AI: address issue #447

backend/app/controllers/posts_controller.rb

@@ -37,7 +37,7 @@ class PostsController < ApplicationController
 
     offset = (page - 1) * limit
 
-    history_join_required = order[0] == 'updated_at' || updated_between.any?(&:present?)
+    needs_history_join = order[0] == 'updated_at' || updated_between.any?(&:present?)
 
     q =
         filtered_posts(locale)
@@ -57,8 +57,8 @@ class PostsController < ApplicationController
     q = q.where('posts.created_at >= ?', created_between[0]) if created_between[0]
     q = q.where('posts.created_at <= ?', created_between[1]) if created_between[1]
     count_scope = q
-    if history_join_required
-      history_times = PostVersion.all
+    if needs_history_join
+      history_times = HistoryAccess.visible(PostVersion.all)
           .select('post_id, MAX(created_at) AS latest_at').group(:post_id)
       q = q.joins("LEFT JOIN (#{ history_times.to_sql }) history_times " +
                   'ON history_times.post_id = posts.id')
@@ -72,7 +72,7 @@ class PostsController < ApplicationController
       q = q.where("#{ updated_at_all_sql } <= ?", updated_between[1])
     end
     count_scope = q if updated_between.any?(&:present?)
-    if history_join_required
+    if needs_history_join
       q = q.select('posts.*', "#{ updated_at_all_sql } AS updated_at")
     end
 
@@ -92,10 +92,10 @@ class PostsController < ApplicationController
              .offset(offset)
              .to_a
     latest_version_times =
-        if history_join_required
+        if needs_history_join
           { }
         else
-          PostVersion.where(post_id: posts.map(&:id))
+          HistoryAccess.visible(PostVersion.where(post_id: posts.map(&:id)))
               .group(:post_id).maximum(:created_at)
         end
 

backend/app/controllers/tag_descriptions_controller.rb

@@ -49,6 +49,7 @@ class TagDescriptionsController < ApplicationController
   private
 
   def representation description
+    HistoryAccess.require_current!(description, TagDescriptionVersion)
     description.as_json(only: [
         :tag_id,
         :language_code,

backend/app/controllers/tag_groups_controller.rb

@@ -1,7 +1,7 @@
 class TagGroupsController < ApplicationController
   def index
     locale = resolve_locale!
-    groups = TagGroup.includes(:created_by_user, :updated_by_user).order(:id)
+    groups = HistoryAccess.current(TagGroup.all, TagGroupVersion).includes(:created_by_user, :updated_by_user).order(:id)
     render json: TagGroupRepr.many(locale, groups.to_a)
   end
 

backend/app/controllers/wiki_pages_controller.rb

@@ -8,11 +8,12 @@ class WikiPagesController < ApplicationController
 
     title = params[:title].to_s.strip
     descriptions =
-        TagDescription.where(language_code: locale.language_code)
+        HistoryAccess.current(TagDescription.all, TagDescriptionVersion)
+        .where(language_code: locale.language_code)
         .includes(tag: :tag_names)
 
     descriptions = descriptions.order(updated_at: :desc, id: :asc)
-    tag_groups = TagGroup.order(updated_at: :desc, id: :asc)
+    tag_groups = HistoryAccess.current(TagGroup.all, TagGroupVersion).order(updated_at: :desc, id: :asc)
     if title.present?
       pattern = "%#{ ApplicationRecord.sanitize_sql_like(title) }%"
       descriptions =
@@ -40,13 +41,13 @@ class WikiPagesController < ApplicationController
     return head :not_found unless language.is_a?(String)
     return head :not_found unless Language.exists?(code: language)
 
-    names = TagDescription.joins(tag: :tag_names)
+    names = HistoryAccess.current(TagDescription.all, TagDescriptionVersion).joins(tag: :tag_names)
         .where(language_code: locale.language_code, tag_names: { language_code: language })
         .pluck('tag_descriptions.tag_id', 'tag_descriptions.id', 'tag_names.name')
     candidates = names.map do |tag_id, description_id, name|
       WikiPageRepr.autolink_tag(locale, tag_id:, description_id:, name:, language:)
     end
-    candidates.concat(TagGroup.order(:id).pluck(:id, :name).map do |id, name|
+    candidates.concat(HistoryAccess.current(TagGroup.all, TagGroupVersion).order(:id).pluck(:id, :name).map do |id, name|
       WikiPageRepr.autolink_group(locale, id:, name:, language:)
     end)
     render json: candidates
@@ -410,7 +411,7 @@ class WikiPagesController < ApplicationController
   end
 
   def tag_description_by_title locale, title
-    TagDescription.joins(tag: :tag_names)
+    HistoryAccess.current(TagDescription.all, TagDescriptionVersion).joins(tag: :tag_names)
         .find_by(language_code: locale.language_code,
                  tag_names: { language_code: locale.language_code, name: title })
   end

backend/app/models/history_access.rb

@@ -147,6 +147,29 @@ class HistoryAccess < ActiveSupport::CurrentAttributes
     scope.where(Arel.sql(sql(scope.klass, row)))
   end
 
+  def self.current(scope, version_model)
+    return scope if admin?
+
+    table = scope.klass.table_name
+    keys = KEYS.fetch(version_model.table_name)
+    matches = keys.map do |key|
+      column = scope.klass.column_names.include?(key) ? key : 'id'
+      "current_snapshot.#{ key } = #{ table }.#{ column }"
+    end.join(' AND ')
+    boundary = "#{ matches } AND current_snapshot.version_no >= #{ table }.version_no " +
+        "AND current_snapshot.event_type = 'discard'"
+    scope = scope.where(Arel.sql("NOT EXISTS (SELECT 1 FROM #{ version_model.table_name } " +
+        "current_snapshot WHERE #{ boundary })"))
+    condition = "#{ matches } AND current_snapshot.version_no = #{ table }.version_no"
+    scope.where(Arel.sql("NOT EXISTS (SELECT 1 FROM #{ version_model.table_name } " +
+        "current_snapshot WHERE #{ condition } AND NOT (#{ sql(version_model, 'current_snapshot') }))"))
+  end
+
+  def self.require_current!(record, version_model)
+    return if admin?
+    raise Forbidden unless current(record.class.where(id: record.id), version_model).exists?
+  end
+
   def self.blob_visible?(blob, seen = [])
     return true if admin?
     return false if seen.include?(blob.id)

backend/app/representations/tag_group_repr.rb

@@ -44,6 +44,7 @@ module TagGroupRepr
   end
 
   def one locale, group
+    HistoryAccess.require_current!(group, TagGroupVersion)
     many(locale, [group]).first
   end
 

backend/app/representations/wiki_page_repr.rb

@@ -5,6 +5,7 @@ module WikiPageRepr
   module_function
 
   def tag_description locale, description
+    HistoryAccess.require_current!(description, TagDescriptionVersion)
     tag = description.tag
 
     { 'id' => description.id,

backend/app/services/counts_candidates.rb

@@ -6,8 +6,14 @@ class CountsCandidates
 
   def initialize(params)
     QueryState.validate!(params, KEYS)
-    raise ArgumentError unless params.fetch('resource') == 'posts'
-    raise ArgumentError unless ['tags', 'tags_json'].include?(params.fetch('field'))
+    definition = CountsResourceDefinition.new(params.fetch('resource'))
+    fields = ['resource_id', 'user']
+    fields += ['tags', 'tags_json', 'tags.id'] if definition.resource == 'posts'
+    fields << 'members' if definition.resource == 'tag_groups'
+    if definition.resource == 'materials'
+      fields += ['updated_by_user_id', 'file_blob_id', 'source_file_id', 'drive_file_id']
+    end
+    raise ArgumentError unless fields.include?(params.fetch('field'))
 
     @params = params
     @page = Integer(params.fetch('page', '1'), 10)
@@ -18,25 +24,27 @@ class CountsCandidates
   end
 
   def call
+    references = ['tags', 'tags_json', 'tags.id', 'members']
+    return resource_candidates unless references.include?(@params['field'])
+
     options = @params.slice('locale', 'at', 'execution_at', 'timezone')
         .merge('definition' => 'latest', 'resource' => 'tags')
     internal = CountsPopulation.new(options)
-    external = CountsPopulation.new(options.merge('resource' => 'nico_tags',
+    groups_flg = @params['field'] == 'members'
+    external = CountsPopulation.new(options.merge(
+        'resource' => groups_flg ? 'tag_groups' : 'nico_tags',
         'execution_at' => internal.at.iso8601(6)))
     connection = TagVersion.connection
     sources = [[internal, 'internal', 'v.category', 'v.names'],
-               [external, 'external', 'NULL', 'JSON_OBJECT()']]
+        [external, groups_flg ? 'group' : 'external', 'NULL', 'JSON_OBJECT()']]
     sources = sources.map do |population, kind, category, names|
       scope = population.scope.except(:select)
-      if @params['query'].present?
-        pattern = "%#{ ApplicationRecord.sanitize_sql_like(@params['query']) }%"
-        scope = scope.where("(v.name LIKE ? OR CAST(v.tag_id AS CHAR) = ? OR EXISTS (" +
-            "SELECT 1 FROM JSON_TABLE(COALESCE(JSON_EXTRACT(#{ names }, '$**.name'), " +
-            "JSON_ARRAY()), '$[*]' COLUMNS (name TEXT PATH '$')) candidate_name " +
-            'WHERE candidate_name.name LIKE ?))', pattern, @params['query'], pattern)
-      end
+      identity = "v.#{ population.definition.keys.first }"
+      scope = search(scope, identity, 'v.name', names)
+      value = ['tags.id', 'members'].include?(@params['field']) ?
+          "CAST(#{ identity } AS CHAR)" : "CONCAT('#{ kind }:', #{ identity })"
       scope.select(Arel.sql(
-          "CONCAT('#{ kind }:', v.tag_id) AS value, v.tag_id AS id, " +
+          "#{ value } AS value, #{ identity } AS id, " +
           "v.name AS name, #{ names } AS names, #{ category } AS category, '#{ kind }' AS kind"))
           .to_sql
     end
@@ -55,4 +63,63 @@ class CountsCandidates
     { rows: rows.first(LIMIT), page: @page, more: rows.length > LIMIT,
       execution_at: internal.at.iso8601(6) }
   end
+
+  private
+
+  def search(scope, identity, name, names)
+    return scope if @params['query'].blank?
+
+    pattern = "%#{ ApplicationRecord.sanitize_sql_like(@params['query']) }%"
+    scope.where("(#{ name } LIKE ? OR CAST(#{ identity } AS CHAR) = ? OR EXISTS (" +
+        "SELECT 1 FROM JSON_TABLE(COALESCE(JSON_EXTRACT(#{ names }, '$**.name'), " +
+        "JSON_ARRAY()), '$[*]' COLUMNS (name TEXT PATH '$')) candidate_name " +
+        'WHERE candidate_name.name LIKE ?))', pattern, @params['query'], pattern)
+  end
+
+  def resource_candidates
+    options = @params.slice('at', 'execution_at', 'timezone')
+        .merge('resource' => @params.fetch('resource'), 'definition' => 'latest')
+    actor_flg = ['user', 'updated_by_user_id'].include?(@params['field'])
+    options['definition'] = 'history' if actor_flg
+    population = CountsPopulation.new(options)
+    scope = population.scope.except(:select)
+    if actor_flg
+      point = population.timestamp(@params['at']) || population.at
+      raise ArgumentError if point > population.at
+
+      column = @params['field'] == 'user' ? 'created_by_user_id' : 'updated_by_user_id'
+      identities = scope.where('v.created_at <= ?', point).select("v.#{ column }")
+      scope = User.where(id: identities)
+      identity = 'users.id'
+      name = 'users.name'
+      names = 'JSON_OBJECT()'
+    else
+      definition = population.definition
+      column = @params['field'] == 'resource_id' ? definition.keys.first : @params['field']
+      if column == 'drive_file_id'
+        column = 'source_file_id'
+        scope = scope.where('v.source_kind' => 'google_drive_file')
+      end
+      identity = "v.#{ column }"
+      label = ['title', 'name', 'url'].find { definition.fields.key?(_1) }
+      name = label ? "v.#{ label }" : 'NULL'
+      names = definition.resource == 'tags' ? 'v.names' : 'JSON_OBJECT()'
+      if ['file_blob_id', 'source_file_id', 'drive_file_id'].include?(@params['field'])
+        scope = scope.where.not("v.#{ column }" => nil).group(Arel.sql(identity))
+        name = 'v.file_filename'
+      end
+    end
+    scope = search(scope, identity, name, names)
+    title = ['file_blob_id', 'source_file_id', 'drive_file_id'].include?(@params['field']) ?
+        "MIN(#{ name })" : name
+    query = scope.optimizer_hints('MAX_EXECUTION_TIME(10000)').distinct
+        .select(Arel.sql("#{ identity } AS id, #{ title } AS name, #{ names } AS names"))
+        .order(Arel.sql(identity)).limit(LIMIT + 1).offset((@page - 1) * LIMIT)
+    rows = scope.klass.connection.select_all(query.to_sql).to_a.map do |values|
+      values['names'] = JSON.parse(values['names']) if values['names'].is_a?(String)
+      values.merge('value' => values.fetch('id').to_s)
+    end
+    { rows: rows.first(LIMIT), page: @page, more: rows.length > LIMIT,
+      execution_at: population.at.iso8601(6) }
+  end
 end

backend/spec/requests/counts_history_boundaries_spec.rb

@@ -14,7 +14,7 @@ RSpec.describe 'History boundaries shared with Counts', type: :request do
     end
   end
 
-  it 'keeps discarded history private while exposing the current description' do
+  it 'denies the same discarded description through Counts, the facade and the ordinary API' do
     get '/counts/query', params: { resource: 'tag_descriptions', definition: 'history',
         mode: 'details', locale: 'ja', execution_at: '2025-01-01T00:00:00Z' }
     expect(response).to have_http_status(:ok)
@@ -22,8 +22,8 @@ RSpec.describe 'History boundaries shared with Counts', type: :request do
         'excluded_count' => 2, 'versions' => [])
     ["/wiki/#{ description.id }", "/tags/#{ tag.id }/description"].each do |path|
       get path, params: { locale: 'ja' }
-      expect(response).to have_http_status(:ok)
-      expect(response.parsed_body.fetch('body')).to eq(description.body)
+      expect(response).to have_http_status(:not_found)
+      expect(response.body).not_to include('private body')
     end
     get '/sitemap_entries/descriptions', params: { locale: 'ja' }
     expect(response).to have_http_status(:ok)

backend/spec/requests/post_history_privacy_spec.rb

@@ -69,38 +69,40 @@ RSpec.describe 'Post history privacy', type: :request do
         sign_in_as(create(:user, role.to_sym)) unless role == 'anonymous'
       end
 
-      it 'uses the latest version timestamp for display regardless of role' do
+      it 'uses only authorised history timestamps for display' do
         get '/posts'
         expect(response).to have_http_status(:ok)
         row = response.parsed_body.fetch('posts').find { _1.fetch('id') == post_record.id }
-        expected = origin + 4.days
+        expected = origin + (role == 'admin' ? 4 : 3).days
         expect(Time.zone.parse(row.fetch('updated_at'))).to eq(expected)
       end
 
-      it 'uses the latest version timestamp for date bounds and count regardless of role' do
+      it 'uses the same visibility for date bounds and count' do
         get '/posts', params: { updated_from: (origin + 4.days).iso8601,
                                 updated_to: (origin + 4.days).iso8601 }
         expect(response).to have_http_status(:ok)
         ids = response.parsed_body.fetch('posts').pluck('id')
-        expect(ids).to eq([post_record.id])
+        expect(ids).to eq(role == 'admin' ? [post_record.id] : [])
         expect(response.parsed_body.fetch('count')).to eq(ids.length)
       end
 
-      it 'sorts using the latest version timestamps in both directions regardless of role' do
+      it 'sorts using authorised timestamps in both directions' do
         ['asc', 'desc'].each do |direction|
           get '/posts', params: { order: "updated_at:#{ direction }" }
           expect(response).to have_http_status(:ok)
-          expected = [other_post.id, post_record.id]
+          expected = role == 'admin' ? [other_post.id, post_record.id] :
+              [post_record.id, other_post.id]
           expected.reverse! if direction == 'desc'
           expect(response.parsed_body.fetch('posts').pluck('id')).to eq(expected)
         end
       end
 
-      it 'applies latest version timestamp ordering before pagination regardless of role' do
+      it 'applies authorised timestamp ordering before pagination' do
         get '/posts', params: { order: 'updated_at:desc', limit: 1 }
 
         expect(response).to have_http_status(:ok)
-        expect(response.parsed_body.fetch('posts').pluck('id')).to eq([post_record.id])
+        expected = role == 'admin' ? post_record.id : other_post.id
+        expect(response.parsed_body.fetch('posts').pluck('id')).to eq([expected])
         expect(response.parsed_body.fetch('count')).to eq(2)
       end
 

frontend/src/components/PostEditForm.tsx

@@ -1,5 +1,6 @@
 import { useEffect, useMemo, useState } from 'react'
 
+import ResourcePickerButton from '@/components/common/ResourcePickerButton'
 import { useLocale } from '@/lib/useLocale'
 import PostOriginalCreatedTimeField from '@/components/PostOriginalCreatedTimeField'
 import FieldError from '@/components/common/FieldError'
@@ -184,7 +185,12 @@ const PostEditForm: FC<Props> = ({ post, onSave }) => {
 	    value={parentPostIds}
 	    disabled={disabled}
 	    errors={fieldErrors.parentPostIds}
-	    onChange={setParentPostIds}/>
+	    onChange={setParentPostIds}
+	    after={<ResourcePickerButton
+		source={{ resource: 'posts', field: 'resource_id' }}
+		values={parentPostIds.split (/\s+/).filter (Boolean)}
+		maximum={Number.MAX_SAFE_INTEGER} disabled={disabled}
+		onSelect={values => setParentPostIds (values.join (' '))}/>}/>
 
 	<PostTagsField
 	    disabled={disabled}

frontend/src/components/common/CandidatePicker.tsx

@@ -10,16 +10,19 @@ import { useUITranslation } from '@/lib/useUITranslation'
 import { inputClass } from '@/lib/utils'
 
 import type { DialogueFormControls } from '@/lib/dialogues/useDialogue'
-import type { CountsCandidate, CountsDefinition, CountsFieldMetadata }
-    from '@/lib/countsDefinitions'
+import type { CountsResource } from '@/lib/counts'
+import type { CountsCandidate } from '@/lib/countsDefinitions'
 
 
-const CountsCandidatePicker = (
-    { field, definition, params, initial, maximum, controls, save }: {
-	field: CountsFieldMetadata; params: URLSearchParams
-	definition: CountsDefinition
+type CandidateSource = {
+    resource: CountsResource; field: string; params?: URLSearchParams }
+
+const CandidatePicker = (
+    { source, choices = [], categories = [], initial, maximum, controls, onSelect }: {
+	source?: CandidateSource; choices?: CountsCandidate[]
+	categories?: { value: string; label: string }[]
 	initial: (string | number | boolean)[]; maximum: number
-	controls: DialogueFormControls; save: (values: string[]) => void },
+	controls: DialogueFormControls; onSelect: (values: string[]) => void },
 ) => {
   const { label, message } = useUITranslation ('counts')
   const locale = useLocale ()
@@ -29,49 +32,58 @@ const CountsCandidatePicker = (
   const [search, setSearch] = useState ('')
   const [category, setCategory] = useState ('')
   const [page, setPage] = useState (1)
+  const params = source?.params ?? new URLSearchParams ()
   const point = useRef (params.get ('execution_at'))
-  const request = new URLSearchParams ({ field: field.key, query: search, page: String (page) })
+  const resource = source?.resource ?? 'posts'
+  const request = new URLSearchParams ({
+      field: source?.field ?? '', query: search, page: String (page) })
   for (const key of ['timezone', 'at', 'execution_at'])
     if (params.has (key)) request.set (key, params.get (key)!)
   if (countsUseLatest (params)) request.delete ('at')
   if (category) request.set ('category', category)
-  const dynamic = field.candidateSource === 'tags'
+  const dynamic = source != null
   const { data, isFetching: fetching, isError: errorFlg } = useQuery ({
-      queryKey: countsKeys.candidates (request.toString (), locale), enabled: dynamic,
+      queryKey: countsKeys.candidates (resource, request.toString (), locale), enabled: dynamic,
       queryFn: ({ signal }) => {
 	const pinned = new URLSearchParams (request)
 	if (point.current != null) pinned.set ('execution_at', point.current)
-	return fetchCountsCandidates (pinned, locale, signal)
-      }, retry: false })
+	return fetchCountsCandidates (resource, pinned, locale, signal)
+      }, retry: false, staleTime: 0, gcTime: 0 })
   useEffect (() => {
     if (data != null) point.current = data.executionAt
   }, [data])
   useEffect (() => {
     controls.setActions ([{ label: label ('counts:pattern.selection'),
-	onSelect: () => save ([...selected]) }])
-  }, [controls, label, save, selected])
-  const fixed: CountsCandidate[] = (field.choices ?? []).map (choice => ({
-      value: choice.value, name: message (choice.label).text }))
-  const rows = dynamic ? data?.rows ?? [] : fixed.filter (row =>
+	onSelect: () => onSelect ([...selected]) }])
+  }, [controls, label, onSelect, selected])
+  const rows = dynamic ? data?.rows ?? [] : choices.filter (row =>
       row.name?.includes (search))
   const headings: Record<string, string> = {
       id: 'columns.resourceId', name: 'columns.name', category: 'common:categoryLabel',
       kind: 'columns.kind' }
-  const available = dynamic ? ['id', 'name', 'category', 'kind'] : ['name']
+  const referenceFlg = ['tags', 'tags_json', 'tags.id', 'members'].includes (source?.field ?? '')
+  const available =
+      dynamic
+      ? (referenceFlg ? ['id', 'name', 'category', 'kind'] : ['id', 'name']) : ['name']
   const visible = available.filter (column => columns.includes (column))
-  const categories = definition.filterFields?.find (field =>
-      field.candidateSource === 'categories')?.choices ?? []
   const cell = (row: CountsCandidate, column: string) => {
-    if (column === 'category') return row.category == null ? ''
-	: message (`common:categories.${row.category}`).text
-    if (column === 'kind') return row.kind == null ? '' : message (`kinds.${row.kind}`).text
+    if (column === 'category')
+      return row.category == null ? '' : message (`common:categories.${row.category}`).text
+    if (column === 'kind')
+    {
+      const key = row.kind === 'group' ? 'resources.tag_groups' : `kinds.${row.kind}`
+      return row.kind == null ? '' : message (key).text
+    }
     return column === 'id' ? row.id : row.name
   }
   return <div className="min-w-0 space-y-2">
     <div className="flex min-w-0 items-center gap-2">
       <input className={inputClass (false, 'h-9 min-w-0 flex-1')}
-	  aria-label={message ('common:search').text} value={draft}
-	  onChange={event => setDraft (event.target.value)}
+	  aria-label={message ('common:search').text} value={draft} maxLength={1000}
+	  onChange={event => {
+	    const value = event.target.value
+	    if (new TextEncoder ().encode (value).length <= 1000) setDraft (value)
+	  }}
 	  onKeyDown={event => {
 	    if (event.key !== 'Enter') return
 	    event.preventDefault ()
@@ -81,7 +93,7 @@ const CountsCandidatePicker = (
       <Button type="button" onClick={() => { setSearch (draft); setPage (1) }}>
 	{label ('common:search')}</Button>
     </div>
-    {dynamic && <select className={inputClass (false, 'h-9 w-full')}
+    {categories.length > 0 && <select className={inputClass (false, 'h-9 w-full')}
 	aria-label={message ('common:categoryLabel').text} value={category}
 	onChange={event => { setCategory (event.target.value); setPage (1) }}>
       <option value=""/>
@@ -108,12 +120,13 @@ const CountsCandidatePicker = (
 	  {visible.map (column => <th key={column} className="p-2">
 	    {label (headings[column])}</th>)}
 	</tr></thead>
-	<tbody>{rows.map (row => <tr key={row.value} className="border-t dark:border-slate-700">
+	<tbody>{rows.map (row => <tr key={`${row.kind ?? ''}:${row.value}`}
+	    className="border-t dark:border-slate-700">
 	  <td className="p-2"><input type="checkbox" checked={selected.has (row.value)}
 	      aria-label={row.name ?? String (row.id ?? '')}
-	      disabled={!selected.has (row.value) && selected.size >= maximum}
+	      disabled={maximum !== 1 && !selected.has (row.value) && selected.size >= maximum}
 	      onChange={event => setSelected (previous => {
-		const next = new Set (previous)
+		const next = new Set (maximum === 1 ? [] : previous)
 		if (event.target.checked) next.add (row.value)
 		else next.delete (row.value)
 		return next
@@ -128,7 +141,8 @@ const CountsCandidatePicker = (
 	  onClick={() => setPage (previous => previous - 1)}>
 	{label ('common:pagination.previous')}</Button>
       <span>{page}</span>
-      <Button type="button" variant="outline" disabled={!data?.more || fetching}
+      <Button type="button" variant="outline"
+	  disabled={!data?.more || page >= 100_000 || fetching}
 	  onClick={() => setPage (previous => previous + 1)}>
 	{label ('common:pagination.next')}</Button>
     </div>}
@@ -136,4 +150,5 @@ const CountsCandidatePicker = (
 }
 
 
-export default CountsCandidatePicker
+export default CandidatePicker
+export type { CandidateSource }

frontend/src/components/common/ResourcePickerButton.tsx

@@ -0,0 +1,27 @@
+import CandidatePicker from '@/components/common/CandidatePicker'
+import { Button } from '@/components/ui/button'
+import useDialogue from '@/lib/dialogues/useDialogue'
+import { useUITranslation } from '@/lib/useUITranslation'
+
+import type { CandidateSource } from '@/components/common/CandidatePicker'
+
+
+const ResourcePickerButton = (
+    { source, values, maximum = 1, disabled, onSelect }: {
+	source: CandidateSource; values: (string | number | boolean)[]
+	maximum?: number; disabled?: boolean
+	onSelect: (values: string[]) => void },
+) => {
+  const dialogue = useDialogue ()
+  const { label } = useUITranslation ('counts')
+  return <Button type="button" variant="outline" disabled={disabled || maximum === 0}
+      onClick={() => void dialogue.form ({
+	  title: label ('pattern.link'), size: 'large', footerLayout: 'inline',
+	  body: controls => <CandidatePicker source={source} initial={values}
+	      maximum={maximum} controls={controls} onSelect={onSelect}/> })}>
+    {label ('pattern.selection')}
+  </Button>
+}
+
+
+export default ResourcePickerButton

frontend/src/components/counts/CountsAdditionalConditions.tsx

@@ -2,9 +2,10 @@ import { useEffect, useState } from 'react'
 
 import CountsConditionValues from '@/components/counts/CountsConditionValues'
 import DateTimeField from '@/components/common/DateTimeField'
+import ResourcePickerButton from '@/components/common/ResourcePickerButton'
 import { Button } from '@/components/ui/button'
-import { countsConditionInputs, countsEventTypes, countsFieldLabel, countsFilterFields,
-	 countsSetOperators, useCountsDefinition }
+import { countsCandidateSource, countsConditionInputs, countsEventTypes, countsFieldLabel,
+	 countsFilterFields, countsSetOperators, useCountsDefinition }
     from '@/lib/countsDefinitions'
 import useDialogue from '@/lib/dialogues/useDialogue'
 import { countsConditionValue } from '@/lib/countsDisplay'
@@ -15,7 +16,7 @@ import { useUITranslation } from '@/lib/useUITranslation'
 
 import { readCountState, encodeCountState } from '@/lib/queryState'
 
-import type { CountsResult } from '@/lib/counts'
+import type { CountsResource, CountsResult } from '@/lib/counts'
 import type { DialogueFormControls } from '@/lib/dialogues/useDialogue'
 import type { CountsCondition, CountsDefinition } from '@/lib/countsDefinitions'
 
@@ -94,10 +95,12 @@ const ConditionEditor = (
 }
 
 
-const CountsAdditionalConditions = ({ params, update, conditionLabels }: {
-    conditionLabels?: CountsResult['conditionLabels']
-    params: URLSearchParams
-    update: (key: string, value: string) => void },
+const CountsAdditionalConditions = (
+    { resource, params, update, conditionLabels }: {
+	resource: CountsResource
+	conditionLabels?: CountsResult['conditionLabels']
+	params: URLSearchParams
+	update: (key: string, value: string) => void },
 ) => {
   const { label, message } = useUITranslation ('counts')
   const definition = useCountsDefinition ()
@@ -149,11 +152,19 @@ const CountsAdditionalConditions = ({ params, update, conditionLabels }: {
 	  value={condition[key] == null ? '' : String (condition[key])} disabled={condition.blank}
 	  aria-label={aria.text} lang={aria.language}
 	  onChange={value => patch (index, { [key]: value ?? '' })}/>
-    return <input value={condition[key] == null ? '' : String (condition[key])} disabled={condition.blank}
-	type={(type === 'integer' || type === 'interval') ? 'number' : 'text'}
-	className={inputClass (false, 'h-10 w-36 min-w-0 max-w-full py-1')}
-	aria-label={aria.text} lang={aria.language}
-	onChange={event => patch (index, { [key]: event.target.value })}/>
+    const source = countsCandidateSource (resource, condition.field, params)
+    const value = condition[key]
+    return <>
+      <input value={condition[key] == null ? '' : String (condition[key])}
+	  disabled={condition.blank}
+	  type={(type === 'integer' || type === 'interval') ? 'number' : 'text'}
+	  className={inputClass (false, 'h-10 w-36 min-w-0 max-w-full py-1')}
+	  aria-label={aria.text} lang={aria.language}
+	  onChange={event => patch (index, { [key]: event.target.value })}/>
+      {source != null && <ResourcePickerButton source={source} disabled={condition.blank}
+	  values={value == null ? [] : [value]}
+	  onSelect={values => patch (index, { [key]: values[0] ?? '' })}/>}
+    </>
   }
   return <fieldset className="min-w-0 space-y-1">
     <legend className="flex items-center gap-2">{label ('additionalConditions')}
@@ -182,7 +193,7 @@ const CountsAdditionalConditions = ({ params, update, conditionLabels }: {
 	  </Button>
 	  {countsSetOperators.includes (condition.operator) ? (
 	      <CountsConditionValues key={`${condition.field}:${condition.operator}`}
-		  condition={condition}
+		  condition={condition} resource={resource}
 		  field={metadata.find (field => field.key === condition.field)!}
 		  definition={definition} params={params}
 		  maximum={Math.max (0, 100 - conditions.reduce ((sum, item, position) =>

frontend/src/components/counts/CountsConditionValues.tsx

@@ -1,18 +1,22 @@
 import { useState } from 'react'
 
-import CountsCandidatePicker from '@/components/counts/CountsCandidatePicker'
+import CandidatePicker from '@/components/common/CandidatePicker'
 import DateTimeField from '@/components/common/DateTimeField'
+import ResourcePickerButton from '@/components/common/ResourcePickerButton'
 import { Button } from '@/components/ui/button'
+import { countsCandidateSource } from '@/lib/countsDefinitions'
 import useDialogue from '@/lib/dialogues/useDialogue'
 import { inputClass } from '@/lib/utils'
 import { useUITranslation } from '@/lib/useUITranslation'
 
+import type { CountsResource } from '@/lib/counts'
 import type { CountsCondition, CountsDefinition, CountsFieldMetadata }
     from '@/lib/countsDefinitions'
 
 
 const CountsConditionValues = (
-    { condition, field, definition, params, maximum, change }: {
+    { resource, condition, field, definition, params, maximum, change }: {
+	resource: CountsResource
 	condition: CountsCondition; field: CountsFieldMetadata; definition: CountsDefinition
 	params: URLSearchParams; maximum: number
 	change: (values: (string | number | boolean)[]) => void },
@@ -21,11 +25,21 @@ const CountsConditionValues = (
   const dialogue = useDialogue ()
   const [draft, setDraft] = useState ('')
   const values = condition.values ?? []
+  const source = countsCandidateSource (resource, field.key, params)
   const pick = () => {
     void dialogue.form ({ title: label (field.candidateSource === 'tags'
 	? 'counts:pattern.link' : 'counts:pattern.pattern'), size: 'large', footerLayout: 'inline',
-	body: controls => <CountsCandidatePicker field={field} definition={definition}
-	    params={params} initial={values} maximum={maximum} controls={controls} save={change}/> })
+	body: controls => <CandidatePicker
+	    source={
+		field.candidateSource === 'tags'
+		? { resource: 'posts', field: field.key, params } : undefined}
+	    choices={(field.choices ?? []).map (choice => ({
+		value: choice.value, name: message (choice.label).text }))}
+	    categories={
+		field.candidateSource === 'tags'
+		? definition.filterFields?.find (field =>
+		    field.candidateSource === 'categories')?.choices : undefined}
+	    initial={values} maximum={maximum} controls={controls} onSelect={change}/> })
   }
   if (condition.input === 'list' || field.candidateSource === 'tags')
     return <Button type="button" variant="outline" disabled={condition.blank} onClick={pick}>
@@ -73,6 +87,8 @@ const CountsConditionValues = (
 	  onClick={() => change (values.filter ((_, position) => position !== index))}>×</Button>
     </span>)}
     {input ()}
+    {source != null && <ResourcePickerButton source={source} values={values}
+	maximum={maximum} disabled={condition.blank} onSelect={change}/>}
     <Button type="button" variant="outline" disabled={condition.blank || draft === ''
 	|| values.length >= maximum} onClick={append}>{label ('add')}</Button>
     <Button type="button" variant="ghost" disabled={condition.blank}

frontend/src/components/counts/CountsControls.tsx

@@ -7,6 +7,7 @@ import AnimatedCollapse from '@/components/common/AnimatedCollapse'
 import DateTimeField from '@/components/common/DateTimeField'
 import FormField from '@/components/common/FormField'
 import HelpPopover from '@/components/common/HelpPopover'
+import ResourcePickerButton from '@/components/common/ResourcePickerButton'
 import TagInput from '@/components/common/TagInput'
 import { Button } from '@/components/ui/button'
 import { countsRequestParams, countsUseLatest, fieldsForCounts, normaliseCountsParams, readCountSort,
@@ -223,11 +224,17 @@ const CountsControls = (
             {['resource_id', 'user_id'].map (key => <FormField key={key}
                 label={label (key === 'resource_id' ? 'columns.resourceId'
                     : 'fields.actor')}>
-              {() => <input value={draft.get (key) ?? ''}
-                  aria-label={message (key === 'resource_id' ? 'columns.resourceId'
-                      : 'fields.actor').text}
-                  className={inputClass (false, 'w-28 py-1')}
-                  onChange={event => update (key, event.target.value)}/>}
+              {() => <div className="flex flex-wrap items-center gap-1">
+		<input value={draft.get (key) ?? ''}
+		    aria-label={message (key === 'resource_id' ? 'columns.resourceId'
+			: 'fields.actor').text}
+		    className={inputClass (false, 'w-28 py-1')}
+		    onChange={event => update (key, event.target.value)}/>
+		<ResourcePickerButton source={{ resource,
+		    field: key === 'resource_id' ? key : 'user', params: draft }}
+		    values={draft.get (key) ? [draft.get (key)!] : []}
+		    onSelect={values => update (key, values[0] ?? '')}/>
+	      </div>}
             </FormField>)}
           </div>
           {resource === 'posts' && <FormField label={label ('columns.tags')}>
@@ -263,7 +270,7 @@ const CountsControls = (
               </>}
             </div>}
           </FormField>}
-	  <CountsAdditionalConditions params={draft} update={update}
+	  <CountsAdditionalConditions resource={resource} params={draft} update={update}
               conditionLabels={(labelParams != null
                   && draft.get ('current') === labelParams.get ('current')
                   && draft.get ('at') === labelParams.get ('at')

frontend/src/components/dialogues/DialogueProvider.tsx

@@ -227,11 +227,13 @@ const DialogueProvider: FC<Props> = ({ children }) => {
 		       </DialogHeader>
 
 		       <div className="min-h-0 flex-1 overflow-y-auto overscroll-contain">
-			 {active.options.body (
-			     formControls.current[active.id] ??= {
+			 <DialogueProvider key={active.id}>
+			   {active.options.body (
+			       formControls.current[active.id] ??= {
 				 close: () => closeRequest (active.id),
 				 setActions: actions => setRequestActions (active.id, actions),
 				 confirm: options => openNestedConfirm (active.id, options) })}
+			 </DialogueProvider>
 		       </div>
 
 		       <DialogFooter

frontend/src/components/posts/PostCoreDataFields.tsx

@@ -1,3 +1,4 @@
+import ResourcePickerButton from '@/components/common/ResourcePickerButton'
 import PostOriginalCreatedTimeField from '@/components/PostOriginalCreatedTimeField'
 import PostTagsField from '@/components/posts/PostTagsField'
 import PostTextField from '@/components/posts/PostTextField'
@@ -88,7 +89,12 @@ const PostCoreDataFields: FC<PostCoreDataFieldsProps> = (
           disabled={parentPostIds.disabled}
           warnings={parentPostIds.warnings}
           errors={parentPostIds.errors}
-          onChange={parentPostIds.onChange}/>
+          onChange={parentPostIds.onChange}
+	  after={<ResourcePickerButton
+	      source={{ resource: 'posts', field: 'resource_id' }}
+	      values={parentPostIds.value.split (/\s+/).filter (Boolean)}
+	      maximum={Number.MAX_SAFE_INTEGER} disabled={parentPostIds.disabled}
+	      onSelect={values => parentPostIds.onChange (values.join (' '))}/>}/>
     </>)
 
 export default PostCoreDataFields

frontend/src/lib/countsDefinitions.ts

@@ -89,18 +89,19 @@ export const fetchCountsDefinition = (
     .then (definition => localiseCountsDefinition (definition, locale))
 
 export type CountsCandidate = {
-    value: string; id?: number; name: string | null; category?: string | null
+    value: string; id?: number | string; name: string | null; category?: string | null
     names?: Record<string, unknown>
-    kind?: 'internal' | 'external' }
+    kind?: 'internal' | 'external' | 'group' }
 export type CountsCandidatesResult = {
     rows: CountsCandidate[]; page: number; more: boolean; executionAt: string }
 
 export const fetchCountsCandidates = (
+    resource: CountsResource,
     params: URLSearchParams,
     locale: LocaleCode,
     signal?: AbortSignal,
 ): Promise<CountsCandidatesResult> => apiGet (
-    '/counts/definitions/posts/candidates', {
+    `/counts/definitions/${encodeURIComponent (resource)}/candidates`, {
 	params: Object.fromEntries (params), locale, signal })
 
 export const countsSetOperators = ['in', 'not_in', 'any', 'all', 'none']
@@ -155,3 +156,25 @@ export const countsAxisFields = (
     history: boolean,
 ): CountField[] => definition.axes[history ? 'history' : 'latest']
     .map (key => ({ key, label: countsFieldLabel (key) }))
+
+
+export const countsCandidateSource = (
+    resource: CountsResource,
+    field: string,
+    params: URLSearchParams,
+): { resource: CountsResource; field: string; params: URLSearchParams } | undefined => {
+  if (['resource_id', 'user', 'updated_by_user_id', 'file_blob_id', 'source_file_id']
+      .includes (field)) return { resource, field, params }
+  if (field === 'user.id') return { resource, field: 'user', params }
+  if ((field === 'tags.id' && resource === 'posts')
+      || (field === 'members' && resource === 'tag_groups'))
+    return { resource, field, params }
+  const leaf = field.split ('.').at (-1) ?? ''
+  const targets: Record<string, CountsResource> = {
+      tagGroupId: 'tag_groups', tagId: 'tags', tag_id: 'tags', parent_id: 'materials',
+      parents: resource === 'posts' ? 'posts' : 'tags',
+      'parents.id': resource === 'posts' ? 'posts' : 'tags',
+      parent_post_ids: 'posts', parent_tag_ids: 'tags' }
+  const target = targets[field] ?? targets[leaf]
+  return target == null ? undefined : { resource: target, field: 'resource_id', params }
+}

frontend/src/lib/queryKeys.ts

@@ -174,6 +174,7 @@ export const theatresKeys = {
 export const countsKeys = {
     definition: (resource: string, locale: LocaleCode = 'ja') =>
 	['counts', 'definition', resource, locale] as const,
-    candidates: (params: string, locale: LocaleCode) => ['counts', 'candidates', locale, params] as const,
+    candidates: (resource: string, params: string, locale: LocaleCode) =>
+	['counts', 'candidates', resource, locale, params] as const,
     index: (resource: string, params: string, locale: LocaleCode) =>
 	['counts', resource, locale, params] as const }

frontend/src/pages/materials/MaterialHistoryPage.tsx

@@ -6,6 +6,7 @@ import { useLocale, useLocaleNavigate } from '@/lib/useLocale'
 import PrefetchLink from '@/components/PrefetchLink'
 import FormField from '@/components/common/FormField'
 import PageTitle from '@/components/common/PageTitle'
+import ResourcePickerButton from '@/components/common/ResourcePickerButton'
 import Pagination from '@/components/common/Pagination'
 import MainArea from '@/components/layout/MainArea'
 import PageHead from '@/components/common/PageHead'
@@ -96,13 +97,19 @@ const MaterialHistoryPage: FC = () => {
 	    <div className="space-y-3">
 	      <FormField label={label ('materialId')}>
 		{({ invalid }) => (
-		    <input
+		    <>
+		      <input
 			type="text"
 			value={materialIdInput}
 			aria-label={message ('materialId').text}
 			lang={message ('materialId').language}
 			onChange={e => setMaterialIdInput (e.target.value)}
-			className={inputClass (invalid)}/>)}
+			className={inputClass (invalid)}/>
+		      <ResourcePickerButton
+			source={{ resource: 'materials', field: 'resource_id' }}
+			values={materialIdInput === '' ? [] : [materialIdInput]}
+			onSelect={values => setMaterialIdInput (values[0] ?? '')}/>
+		    </>)}
 	      </FormField>
 
 	      <FormField label={label ('tagName')}>

frontend/src/pages/materials/MaterialSyncSuppressionsPage.tsx

@@ -4,6 +4,7 @@ import { useState } from 'react'
 import { useLocale } from '@/lib/useLocale'
 import FormField from '@/components/common/FormField'
 import PageTitle from '@/components/common/PageTitle'
+import ResourcePickerButton from '@/components/common/ResourcePickerButton'
 import MainArea from '@/components/layout/MainArea'
 import { Button } from '@/components/ui/button'
 import { toast } from '@/components/ui/use-toast'
@@ -126,11 +127,17 @@ const MaterialSyncSuppressionsPage: FC = () => {
 
 	      <FormField label={label ('suppressions.driveFileId')}>
 		{({ invalid }) => (
-		    <input
+		    <>
+		      <input
 			type="text"
 			value={driveFileId}
 			onChange={e => setDriveFileId (e.target.value)}
-			className={inputClass (invalid)}/>)}
+			className={inputClass (invalid)}/>
+		      <ResourcePickerButton
+			source={{ resource: 'materials', field: 'drive_file_id' }}
+			values={driveFileId === '' ? [] : [driveFileId]}
+			onSelect={values => setDriveFileId (values[0] ?? '')}/>
+		    </>)}
 	      </FormField>
 
 	      <FormField label={label ('suppressions.reason')}>