat(HistoryAccess.current(TagGroup.all, TagGroupVersion).order(:id).pluck(:id, :name).map do |id, name|
       WikiPageRepr.autolink_group(locale, id:, name:, language:)
     end)
     render json: candidates
@@ -410,7 +418,7 @@ class WikiPagesController < ApplicationController
   end
 
   def tag_description_by_title locale, title
-    TagDescription.joins(tag: :tag_names)
+    HistoryAccess.current(TagDescription.all, TagDescriptionVersion).joins(tag: :tag_names)
         .find_by(language_code: locale.language_code,
                  tag_names: { language_code: locale.language_code, name: title })
   end

backend/app/models/history_access.rb

@@ -147,6 +147,29 @@ class HistoryAccess < ActiveSupport::CurrentAttributes
     scope.where(Arel.sql(sql(scope.klass, row)))
   end
 
+  def self.current(scope, version_model)
+    return scope if admin?
+
+    table = scope.klass.table_name
+    keys = KEYS.fetch(version_model.table_name)
+    matches = keys.map do |key|
+      column = scope.klass.column_names.include?(key) ? key : 'id'
+      "current_snapshot.#{ key } = #{ table }.#{ column }"
+    end.join(' AND ')
+    boundary = "#{ matches } AND current_snapshot.version_no >= #{ table }.version_no " +
+        "AND current_snapshot.event_type = 'discard'"
+    scope = scope.where(Arel.sql("NOT EXISTS (SELECT 1 FROM #{ version_model.table_name } " +
+        "current_snapshot WHERE #{ boundary })"))
+    condition = "#{ matches } AND current_snapshot.version_no = #{ table }.version_no"
+    scope.where(Arel.sql("NOT EXISTS (SELECT 1 FROM #{ version_model.table_name } " +
+        "current_snapshot WHERE #{ condition } AND NOT (#{ sql(version_model, 'current_snapshot') }))"))
+  end
+
+  def self.require_current!(record, version_model)
+    return if admin?
+    raise Forbidden unless current(record.class.where(id: record.id), version_model).exists?
+  end
+
   def self.blob_visible?(blob, seen = [])
     return true if admin?
     return false if seen.include?(blob.id)

backend/app/representations/tag_group_repr.rb

@@ -44,6 +44,7 @@ module TagGroupRepr
   end
 
   def one locale, group
+    HistoryAccess.require_current!(group, TagGroupVersion)
     many(locale, [group]).first
   end
 

backend/app/representations/wiki_page_repr.rb

@@ -5,6 +5,7 @@ module WikiPageRepr
   module_function
 
   def tag_description locale, description
+    HistoryAccess.require_current!(description, TagDescriptionVersion)
     tag = description.tag
 
     { 'id' => description.id,

backend/spec/requests/counts_history_boundaries_spec.rb

@@ -14,7 +14,7 @@ RSpec.describe 'History boundaries shared with Counts', type: :request do
     end
   end
 
-  it 'keeps discarded history private while exposing the current description' do
+  it 'denies the same discarded description through Counts, the facade and the ordinary API' do
     get '/counts/query', params: { resource: 'tag_descriptions', definition: 'history',
         mode: 'details', locale: 'ja', execution_at: '2025-01-01T00:00:00Z' }
     expect(response).to have_http_status(:ok)
@@ -22,8 +22,8 @@ RSpec.describe 'History boundaries shared with Counts', type: :request do
         'excluded_count' => 2, 'versions' => [])
     ["/wiki/#{ description.id }", "/tags/#{ tag.id }/description"].each do |path|
       get path, params: { locale: 'ja' }
-      expect(response).to have_http_status(:ok)
-      expect(response.parsed_body.fetch('body')).to eq(description.body)
+      expect(response).to have_http_status(:not_found)
+      expect(response.body).not_to include('private body')
     end
     get '/sitemap_entries/descriptions', params: { locale: 'ja' }
     expect(response).to have_http_status(:ok)

backend/spec/requests/post_history_privacy_spec.rb

@@ -69,38 +69,40 @@ RSpec.describe 'Post history privacy', type: :request do
         sign_in_as(create(:user, role.to_sym)) unless role == 'anonymous'
       end
 
-      it 'uses the latest version timestamp for display regardless of role' do
+      it 'uses only authorised history timestamps for display' do
         get '/posts'
         expect(response).to have_http_status(:ok)
         row = response.parsed_body.fetch('posts').find { _1.fetch('id') == post_record.id }
-        expected = origin + 4.days
+        expected = origin + (role == 'admin' ? 4 : 3).days
         expect(Time.zone.parse(row.fetch('updated_at'))).to eq(expected)
       end
 
-      it 'uses the latest version timestamp for date bounds and count regardless of role' do
+      it 'uses the same visibility for date bounds and count' do
         get '/posts', params: { updated_from: (origin + 4.days).iso8601,
                                 updated_to: (origin + 4.days).iso8601 }
         expect(response).to have_http_status(:ok)
         ids = response.parsed_body.fetch('posts').pluck('id')
-        expect(ids).to eq([post_record.id])
+        expect(ids).to eq(role == 'admin' ? [post_record.id] : [])
         expect(response.parsed_body.fetch('count')).to eq(ids.length)
       end
 
-      it 'sorts using the latest version timestamps in both directions regardless of role' do
+      it 'sorts using authorised timestamps in both directions' do
         ['asc', 'desc'].each do |direction|
           get '/posts', params: { order: "updated_at:#{ direction }" }
           expect(response).to have_http_status(:ok)
-          expected = [other_post.id, post_record.id]
+          expected = role == 'admin' ? [other_post.id, post_record.id] :
+              [post_record.id, other_post.id]
           expected.reverse! if direction == 'desc'
           expect(response.parsed_body.fetch('posts').pluck('id')).to eq(expected)
         end
       end
 
-      it 'applies latest version timestamp ordering before pagination regardless of role' do
+      it 'applies authorised timestamp ordering before pagination' do
         get '/posts', params: { order: 'updated_at:desc', limit: 1 }
 
         expect(response).to have_http_status(:ok)
-        expect(response.parsed_body.fetch('posts').pluck('id')).to eq([post_record.id])
+        expected = role == 'admin' ? post_record.id : other_post.id
+        expect(response.parsed_body.fetch('posts').pluck('id')).to eq([expected])
         expect(response.parsed_body.fetch('count')).to eq(2)
       end
 

frontend/src/App.tsx

@@ -166,7 +166,13 @@ export const pageRoutes = (
 	    robots: 'noindex', authentication: 'user' } },
 	{ path: ':id', element: <MaterialDetailPage/>,
 	  handle: { preload: MaterialDetailPage.preload, sitemap: ['materials'] } }] },
-    { path: 'wiki', element: <WikiSearchPage/>,
+    { path: 'wiki', element: <LocaleRedirect to="/tag-descriptions"/>,
+      handle: { redirectTo: '/tag-descriptions' } },
+    { path: 'tag-descriptions',
+      element: <WikiSearchPage key="tag_description" resourceType="tag_description"/>,
+      handle: { preload: WikiSearchPage.preload, sitemap: ['static'] } },
+    { path: 'tag-groups',
+      element: <WikiSearchPage key="tag_group" resourceType="tag_group"/>,
       handle: { preload: WikiSearchPage.preload, sitemap: ['static'] } },
     { path: 'wiki/:title', element: <WikiDetailPage/>,
       handle: { preload: WikiDetailPage.preload, switchLocale: switchWikiLocale,

frontend/src/components/TopNav.tsx

@@ -29,7 +29,7 @@ import { fetchWikiPage } from '@/lib/wiki'
 import type { FC, MouseEvent } from 'react'
 
 import type { AvailableLocale, LocaleCode } from '@/lib/locales'
-import type { Material, Menu, MenuVisibleItem, Tag, User } from '@/types'
+import type { Material, Menu, MenuVisibleItem, Tag, User, WikiPage } from '@/types'
 
 type Props = {
     user: User | null
@@ -39,10 +39,11 @@ type NavDensity = 'auto' | 'comfortable' | 'compact'
 
 
 export const menuOutline = (
-    { tag, material, wikiId, user, pathName: fullPathname }: {
+    { tag, material, wikiId, wikiResourceType, user, pathName: fullPathname }: {
 	tag?: Tag | null
 	material?: Material | null
 	wikiId: number | null
+	wikiResourceType?: WikiPage['resourceType']
 	user: User | null
 	pathName: string },
 ): Menu => {
@@ -99,17 +100,30 @@ export const menuOutline = (
 	    visible: materialFlg && Boolean (material?.tag) },
 	  { ...message ('history'), to: `/materials/changes?material_id=${ material?.id }`,
 	    visible: materialFlg }] },
-      { ...message ('wiki'), to: '/wiki', subMenu: [
-	  { ...message ('search'), to: '/wiki' },
-	  { ...message ('create'), to: '/wiki/new', visible: editable },
-	  { ...message ('allHistory'), to: '/wiki/changes' },
-	  { ...message ('help'), to: '/wiki/ヘルプ:Wiki' },
-	  { component: <Separator/>, visible: wikiPageFlg },
-	  { ...message ('postsWithCount', { count: postCount }), to: `/posts?tags=${ wikiTitle }`,
-	    visible: wikiPageFlg },
-	  { ...message ('history'), to: `/wiki/changes?id=${ wikiId }`, visible: wikiPageFlg },
-	  { ...message ('edit'), to: `/wiki/${ wikiId || wikiTitle }/edit`,
-	    visible: wikiPageFlg && editable }] },
+      ...([
+	  { key: 'tagDescriptions', path: '/tag-descriptions', type: 'tag_description' },
+	  { key: 'tagGroups', path: '/tag-groups', type: 'tag_group' }] as const)
+	  .map (({ key, path, type }): MenuVisibleItem => {
+	    const current = (wikiResourceType ?? 'tag_description') === type
+	    const detailFlg = wikiPageFlg && current
+	    const creationPath =
+		type === 'tag_group'
+		? `/wiki/new?title=${ encodeURIComponent ('タググループ:') }` : '/wiki/new'
+	    return { ...message (key), to: path,
+		base: (pathName.startsWith ('/wiki') && current) ? '/wiki' : path,
+		subMenu: [
+		    { ...message ('search'), to: path },
+		    { ...message ('create'), to: creationPath, visible: editable },
+		    { ...message ('allHistory'), to: '/wiki/changes' },
+		    { ...message ('help'), to: '/wiki/ヘルプ:Wiki' },
+		    { component: <Separator/>, visible: detailFlg },
+		    { ...message ('postsWithCount', { count: postCount }),
+		      to: `/posts?tags=${ wikiTitle }`, visible: detailFlg },
+		    { ...message ('history'), to: `/wiki/changes?id=${ wikiId }`,
+		      visible: detailFlg },
+		    { ...message ('edit'), to: `/wiki/${ wikiId || wikiTitle }/edit`,
+		      visible: detailFlg && editable }] }
+	  }),
       { ...message ('help'), to: '/help/home', base: '/help', subMenu: [
 	  { ...message ('search'), to: '/help' },
 	  { ...message ('allHistory'), to: '/help/changes' },
@@ -229,7 +243,8 @@ const TopNav: FC<Props> = ({ user, locales, resolveLocaleSwitch }) => {
       queryKey: materialsKeys.show (effectiveTitle, locale),
       queryFn: () => fetchMaterial (effectiveTitle, locale) })
 
-  const menu = menuOutline ({ tag, material, wikiId, user, pathName: location.pathname })
+  const menu = menuOutline ({ tag, material, wikiId,
+      wikiResourceType: wikiPage?.resourceType, user, pathName: location.pathname })
   const visibleMenu = menu.filter ((item): item is MenuVisibleItem => item.visible ?? true)
   const menuLabels = visibleMenu.map (item => item.name).join ('\u0000')
   const moreMenu = menu.filter (item =>

frontend/src/lib/prefetchers.ts

@@ -100,10 +100,11 @@ const prefetchHelpDiff: Prefetcher = async (qc, url, locale) => {
 
 const prefetchWikiPagesIndex: Prefetcher = async (qc, url, locale) => {
   const title = url.searchParams.get ('title') ?? ''
+  const resourceType = url.pathname === '/tag-groups' ? 'tag_group' : 'tag_description'
 
   await qc.prefetchQuery ({
-      queryKey: wikiKeys.index ({ title }, locale),
-      queryFn:  () => fetchWikiPages ({ title }, locale) })
+      queryKey: wikiKeys.index ({ title, resourceType }, locale),
+      queryFn: () => fetchWikiPages ({ title, resourceType }, locale) })
 }
 
 
@@ -310,7 +311,8 @@ export const routePrefetchers: { test: (u: URL) => boolean; run: Prefetcher }[]
 		  && Boolean (mPost (u.pathname))),
       run: prefetchPostShow },
     { test: u => u.pathname === '/posts/changes', run: prefetchPostChanges },
-    { test: u => u.pathname === '/wiki', run: prefetchWikiPagesIndex },
+    { test: u => ['/wiki', '/tag-descriptions', '/tag-groups'].includes (u.pathname),
+      run: prefetchWikiPagesIndex },
     { test: u => (!(['/wiki/new', '/wiki/changes'].includes (u.pathname))
 		  && Boolean (mWiki (u.pathname))),
       run: prefetchWikiPageShow },

frontend/src/lib/queryKeys.ts

@@ -5,6 +5,7 @@ import type {
     FetchPostsParams,
     FetchTagsParams,
     MaterialFilter,
+    WikiPage,
     WikiTagReference } from '@/types'
 
 export const localesKeys = {
@@ -130,7 +131,7 @@ export const wikiKeys = {
     autolinkCandidates: (language: string, locale: LocaleCode) =>
 	['wiki', 'autolink', locale, language] as const,
     index:  (
-    p: { title?: string },
+    p: { title?: string, resourceType?: WikiPage['resourceType'] },
     locale: LocaleCode = 'ja',
 ) => ['wiki', locale, 'index', p] as const,
     show:   (

frontend/src/lib/wiki.ts

@@ -24,10 +24,10 @@ export const fetchWikiChanges = (
 
 
 export const fetchWikiPages = async (
-    { title }:  { title?: string },
+    { title, resourceType }: { title?: string, resourceType?: WikiPage['resourceType'] },
     locale: LocaleCode = 'ja',
 ): Promise<WikiPage[]> =>
-    await apiGet ('/wiki', { locale, params: { title } })
+    await apiGet ('/wiki', { locale, params: { title, resource_type: resourceType } })
 
 
 export const fetchWikiPage = async (

frontend/src/locales/ain-Kana/navigation.json

@@ -14,6 +14,8 @@
   "materials": "チカㇻペ",
   "suppressions": "アエアイカㇷ゚テㇷ゚",
   "wiki": "Wiki",
+  "tagDescriptions": "$t(counts:resources.tag_descriptions)",
+  "tagGroups": "$t(counts:resources.tag_groups)",
   "create": "アシㇼ",
   "edit": "イヌイェㇷ゚",
   "entertainment": "シノッ",

frontend/src/locales/ja/navigation.json

@@ -13,6 +13,8 @@
   "materials": "素材",
   "suppressions": "抑止",
   "wiki": "Wiki",
+  "tagDescriptions": "$t(counts:resources.tag_descriptions)",
+  "tagGroups": "$t(counts:resources.tag_groups)",
   "create": "新規",
   "edit": "編輯",
   "entertainment": "おたのしみ",

frontend/src/pages/materials/MaterialDetailPage.tsx

@@ -135,7 +135,7 @@ const MaterialDetailPage: FC = () => {
 
 	      <TabGroup>
 		{material.tag && (
-		    <Tab name={label ('navigation:wiki')}>
+		    <Tab name={label ('navigation:tagDescriptions')}>
 		      <WikiBody
 			  title={material.tag.name}
 			  language={localeLanguage (locale)}

frontend/src/pages/posts/PostListPage.tsx

@@ -176,7 +176,7 @@ const PostListPage: FC = () => {
 	      {loading && label ('common:loading')}
 	    </Tab>
 	    {tags.length === 1 && (
-		<Tab name={label ('navigation:wiki')}>
+		<Tab name={label ('navigation:tagDescriptions')}>
 		  <WikiBody title={tags[0]} body={wikiPage?.body}
 		      language={wikiPage?.languageCode ?? (wikiPage?.resourceType === 'tag_description'
 			  ? localeLanguage (locale) : 'und')}/>

frontend/src/pages/wiki/WikiDetailPage.tsx

@@ -51,7 +51,8 @@ const WikiDetailPage: FC = () => {
       queryKey: helpKeys.titles ('ja'),
       queryFn: () => getHelpTitleIndex ('ja'),
       staleTime: Infinity })
-  const lookupTitle = title.trim ().normalize ('NFKC').toLowerCase ().replace (/^ヘルプ:/, '')
+  const lookupTitle = title.trim ().normalize ('NFKC').toLowerCase ()
+      .replace (/^(?:ヘルプ|手引):/, '')
   const identifiers = useMemo (() => (
       (titleIndex != null && Object.hasOwn (titleIndex, lookupTitle))
       ? titleIndex[lookupTitle] : []), [titleIndex, lookupTitle])

frontend/src/pages/wiki/WikiSearchPage.tsx

@@ -8,7 +8,7 @@ import FormField from '@/components/common/FormField'
 import PageTitle from '@/components/common/PageTitle'
 import MainArea from '@/components/layout/MainArea'
 import PageHead from '@/components/common/PageHead'
-import { apiGet } from '@/lib/api'
+import { fetchWikiPages } from '@/lib/wiki'
 import { wikiKeys } from '@/lib/queryKeys'
 import { dateString, inputClass } from '@/lib/utils'
 
@@ -17,16 +17,20 @@ import type { FormEvent , FC } from 'react'
 import type { WikiPage } from '@/types'
 
 
-const WikiSearchPage: FC = () => {
+const WikiSearchPage: FC<{ resourceType?: WikiPage['resourceType'] }> = (
+    { resourceType = 'tag_description' },
+) => {
   const { message, label } = useUITranslation ('shared')
   const locale = useLocale ()
+  const heading =
+      resourceType === 'tag_group'
+      ? 'navigation:tagGroups' : 'navigation:tagDescriptions'
   const [title, setTitle] = useState ('')
   const [text, setText] = useState ('')
   const [submittedTitle, setSubmittedTitle] = useState ('')
   const { data: results = [], refetch } = useQuery ({
-      queryKey: wikiKeys.index ({ title: submittedTitle }, locale),
-      queryFn: () => apiGet<WikiPage[]> ('/wiki', {
-	  locale, params: { title: submittedTitle } }) })
+      queryKey: wikiKeys.index ({ title: submittedTitle, resourceType }, locale),
+      queryFn: () => fetchWikiPages ({ title: submittedTitle, resourceType }, locale) })
 
   const handleSearch = (ev: FormEvent) => {
     ev.preventDefault ()
@@ -42,10 +46,10 @@ const WikiSearchPage: FC = () => {
 
   return (
       <MainArea>
-	<PageHead title={message ('navigation:wiki')}/>
+	<PageHead title={message (heading)}/>
 
 	<div className="max-w-xl">
-	  <PageTitle>{label ('navigation:wiki')}</PageTitle>
+	  <PageTitle>{label (heading)}</PageTitle>
 	  <form onSubmit={handleSearch} className="space-y-2">
 	    {/* タイトル */}
 	    <FormField label={label ('labels.title')}>