AI: address review on PR #463

backend/app/controllers/posts_controller.rb

@@ -37,7 +37,7 @@ class PostsController < ApplicationController
 
     offset = (page - 1) * limit
 
-    history_join_required = order[0] == 'updated_at' || updated_between.any?(&:present?)
+    needs_history_join = order[0] == 'updated_at' || updated_between.any?(&:present?)
 
     q =
         filtered_posts(locale)
@@ -57,8 +57,8 @@ class PostsController < ApplicationController
     q = q.where('posts.created_at >= ?', created_between[0]) if created_between[0]
     q = q.where('posts.created_at <= ?', created_between[1]) if created_between[1]
     count_scope = q
-    if history_join_required
-      history_times = PostVersion.all
+    if needs_history_join
+      history_times = HistoryAccess.visible(PostVersion.all)
           .select('post_id, MAX(created_at) AS latest_at').group(:post_id)
       q = q.joins("LEFT JOIN (#{ history_times.to_sql }) history_times " +
                   'ON history_times.post_id = posts.id')
@@ -72,7 +72,7 @@ class PostsController < ApplicationController
       q = q.where("#{ updated_at_all_sql } <= ?", updated_between[1])
     end
     count_scope = q if updated_between.any?(&:present?)
-    if history_join_required
+    if needs_history_join
       q = q.select('posts.*', "#{ updated_at_all_sql } AS updated_at")
     end
 
@@ -92,10 +92,10 @@ class PostsController < ApplicationController
              .offset(offset)
              .to_a
     latest_version_times =
-        if history_join_required
+        if needs_history_join
           { }
         else
-          PostVersion.where(post_id: posts.map(&:id))
+          HistoryAccess.visible(PostVersion.where(post_id: posts.map(&:id)))
               .group(:post_id).maximum(:created_at)
         end
 

backend/app/controllers/tag_descriptions_controller.rb

@@ -49,6 +49,7 @@ class TagDescriptionsController < ApplicationController
   private
 
   def representation description
+    HistoryAccess.require_current!(description, TagDescriptionVersion)
     description.as_json(only: [
         :tag_id,
         :language_code,

backend/app/controllers/tag_groups_controller.rb

@@ -1,7 +1,7 @@
 class TagGroupsController < ApplicationController
   def index
     locale = resolve_locale!
-    groups = TagGroup.includes(:created_by_user, :updated_by_user).order(:id)
+    groups = HistoryAccess.current(TagGroup.all, TagGroupVersion).includes(:created_by_user, :updated_by_user).order(:id)
     render json: TagGroupRepr.many(locale, groups.to_a)
   end
 

backend/app/controllers/wiki_pages_controller.rb

@@ -8,11 +8,12 @@ class WikiPagesController < ApplicationController
 
     title = params[:title].to_s.strip
     descriptions =
-        TagDescription.where(language_code: locale.language_code)
+        HistoryAccess.current(TagDescription.all, TagDescriptionVersion)
+        .where(language_code: locale.language_code)
         .includes(tag: :tag_names)
 
     descriptions = descriptions.order(updated_at: :desc, id: :asc)
-    tag_groups = TagGroup.order(updated_at: :desc, id: :asc)
+    tag_groups = HistoryAccess.current(TagGroup.all, TagGroupVersion).order(updated_at: :desc, id: :asc)
     if title.present?
       pattern = "%#{ ApplicationRecord.sanitize_sql_like(title) }%"
       descriptions =
@@ -40,13 +41,13 @@ class WikiPagesController < ApplicationController
     return head :not_found unless language.is_a?(String)
     return head :not_found unless Language.exists?(code: language)
 
-    names = TagDescription.joins(tag: :tag_names)
+    names = HistoryAccess.current(TagDescription.all, TagDescriptionVersion).joins(tag: :tag_names)
         .where(language_code: locale.language_code, tag_names: { language_code: language })
         .pluck('tag_descriptions.tag_id', 'tag_descriptions.id', 'tag_names.name')
     candidates = names.map do |tag_id, description_id, name|
       WikiPageRepr.autolink_tag(locale, tag_id:, description_id:, name:, language:)
     end
-    candidates.concat(TagGroup.order(:id).pluck(:id, :name).map do |id, name|
+    candidates.concat(HistoryAccess.current(TagGroup.all, TagGroupVersion).order(:id).pluck(:id, :name).map do |id, name|
       WikiPageRepr.autolink_group(locale, id:, name:, language:)
     end)
     render json: candidates
@@ -410,7 +411,7 @@ class WikiPagesController < ApplicationController
   end
 
   def tag_description_by_title locale, title
-    TagDescription.joins(tag: :tag_names)
+    HistoryAccess.current(TagDescription.all, TagDescriptionVersion).joins(tag: :tag_names)
         .find_by(language_code: locale.language_code,
                  tag_names: { language_code: locale.language_code, name: title })
   end

backend/app/models/history_access.rb

@@ -147,6 +147,29 @@ class HistoryAccess < ActiveSupport::CurrentAttributes
     scope.where(Arel.sql(sql(scope.klass, row)))
   end
 
+  def self.current(scope, version_model)
+    return scope if admin?
+
+    table = scope.klass.table_name
+    keys = KEYS.fetch(version_model.table_name)
+    matches = keys.map do |key|
+      column = scope.klass.column_names.include?(key) ? key : 'id'
+      "current_snapshot.#{ key } = #{ table }.#{ column }"
+    end.join(' AND ')
+    boundary = "#{ matches } AND current_snapshot.version_no >= #{ table }.version_no " +
+        "AND current_snapshot.event_type = 'discard'"
+    scope = scope.where(Arel.sql("NOT EXISTS (SELECT 1 FROM #{ version_model.table_name } " +
+        "current_snapshot WHERE #{ boundary })"))
+    condition = "#{ matches } AND current_snapshot.version_no = #{ table }.version_no"
+    scope.where(Arel.sql("NOT EXISTS (SELECT 1 FROM #{ version_model.table_name } " +
+        "current_snapshot WHERE #{ condition } AND NOT (#{ sql(version_model, 'current_snapshot') }))"))
+  end
+
+  def self.require_current!(record, version_model)
+    return if admin?
+    raise Forbidden unless current(record.class.where(id: record.id), version_model).exists?
+  end
+
   def self.blob_visible?(blob, seen = [])
     return true if admin?
     return false if seen.include?(blob.id)

backend/app/representations/tag_group_repr.rb

@@ -44,6 +44,7 @@ module TagGroupRepr
   end
 
   def one locale, group
+    HistoryAccess.require_current!(group, TagGroupVersion)
     many(locale, [group]).first
   end
 

backend/app/representations/wiki_page_repr.rb

@@ -5,6 +5,7 @@ module WikiPageRepr
   module_function
 
   def tag_description locale, description
+    HistoryAccess.require_current!(description, TagDescriptionVersion)
     tag = description.tag
 
     { 'id' => description.id,

frontend/src/components/DraggableDroppableTagRow.test.tsx

@@ -1,9 +1,25 @@
+import { screen } from '@testing-library/react'
 import { beforeEach, describe, expect, it, vi } from 'vitest'
 
 import DraggableDroppableTagRow from '@/components/DraggableDroppableTagRow'
 import { buildTag } from '@/test/factories'
 import { renderWithProviders } from '@/test/render'
 
+import type { CSSProperties, ReactNode } from 'react'
+
+vi.mock ('framer-motion', async importOriginal => {
+  const original = await importOriginal<typeof import ('framer-motion')> ()
+  return {
+      ...original,
+      motion: {
+	  ...original.motion,
+	  div: ({ children, style, layoutId }: {
+	      children?: ReactNode
+	      style?: CSSProperties
+	      layoutId?: string }) => (
+	      <div style={style} data-layout-id={layoutId}>{children}</div>) } }
+})
+
 const dndKit = vi.hoisted (() => ({
   useDraggable: vi.fn (),
   useDroppable: vi.fn (),
@@ -97,4 +113,32 @@ describe ('DraggableDroppableTagRow', () => {
 	}),
     )
   })
+
+  it.each ([false, true]) (
+      'separates same-id internal and external animation identities (sp=%s)',
+      sp => {
+	const internal = buildTag ({ id: 7, name: 'internal_collision' })
+	const external = buildTag ({
+	    id: 7, name: 'nico:external_collision', category: 'nico' })
+
+	renderWithProviders (
+	    <>
+	      {[internal, external].map (item => (
+		  <DraggableDroppableTagRow
+		      key={item.category}
+		      tag={item}
+		      nestLevel={0}
+		      pathKey={`cat-${ item.category }-7`}
+		      suppressClickRef={{ current: false }}
+		      sp={sp}/>))}
+	    </>)
+
+	const prefix = sp ? 'tag-sp-' : 'tag-'
+	for (const item of [internal, external])
+	{
+	  expect (screen.getByRole ('link', { name: item.name })
+	      .closest ('[data-layout-id]')).toHaveAttribute (
+		  'data-layout-id', `${ prefix }${ item.category }-7`)
+	}
+      })
 })

frontend/src/components/DraggableDroppableTagRow.tsx

@@ -137,7 +137,7 @@ const DraggableDroppableTagRow: FC<Props> = ({
 		transition={{ layout: layoutTransition }}
 		layoutId={animationMode === 'off'
 		    ? undefined
-		    : `tag-${ sp ? 'sp-' : '' }${ tag.id }`}>
+		    : `tag-${ sp ? 'sp-' : '' }${ tag.category }-${ tag.id }`}>
 	      <TagLink tag={tag} nestLevel={nestLevel}/>
 	    </motion.div>)}
       </div>)

frontend/src/components/TagSidebar.test.tsx

@@ -0,0 +1,47 @@
+import { screen } from '@testing-library/react'
+import { describe, expect, it, vi } from 'vitest'
+
+import TagSidebar from '@/components/TagSidebar'
+import { buildPost, buildTag } from '@/test/factories'
+import { renderWithProviders } from '@/test/render'
+
+import type { ReactNode } from 'react'
+
+vi.mock ('@/components/TagSearch', () => ({ default: () => null }))
+vi.mock ('@/components/layout/SidebarComponent', () => ({
+    default: ({ children }: { children: ReactNode }) => <>{children}</> }))
+
+vi.mock ('framer-motion', async importOriginal => {
+  const original = await importOriginal<typeof import ('framer-motion')> ()
+  return {
+      ...original,
+      motion: {
+	  ...original.motion,
+	  div: ({ children, layoutId }: {
+	      children?: ReactNode
+	      layoutId?: string }) => (
+	      <div data-layout-id={layoutId}>{children}</div>) } }
+})
+
+describe ('TagSidebar', () => {
+  it ('keeps same-id internal and external tags with distinct identities', () => {
+    const errors = vi.spyOn (console, 'error').mockImplementation (() => {})
+    const internal = buildTag ({ id: 7, name: 'internal_collision' })
+    const external = buildTag ({
+	id: 7, name: 'nico:external_collision', category: 'nico' })
+
+    renderWithProviders (
+	<TagSidebar posts={[buildPost ({ tags: [internal, external] })]}/>)
+
+    for (const item of [internal, external])
+    {
+      const link = screen.getByRole ('link', { name: item.name })
+      expect (link).toBeInTheDocument ()
+      expect (link.closest ('[data-layout-id]')).toHaveAttribute (
+	  'data-layout-id', `tag-${ item.category }-7`)
+    }
+
+    expect (errors.mock.calls.filter (args =>
+	args.some (value => String (value).includes ('same key')))).toEqual ([])
+  })
+})

frontend/src/components/TagSidebar.tsx

@@ -84,7 +84,8 @@ const TagSidebar: FC<Props> = ({ posts, onClick }) => {
 	<ul>
 	  {CATEGORIES.flatMap (cat => cat in tags ? (
 	      tags[cat].map (tag => (
-		  <li key={tag.id} className="mb-1 min-w-0 max-w-full overflow-hidden">
+		  <li key={`${ cat }-${ tag.id }`}
+		      className="mb-1 min-w-0 max-w-full overflow-hidden">
 		    {animationsOff
 		     ? (
 			 <div className="flex min-w-0 max-w-full items-baseline overflow-hidden">
@@ -94,7 +95,7 @@ const TagSidebar: FC<Props> = ({ posts, onClick }) => {
 			 <motion.div
 			     className="flex min-w-0 max-w-full items-baseline overflow-hidden"
 			     transition={{ layout: layoutTransition }}
-			     layoutId={`tag-${ tag.id }`}>
+			     layoutId={`tag-${ cat }-${ tag.id }`}>
 			   <TagLink tag={tag} onClick={onClick}/>
 			 </motion.div>)}
 		  </li>))) : [])}