131 行
6.6 KiB
Ruby
131 行
6.6 KiB
Ruby
require 'rails_helper'
|
|
|
|
RSpec.describe HistoryAccess do
|
|
include_context 'Ainu locale'
|
|
|
|
let!(:tag) { create(:tag) }
|
|
|
|
it 'uses the complete tag-description identity and version order at equal timestamps' do
|
|
locale
|
|
rows = ['ja', 'ain'].flat_map do |language|
|
|
['create', 'discard', 'restore'].each_with_index.map do |event, index|
|
|
TagDescriptionVersion.create!(tag_id: tag.id, language_code: language,
|
|
version_no: index + 1, event_type: language == 'ain' ? 'update' : event,
|
|
body: "#{ language } #{ index }", created_at: Time.utc(2024))
|
|
end
|
|
end
|
|
described_class.set(user: nil) do
|
|
expect(described_class.visible(TagDescriptionVersion.where(id: rows.map(&:id))).pluck(:id))
|
|
.to match_array([rows[2], *rows.last(3)].map(&:id))
|
|
expect { described_class.require!(rows.first) }.to raise_error(HistoryAccess::Forbidden)
|
|
end
|
|
described_class.set(user: create(:user, :admin)) do
|
|
expect(described_class.visible(TagDescriptionVersion.where(id: rows.map(&:id))).count).to eq(6)
|
|
end
|
|
end
|
|
|
|
it 'invalidates public artifacts after a new discard and binds admin artifacts to their actor' do
|
|
public_metadata = described_class.set(user: nil) { described_class.authority }
|
|
admin = create(:user, :admin)
|
|
admin_metadata = described_class.set(user: admin) { described_class.authority }
|
|
TagVersion.create!(tag:, version_no: 1, event_type: 'discard', name: 'private',
|
|
category: 'general',
|
|
names: { ja: { name: 'private', script_code: 'Jpan',
|
|
auto_generated: false, aliases: [] } },
|
|
aliases: '', parent_tag_ids: '', created_at: Time.utc(2024))
|
|
described_class.set(user: nil) do
|
|
expect(described_class.authorised_artifact?(public_metadata)).to be(false)
|
|
expect(described_class.authorised_artifact?(admin_metadata)).to be(false)
|
|
end
|
|
described_class.set(user: create(:user, :admin)) do
|
|
expect(described_class.authorised_artifact?(admin_metadata)).to be(false)
|
|
end
|
|
described_class.set(user: admin) do
|
|
expect(described_class.authorised_artifact?(admin_metadata)).to be(true)
|
|
admin.update!(role: :guest)
|
|
expect(described_class.authorised_artifact?(admin_metadata)).to be(false)
|
|
end
|
|
end
|
|
|
|
it 'denies a blob attached to a discarded post including its derived attachment' do
|
|
post = create(:post)
|
|
blob = ActiveStorage::Blob.create_before_direct_upload!(filename: 'private.png',
|
|
byte_size: 1, checksum: Base64.strict_encode64('checksum'), content_type: 'image/png')
|
|
ActiveStorage::Attachment.create!(name: 'thumbnail', record: post, blob:)
|
|
PostVersion.create!(post:, version_no: 1, event_type: 'discard', url: post.url,
|
|
title: 'private', tags: '', tags_json: [], parent_post_ids: '', created_at: Time.utc(2024))
|
|
variant = ActiveStorage::VariantRecord.create!(blob:, variation_digest: 'spec-variation')
|
|
derived = ActiveStorage::Blob.create_before_direct_upload!(filename: 'derived.png',
|
|
byte_size: 1, checksum: Base64.strict_encode64('checksum'), content_type: 'image/png')
|
|
ActiveStorage::Attachment.create!(name: 'image', record: variant, blob: derived)
|
|
described_class.set(user: nil) do
|
|
expect(described_class.blob_visible?(blob)).to be(false)
|
|
expect(described_class.blob_visible?(derived)).to be(false)
|
|
end
|
|
described_class.set(user: create(:user, :admin)) do
|
|
expect(described_class.blob_visible?(derived)).to be(true)
|
|
end
|
|
end
|
|
end
|
|
|
|
RSpec.describe 'Counts artifact policy and external references' do
|
|
it 'rejects files created before the masked-summary policy' do
|
|
HistoryAccess.set(user: nil) do
|
|
metadata = HistoryAccess.authority.except('artifact_policy')
|
|
expect(HistoryAccess.authorised_artifact?(metadata)).to be(false)
|
|
end
|
|
end
|
|
|
|
it 'does not expose a private linked tag name through an external history snapshot' do
|
|
tag = create(:tag, primary_name: 'private-linked-name')
|
|
TagVersion.create!(tag:, version_no: 1, event_type: 'discard', name: 'private-linked-name',
|
|
category: 'general', aliases: '', parent_tag_ids: '', created_at: Time.utc(2024),
|
|
names: { ja: { name: 'private-linked-name', script_code: 'Jpan',
|
|
auto_generated: false, aliases: [] } })
|
|
external = create(:external_tag, name: 'public-external')
|
|
row = NicoTagVersion.create!(external_tag: external, version_no: 1, event_type: 'create',
|
|
name: 'nico:public-external', linked_tags: 'private-linked-name',
|
|
created_at: Time.utc(2024))
|
|
post = create(:post)
|
|
snapshot = PostVersion.create!(post:, version_no: 1, event_type: 'create',
|
|
title: 'external reference', url: post.url, tags: '',
|
|
tags_json: [{ external_tag_id: external.id }], parent_post_ids: '',
|
|
created_at: Time.utc(2024, 2))
|
|
HistoryAccess.set(user: nil) do
|
|
expect(HistoryAccess.visible(NicoTagVersion.where(id: row.id))).to be_empty
|
|
expect(HistoryAccess.visible(PostVersion.where(id: snapshot.id))).to be_empty
|
|
end
|
|
HistoryAccess.set(user: create(:user, :admin)) do
|
|
expect(HistoryAccess.visible(NicoTagVersion.where(id: row.id))).to exist
|
|
end
|
|
public_row = NicoTagVersion.create!(external_tag: external, version_no: 2, event_type: 'update',
|
|
name: 'nico:public-external', linked_tags: 'private-linked-name-extra',
|
|
created_at: Time.utc(2024, 7))
|
|
HistoryAccess.set(user: nil) do
|
|
expect(HistoryAccess.visible(NicoTagVersion.where(id: public_row.id))).to exist
|
|
expect(HistoryAccess.visible(PostVersion.where(id: snapshot.id))).to be_empty
|
|
end
|
|
end
|
|
|
|
it 'propagates the recorded tag version policy to its post snapshot' do
|
|
parent = create(:tag, primary_name: 'private parent')
|
|
child = create(:tag, primary_name: 'referencing child')
|
|
[[parent, 'discard', '', 'private parent'],
|
|
[child, 'create', parent.id.to_s, 'referencing child']].each do |tag, event, parents, name|
|
|
TagVersion.create!(tag:, version_no: 1, event_type: event, name:,
|
|
category: 'general', aliases: '', parent_tag_ids: parents, created_at: Time.utc(2023),
|
|
names: { ja: { name:, script_code: 'Jpan',
|
|
auto_generated: false, aliases: [] } })
|
|
end
|
|
post = create(:post)
|
|
row = PostVersion.create!(post:, version_no: 1, event_type: 'create', title: 'snapshot',
|
|
url: post.url, tags: '', parent_post_ids: '',
|
|
tags_json: [{ tag_id: child.id, version_no: 1, name: 'referencing child', sections: [] }],
|
|
created_at: Time.utc(2024))
|
|
HistoryAccess.set(user: nil) do
|
|
expect(HistoryAccess.visible(PostVersion.where(id: row.id))).to be_empty
|
|
end
|
|
end
|
|
|
|
end
|