AI: address review on PR #466

backend/app/controllers/material_versions_controller.rb

@@ -5,6 +5,7 @@ class MaterialVersionsController < ApplicationController
 
     page = 1 if page < 1
     limit = 1 if limit < 1
+    limit = 100 if limit > 100
 
     offset = (page - 1) * limit
 

backend/app/controllers/materials_controller.rb

@@ -14,6 +14,7 @@ class MaterialsController < ApplicationController
 
     page = 1 if page < 1
     limit = 1 if limit < 1
+    limit = 100 if limit > 100
 
     offset = (page - 1) * limit
 

backend/app/controllers/nico_tags_controller.rb

@@ -15,6 +15,7 @@ class NicoTagsController < ApplicationController
 
     page = 1 if page < 1
     limit = 1 if limit < 1
+    limit = 100 if limit > 100
 
     post_tag_max_sql =
         PostExternalTag

backend/app/controllers/post_versions_controller.rb

@@ -11,6 +11,7 @@ class PostVersionsController < ApplicationController
 
     page = 1 if page < 1
     limit = 1 if limit < 1
+    limit = 100 if limit > 100
 
     offset = (page - 1) * limit
 

backend/app/controllers/posts_controller.rb

@@ -34,10 +34,11 @@ class PostsController < ApplicationController
 
     page = 1 if page < 1
     limit = 1 if limit < 1
+    limit = 100 if limit > 100
 
     offset = (page - 1) * limit
 
-    history_join_required = order[0] == 'updated_at' || updated_between.any?(&:present?)
+    needs_history_join = order[0] == 'updated_at' || updated_between.any?(&:present?)
 
     q =
         filtered_posts(locale)
@@ -57,8 +58,8 @@ class PostsController < ApplicationController
     q = q.where('posts.created_at >= ?', created_between[0]) if created_between[0]
     q = q.where('posts.created_at <= ?', created_between[1]) if created_between[1]
     count_scope = q
-    if history_join_required
+    if needs_history_join
-      history_times = PostVersion.all
+      history_times = HistoryAccess.visible(PostVersion.all)
           .select('post_id, MAX(created_at) AS latest_at').group(:post_id)
       q = q.joins("LEFT JOIN (#{ history_times.to_sql }) history_times " +
                   'ON history_times.post_id = posts.id')
@@ -72,7 +73,7 @@ class PostsController < ApplicationController
       q = q.where("#{ updated_at_all_sql } <= ?", updated_between[1])
     end
     count_scope = q if updated_between.any?(&:present?)
-    if history_join_required
+    if needs_history_join
       q = q.select('posts.*', "#{ updated_at_all_sql } AS updated_at")
     end
 
@@ -92,10 +93,10 @@ class PostsController < ApplicationController
              .offset(offset)
              .to_a
     latest_version_times =
-        if history_join_required
+        if needs_history_join
           { }
         else
-          PostVersion.where(post_id: posts.map(&:id))
+          HistoryAccess.visible(PostVersion.where(post_id: posts.map(&:id)))
               .group(:post_id).maximum(:created_at)
         end
 

backend/app/controllers/tag_descriptions_controller.rb

@@ -49,6 +49,7 @@ class TagDescriptionsController < ApplicationController
   private
 
   def representation description
+    HistoryAccess.require_current!(description, TagDescriptionVersion)
     description.as_json(only: [
         :tag_id,
         :language_code,

backend/app/controllers/tag_groups_controller.rb

@@ -1,7 +1,7 @@
 class TagGroupsController < ApplicationController
   def index
     locale = resolve_locale!
-    groups = TagGroup.includes(:created_by_user, :updated_by_user).order(:id)
+    groups = HistoryAccess.current(TagGroup.all, TagGroupVersion).includes(:created_by_user, :updated_by_user).order(:id)
     render json: TagGroupRepr.many(locale, groups.to_a)
   end
 

backend/app/controllers/tag_versions_controller.rb

@@ -7,6 +7,7 @@ class TagVersionsController < ApplicationController
 
     page = 1 if page < 1
     limit = 1 if limit < 1
+    limit = 100 if limit > 100
 
     offset = (page - 1) * limit
 

backend/app/controllers/tags_controller.rb

@@ -33,6 +33,7 @@ class TagsController < ApplicationController
 
     page = 1 if page < 1
     limit = 1 if limit < 1
+    limit = 100 if limit > 100
 
     offset = (page - 1) * limit
 

backend/app/controllers/theatre_comments_controller.rb

@@ -2,6 +2,7 @@ class TheatreCommentsController < ApplicationController
   def index
     limit = params[:limit].to_i
     limit = 20 if limit <= 0
+    limit = 100 if limit > 100
 
     no_gt = params[:no_gt].to_i
     no_gt = 0 if no_gt < 0
@@ -9,6 +10,7 @@ class TheatreCommentsController < ApplicationController
     comments = TheatreComment
                .where(theatre_id: params[:theatre_id])
                .where('no > ?', no_gt)
+               .includes(:user)
                .order(no: :desc)
                .limit(limit)
 

backend/app/controllers/theatre_programmes_controller.rb

@@ -2,6 +2,7 @@ class TheatreProgrammesController < ApplicationController
   def index
     limit = params[:limit].to_i
     limit = 100 if limit <= 0
+    limit = 100 if limit > 100
 
     position_gt = params[:position_gt].to_i
     position_gt = 0 if position_gt < 0
@@ -10,7 +11,7 @@ class TheatreProgrammesController < ApplicationController
                  .where(theatre_id: params[:theatre_id])
                  .where('position > ?', position_gt)
                  .includes(:post)
-                 .order(position: :desc).limit(100)
+                 .order(position: :desc)
                  .limit(limit)
 
     render json: programmes.map { |programme|

backend/app/controllers/theatre_skip_events_controller.rb

@@ -2,6 +2,7 @@ class TheatreSkipEventsController < ApplicationController
   def index
     limit = params[:limit].to_i
     limit = 50 if limit <= 0
+    limit = 100 if limit > 100
 
     events =
         TheatreSkipEvent

backend/app/controllers/wiki_pages_controller.rb

@@ -8,11 +8,12 @@ class WikiPagesController < ApplicationController
 
     title = params[:title].to_s.strip
     descriptions =
-        TagDescription.where(language_code: locale.language_code)
+        HistoryAccess.current(TagDescription.all, TagDescriptionVersion)
+        .where(language_code: locale.language_code)
         .includes(tag: :tag_names)
 
     descriptions = descriptions.order(updated_at: :desc, id: :asc)
-    tag_groups = TagGroup.order(updated_at: :desc, id: :asc)
+    tag_groups = HistoryAccess.current(TagGroup.all, TagGroupVersion).order(updated_at: :desc, id: :asc)
     if title.present?
       pattern = "%#{ ApplicationRecord.sanitize_sql_like(title) }%"
       descriptions =
@@ -40,13 +41,13 @@ class WikiPagesController < ApplicationController
     return head :not_found unless language.is_a?(String)
     return head :not_found unless Language.exists?(code: language)
 
-    names = TagDescription.joins(tag: :tag_names)
+    names = HistoryAccess.current(TagDescription.all, TagDescriptionVersion).joins(tag: :tag_names)
         .where(language_code: locale.language_code, tag_names: { language_code: language })
         .pluck('tag_descriptions.tag_id', 'tag_descriptions.id', 'tag_names.name')
     candidates = names.map do |tag_id, description_id, name|
       WikiPageRepr.autolink_tag(locale, tag_id:, description_id:, name:, language:)
     end
-    candidates.concat(TagGroup.order(:id).pluck(:id, :name).map do |id, name|
+    candidates.concat(HistoryAccess.current(TagGroup.all, TagGroupVersion).order(:id).pluck(:id, :name).map do |id, name|
       WikiPageRepr.autolink_group(locale, id:, name:, language:)
     end)
     render json: candidates
@@ -410,7 +411,7 @@ class WikiPagesController < ApplicationController
   end
 
   def tag_description_by_title locale, title
-    TagDescription.joins(tag: :tag_names)
+    HistoryAccess.current(TagDescription.all, TagDescriptionVersion).joins(tag: :tag_names)
         .find_by(language_code: locale.language_code,
                  tag_names: { language_code: locale.language_code, name: title })
   end

backend/app/models/history_access.rb

@@ -147,6 +147,29 @@ class HistoryAccess < ActiveSupport::CurrentAttributes
     scope.where(Arel.sql(sql(scope.klass, row)))
   end
 
+  def self.current(scope, version_model)
+    return scope if admin?
+
+    table = scope.klass.table_name
+    keys = KEYS.fetch(version_model.table_name)
+    matches = keys.map do |key|
+      column = scope.klass.column_names.include?(key) ? key : 'id'
+      "current_snapshot.#{ key } = #{ table }.#{ column }"
+    end.join(' AND ')
+    boundary = "#{ matches } AND current_snapshot.version_no >= #{ table }.version_no " +
+        "AND current_snapshot.event_type = 'discard'"
+    scope = scope.where(Arel.sql("NOT EXISTS (SELECT 1 FROM #{ version_model.table_name } " +
+        "current_snapshot WHERE #{ boundary })"))
+    condition = "#{ matches } AND current_snapshot.version_no = #{ table }.version_no"
+    scope.where(Arel.sql("NOT EXISTS (SELECT 1 FROM #{ version_model.table_name } " +
+        "current_snapshot WHERE #{ condition } AND NOT (#{ sql(version_model, 'current_snapshot') }))"))
+  end
+
+  def self.require_current!(record, version_model)
+    return if admin?
+    raise Forbidden unless current(record.class.where(id: record.id), version_model).exists?
+  end
+
   def self.blob_visible?(blob, seen = [])
     return true if admin?
     return false if seen.include?(blob.id)

backend/app/representations/tag_group_repr.rb

@@ -44,6 +44,7 @@ module TagGroupRepr
   end
 
   def one locale, group
+    HistoryAccess.require_current!(group, TagGroupVersion)
     many(locale, [group]).first
   end
 

backend/app/representations/wiki_page_repr.rb

@@ -5,6 +5,7 @@ module WikiPageRepr
   module_function
 
   def tag_description locale, description
+    HistoryAccess.require_current!(description, TagDescriptionVersion)
     tag = description.tag
 
     { 'id' => description.id,

backend/spec/requests/counts_history_boundaries_spec.rb

@@ -14,7 +14,7 @@ RSpec.describe 'History boundaries shared with Counts', type: :request do
     end
   end
 
-  it 'keeps discarded history private while exposing the current description' do
+  it 'denies the same discarded description through Counts, the facade and the ordinary API' do
     get '/counts/query', params: { resource: 'tag_descriptions', definition: 'history',
         mode: 'details', locale: 'ja', execution_at: '2025-01-01T00:00:00Z' }
     expect(response).to have_http_status(:ok)
@@ -22,8 +22,8 @@ RSpec.describe 'History boundaries shared with Counts', type: :request do
         'excluded_count' => 2, 'versions' => [])
     ["/wiki/#{ description.id }", "/tags/#{ tag.id }/description"].each do |path|
       get path, params: { locale: 'ja' }
-      expect(response).to have_http_status(:ok)
+      expect(response).to have_http_status(:not_found)
-      expect(response.parsed_body.fetch('body')).to eq(description.body)
+      expect(response.body).not_to include('private body')
     end
     get '/sitemap_entries/descriptions', params: { locale: 'ja' }
     expect(response).to have_http_status(:ok)

backend/spec/requests/list_limits_spec.rb

@@ -0,0 +1,174 @@
+require 'rails_helper'
+
+RSpec.describe 'List API limits', type: :request do
+  shared_examples 'a capped list' do |default_count, minimum_count, paginated|
+    def response_rows
+      body = json
+      body.is_a?(Array) ? body : body.fetch(collection_key)
+    end
+
+    it 'caps oversized limits at 100 and preserves the 100 boundary' do
+      get path, params: { locale: 'ja', limit: 100 }
+      expect(response).to have_http_status(:ok)
+      expect(response_rows.size).to eq(100)
+      boundary_rows = response_rows
+
+      [101, 10_000].each do |limit|
+        get path, params: { locale: 'ja', limit: }
+        expect(response).to have_http_status(:ok)
+        expect(response_rows).to eq(boundary_rows)
+      end
+    end
+
+    it 'preserves the default, nonpositive and small positive limits' do
+      get path, params: { locale: 'ja' }
+      expect(response).to have_http_status(:ok)
+      expect(response_rows.size).to eq(default_count)
+
+      [0, -1].each do |limit|
+        get path, params: { locale: 'ja', limit: }
+        expect(response).to have_http_status(:ok)
+        expect(response_rows.size).to eq(minimum_count)
+      end
+
+      get path, params: { locale: 'ja', limit: 2 }
+      expect(response).to have_http_status(:ok)
+      expect(response_rows.size).to eq(2)
+    end
+
+    if paginated
+      it 'uses the capped limit for page offsets and preserves total count' do
+        get path, params: { locale: 'ja', limit: 100 }
+        first_page = response_rows
+        expect(response).to have_http_status(:ok)
+        expect(json.fetch('count')).to eq(101)
+
+        get path, params: { locale: 'ja', limit: 100, page: 2 }
+        expect(response).to have_http_status(:ok)
+        expect(response_rows.size).to eq(1)
+        second_page = response_rows
+        expect(first_page & second_page).to be_empty
+
+        get path, params: { locale: 'ja', limit: 101, page: 2 }
+        expect(response).to have_http_status(:ok)
+        expect(response_rows).to eq(second_page)
+        expect(json.fetch('count')).to eq(101)
+      end
+    end
+  end
+
+  context 'posts' do
+    let(:path) { '/posts' }
+    let(:collection_key) { 'posts' }
+    before { create_list(:post, 101) }
+
+    include_examples 'a capped list', 20, 1, true
+  end
+
+  context 'tags' do
+    let(:path) { '/tags' }
+    let(:collection_key) { 'tags' }
+    before { create_list(:tag, 101) }
+
+    include_examples 'a capped list', 20, 1, true
+  end
+
+  context 'nico tags' do
+    let(:path) { '/tags/nico' }
+    let(:collection_key) { 'tags' }
+    before { create_list(:external_tag, 101) }
+
+    include_examples 'a capped list', 20, 1, true
+  end
+
+  context 'materials' do
+    let(:path) { '/materials' }
+    let(:collection_key) { 'materials' }
+    before do
+      101.times { |index| Material.create!(url: "https://example.com/material-#{ index }") }
+    end
+
+    include_examples 'a capped list', 20, 1, true
+  end
+
+  context 'post versions' do
+    let(:path) { '/posts/versions' }
+    let(:collection_key) { 'versions' }
+    let(:post) { create(:post) }
+    before do
+      101.times do |index|
+        PostVersion.create!(post:, version_no: index + 1, event_type: 'update',
+                            url: post.url, tags: '', tags_json: [], parent_post_ids: '')
+      end
+    end
+
+    include_examples 'a capped list', 20, 1, true
+  end
+
+  context 'tag versions' do
+    let(:path) { '/tags/versions' }
+    let(:collection_key) { 'versions' }
+    let(:tag) { create(:tag) }
+    before do
+      101.times do |index|
+        TagVersion.create!(tag:, version_no: index + 1, event_type: 'update',
+                           name: 'limit tag', category: 'general', aliases: '',
+                           parent_tag_ids: '', names: {
+                               ja: { name: 'limit tag', script_code: 'Jpan',
+                                     auto_generated: false, aliases: [] } })
+      end
+    end
+
+    include_examples 'a capped list', 20, 1, true
+  end
+
+  context 'material versions' do
+    let(:path) { '/materials/versions' }
+    let(:collection_key) { 'versions' }
+    let(:material) { Material.create!(url: 'https://example.com/material') }
+    before do
+      101.times do |index|
+        MaterialVersion.create!(material:, version_no: index + 1,
+                                event_type: 'update', url: material.url)
+      end
+    end
+
+    include_examples 'a capped list', 20, 1, true
+  end
+
+  context 'theatre lists' do
+    let(:theatre) { create(:theatre) }
+    let(:post) { create(:post) }
+
+    context 'comments' do
+      let(:path) { "/theatres/#{ theatre.id }/comments" }
+      before { create_list(:theatre_comment, 101, theatre:, user: theatre.created_by_user) }
+
+      include_examples 'a capped list', 20, 20, false
+    end
+
+    context 'programmes' do
+      let(:path) { "/theatres/#{ theatre.id }/programmes" }
+      before do
+        101.times do |index|
+          TheatreProgramme.create!(theatre:, post:, position: index + 1)
+        end
+      end
+
+      include_examples 'a capped list', 100, 100, false
+    end
+
+    context 'skip events' do
+      let(:path) { "/theatres/#{ theatre.id }/skip_events" }
+      before do
+        101.times do |index|
+          TheatreSkipEvent.create!(theatre:, post:,
+                                   skipped_by_user: theatre.created_by_user,
+                                   created_at: Time.utc(2026, 1, 1) + index.seconds)
+        end
+      end
+
+      include_examples 'a capped list', 50, 50, false
+    end
+  end
+end

backend/spec/requests/post_history_privacy_spec.rb

@@ -69,38 +69,40 @@ RSpec.describe 'Post history privacy', type: :request do
         sign_in_as(create(:user, role.to_sym)) unless role == 'anonymous'
       end
 
-      it 'uses the latest version timestamp for display regardless of role' do
+      it 'uses only authorised history timestamps for display' do
         get '/posts'
         expect(response).to have_http_status(:ok)
         row = response.parsed_body.fetch('posts').find { _1.fetch('id') == post_record.id }
-        expected = origin + 4.days
+        expected = origin + (role == 'admin' ? 4 : 3).days
         expect(Time.zone.parse(row.fetch('updated_at'))).to eq(expected)
       end
 
-      it 'uses the latest version timestamp for date bounds and count regardless of role' do
+      it 'uses the same visibility for date bounds and count' do
         get '/posts', params: { updated_from: (origin + 4.days).iso8601,
                                 updated_to: (origin + 4.days).iso8601 }
         expect(response).to have_http_status(:ok)
         ids = response.parsed_body.fetch('posts').pluck('id')
-        expect(ids).to eq([post_record.id])
+        expect(ids).to eq(role == 'admin' ? [post_record.id] : [])
         expect(response.parsed_body.fetch('count')).to eq(ids.length)
       end
 
-      it 'sorts using the latest version timestamps in both directions regardless of role' do
+      it 'sorts using authorised timestamps in both directions' do
         ['asc', 'desc'].each do |direction|
           get '/posts', params: { order: "updated_at:#{ direction }" }
           expect(response).to have_http_status(:ok)
-          expected = [other_post.id, post_record.id]
+          expected = role == 'admin' ? [other_post.id, post_record.id] :
+              [post_record.id, other_post.id]
           expected.reverse! if direction == 'desc'
           expect(response.parsed_body.fetch('posts').pluck('id')).to eq(expected)
         end
       end
 
-      it 'applies latest version timestamp ordering before pagination regardless of role' do
+      it 'applies authorised timestamp ordering before pagination' do
         get '/posts', params: { order: 'updated_at:desc', limit: 1 }
 
         expect(response).to have_http_status(:ok)
-        expect(response.parsed_body.fetch('posts').pluck('id')).to eq([post_record.id])
+        expected = role == 'admin' ? post_record.id : other_post.id
+        expect(response.parsed_body.fetch('posts').pluck('id')).to eq([expected])
         expect(response.parsed_body.fetch('count')).to eq(2)
       end