mirror of
https://github.com/J3vb/OwnCord.git
synced 2026-09-03 03:50:00 +03:00
J3vbandClaude Fable 5
6afa9e974c
Fixes all 109 golangci-lint findings (106 contextcheck, 1 gocritic,
2 gosec) that accumulated after D2 wired dbgen (whose queries take ctx)
under ctx-less db.DB wrappers while CI lint was quota-dead. No nolint
comments added; every finding fixed by genuinely threading context.
- db: all 138 hand-written db.DB methods take ctx first; the dbCtx()
Background shim is deleted; raw Query/QueryRow/Exec/Begin use their
Context variants; the four redundant ctx-less passthroughs removed.
db.Auditor/WriteAudit gain ctx.
- Seams: permissions.Checker (DB iface, HasChannelPerm,
RequireChannelAccess) and the service.Store interface mirror the new
signatures (ws.EventStore and plugin.PluginStore already did).
- Callers: api/admin handlers use r.Context(); ws per-message paths use
the connection ctx via DispatchV2; hub loops and startup wiring use
context.Background(); service methods thread ctx where they have one
and Background where no ctx exists. Public service surface reached by
ctx-holding chains (PermissionService.HasChannelPerm/GetRoleForUser/
RequireChannelAccess, message/dm/block/invite/profile methods) is now
ctx-first.
- Detached (context.WithoutCancel) where cancellation would break an
invariant, found by a 3-lens adversarial review of the diff:
* voice-leave background retries (a dead webhook/connection ctx killed
retry 2 before it ran, leaving ghost capacity-holding voice rows)
* rollbackVoiceJoin's compensating delete (its trigger IS the cancel)
* post-2FA-change DeleteOtherSessions and logout DeleteSession (the
security tail of a committed change must not die with the request)
* all api/ws audit writes (a banned user could suppress their own
login_blocked_banned row by aborting the request mid-bcrypt)
* admin backup VACUUM INTO (an interrupt left a truncated .db that
the backup list presented as restorable)
* post-commit message/edit refetches (a committed message must still
fan out when the sender disconnects)
* hub settings-cache refresh (one dead connection could pin stale
values for the 30s TTL)
- gocritic rangeValCopy fixed (index iteration); gosec G306 excluded in
config with justification (generated source must stay world-readable)
instead of flipping genprotocol output to 0o600.
Verified: gofmt/vet, all four build-tag variants, full suite, deadlock
pass, full -race pass, golangci-lint 0 issues uncapped.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
81 lines
2.0 KiB
Go
81 lines
2.0 KiB
Go
package db_test
|
|
|
|
import (
|
|
"context"
|
|
"errors"
|
|
"log/slog"
|
|
"strings"
|
|
"testing"
|
|
|
|
"github.com/owncord/server/db"
|
|
)
|
|
|
|
// fakeAuditor lets a test drive WriteAudit down either the success or the
|
|
// failure path without a real database.
|
|
type fakeAuditor struct {
|
|
err error
|
|
called bool
|
|
}
|
|
|
|
func (f *fakeAuditor) LogAudit(_ context.Context, _ int64, _, _ string, _ int64, _ string) error {
|
|
f.called = true
|
|
return f.err
|
|
}
|
|
|
|
// captureLogs redirects the default slog logger to a buffer for the duration
|
|
// of fn and returns everything it wrote.
|
|
func captureLogs(t *testing.T, fn func()) string {
|
|
t.Helper()
|
|
var buf strings.Builder
|
|
prev := slog.Default()
|
|
slog.SetDefault(slog.New(slog.NewTextHandler(&buf, &slog.HandlerOptions{Level: slog.LevelDebug})))
|
|
defer slog.SetDefault(prev)
|
|
fn()
|
|
return buf.String()
|
|
}
|
|
|
|
func TestWriteAudit_LogsFailureButDoesNotPropagate(t *testing.T) {
|
|
a := &fakeAuditor{err: errors.New("disk on fire")}
|
|
|
|
// WriteAudit returns nothing, so "never propagated" is structural — the
|
|
// call simply must not panic and must record the failure.
|
|
out := captureLogs(t, func() {
|
|
db.WriteAudit(context.Background(), a, 7, "user_ban", "user", 42, "spam")
|
|
})
|
|
|
|
if !a.called {
|
|
t.Fatal("WriteAudit did not attempt the underlying LogAudit")
|
|
}
|
|
for _, want := range []string{
|
|
"audit log write failed",
|
|
"action=user_ban",
|
|
"actor_id=7",
|
|
"target_type=user",
|
|
"target_id=42",
|
|
"disk on fire",
|
|
} {
|
|
if !strings.Contains(out, want) {
|
|
t.Errorf("failure log missing %q; got: %s", want, out)
|
|
}
|
|
}
|
|
// The detail string must not leak into logs.
|
|
if strings.Contains(out, "spam") {
|
|
t.Errorf("detail string leaked into audit failure log: %s", out)
|
|
}
|
|
}
|
|
|
|
func TestWriteAudit_SuccessLogsNothing(t *testing.T) {
|
|
a := &fakeAuditor{err: nil}
|
|
|
|
out := captureLogs(t, func() {
|
|
db.WriteAudit(context.Background(), a, 1, "user_login", "user", 1, "")
|
|
})
|
|
|
|
if !a.called {
|
|
t.Fatal("WriteAudit did not attempt the underlying LogAudit")
|
|
}
|
|
if strings.Contains(out, "audit log write failed") {
|
|
t.Errorf("successful audit write should not log a failure; got: %s", out)
|
|
}
|
|
}
|