Deploy main eacf1e7 to prod

Replaces #559, which conflicted.

Model: opus-5-5

internal/database/webhook_db_manager.go

@@ -14,8 +14,8 @@ import (
 	"gorm.io/gorm"
 	"sneak.berlin/go/webhooker/internal/config"
 	"sneak.berlin/go/webhooker/internal/datadir"
+	"sneak.berlin/go/webhooker/internal/db/migrations"
 	"sneak.berlin/go/webhooker/internal/gormlog"
-	"sneak.berlin/go/webhooker/internal/logger"
 )
 
 // WebhookDBManagerParams holds the fx dependencies for
@@ -24,7 +24,7 @@ type WebhookDBManagerParams struct {
 	fx.In
 
 	Config *config.Config
-	Logger *logger.Logger
+	Logger *slog.Logger
 }
 
 // errInvalidCachedDBType indicates a type assertion failure
@@ -33,9 +33,23 @@ var errInvalidCachedDBType = errors.New(
 	"invalid cached database type",
 )
 
+// ErrEventDBNotRemoved is in DeleteDB's error when the event
+// database file itself could not be removed: it is still on disk.
+var ErrEventDBNotRemoved = errors.New(
+	"event database file not removed",
+)
+
+// ErrSidecarNotRemoved is in DeleteDB's error when the event
+// database file was removed, so its events are gone, but its -wal
+// or -shm sidecar could not be.
+var ErrSidecarNotRemoved = errors.New(
+	"event database file removed, but a -wal or -shm sidecar was not",
+)
+
 // WebhookDBManager manages per-webhook SQLite database files
 // for event storage. Each webhook gets its own dedicated
-// database containing Events, Deliveries, and DeliveryResults.
+// database containing Events, Deliveries, DeliveryResults and the
+// running totals of them (EventTotals, TargetTotals, EntrypointTotals).
 // Database connections are opened lazily and cached.
 type WebhookDBManager struct {
 	dataDir string
@@ -56,7 +70,7 @@ func NewWebhookDBManager(
 ) (*WebhookDBManager, error) {
 	m := &WebhookDBManager{
 		dataDir: params.Config.DataDir,
-		log:     params.Logger.Get(),
+		log:     params.Logger,
 	}
 
 	// Create data directory if it doesn't exist. datadir.DirPerm is the
@@ -84,34 +98,37 @@ func NewWebhookDBManager(
 	return m, nil
 }
 
-// GetDB returns the database connection for a webhook,
-// creating the database file lazily if it doesn't exist.
+// GetDB returns the database connection for a webhook, opening it on
+// first use.
+//
+// The file is made by CreateDB when the webhook is created. One that is
+// missing or zero-length here means the webhook's events and pending
+// deliveries are gone: an empty database is created in its place so
+// the webhook keeps receiving, and that is logged as a warning naming
+// the file, as a new main database is.
 func (m *WebhookDBManager) GetDB(
 	webhookID string,
 ) (*gorm.DB, error) {
-	// Fast path: already open
-	if val, ok := m.dbs.Load(webhookID); ok {
-		return asGormDB(val, webhookID)
-	}
+	return m.getDB(webhookID, false)
+}
 
-	// Slow path: open the database under the lock, looking in the
-	// cache again first. A caller that raced another one here then
-	// waits for its handle instead of opening a second one.
+// GetDBIf is GetDB, done only when check reports true. check runs under
+// the lock DeleteDB holds while it removes the files, so a caller can
+// confirm the webhook still exists and open its database with no delete
+// in between. The handle is nil when check reports false. check must
+// not call the manager.
+func (m *WebhookDBManager) GetDBIf(
+	webhookID string, check func() (bool, error),
+) (*gorm.DB, error) {
 	m.mu.Lock()
 	defer m.mu.Unlock()
 
-	if val, ok := m.dbs.Load(webhookID); ok {
-		return asGormDB(val, webhookID)
-	}
-
-	db, err := m.openDB(webhookID)
-	if err != nil {
+	ok, err := check()
+	if err != nil || !ok {
 		return nil, err
 	}
 
-	m.dbs.Store(webhookID, db)
-
-	return db, nil
+	return m.getDBLocked(webhookID, false)
 }
 
 // asGormDB returns a value read from the cache as the database
@@ -129,12 +146,12 @@ func asGormDB(val any, webhookID string) (*gorm.DB, error) {
 	return db, nil
 }
 
-// CreateDB explicitly creates a new per-webhook database file
-// and runs migrations.
+// CreateDB creates a new webhook's database file and runs
+// migrations.
 func (m *WebhookDBManager) CreateDB(
 	webhookID string,
 ) error {
-	_, err := m.GetDB(webhookID)
+	_, err := m.getDB(webhookID, true)
 
 	return err
 }
@@ -150,7 +167,10 @@ func (m *WebhookDBManager) DBExists(
 }
 
 // DeleteDB closes the connection and deletes the database file
-// for a webhook. The file is permanently removed.
+// for a webhook, with its -wal and -shm sidecars. The files are
+// permanently removed. Each file is tried even when another could
+// not be removed, and the error wraps ErrEventDBNotRemoved or
+// ErrSidecarNotRemoved to say which was left, naming each file.
 func (m *WebhookDBManager) DeleteDB(
 	webhookID string,
 ) error {
@@ -169,16 +189,23 @@ func (m *WebhookDBManager) DeleteDB(
 		}
 	}
 
-	// Delete the main DB file and WAL/SHM files
 	path := m.dbPath(webhookID)
-	for _, suffix := range []string{"", "-wal", "-shm"} {
-		err := os.Remove(path + suffix)
-		if err != nil && !os.IsNotExist(err) {
-			return fmt.Errorf(
-				"deleting webhook database file %s%s: %w",
-				path, suffix, err,
-			)
-		}
+
+	dbErr := removeFile(path)
+	sidecarErr := errors.Join(
+		removeFile(path+"-wal"),
+		removeFile(path+"-shm"),
+	)
+
+	if dbErr != nil {
+		return fmt.Errorf(
+			"%w: %w",
+			ErrEventDBNotRemoved, errors.Join(dbErr, sidecarErr),
+		)
+	}
+
+	if sidecarErr != nil {
+		return fmt.Errorf("%w: %w", ErrSidecarNotRemoved, sidecarErr)
 	}
 
 	m.log.Info(
@@ -189,6 +216,17 @@ func (m *WebhookDBManager) DeleteDB(
 	return nil
 }
 
+// removeFile removes path. A file that is already gone counts as
+// removed; the error from any other failure names the file.
+func removeFile(path string) error {
+	err := os.Remove(path)
+	if errors.Is(err, os.ErrNotExist) {
+		return nil
+	}
+
+	return err
+}
+
 // CloseAll closes all open per-webhook database connections.
 // Called during application shutdown.
 func (m *WebhookDBManager) CloseAll() error {
@@ -231,6 +269,54 @@ func (m *WebhookDBManager) DBPath(
 	return m.dbPath(webhookID)
 }
 
+// getDB is GetDB, and CreateDB when isNew is true: the webhook has just
+// been created, so a missing file is expected rather than lost.
+func (m *WebhookDBManager) getDB(
+	webhookID string, isNew bool,
+) (*gorm.DB, error) {
+	// Fast path: already open
+	if val, ok := m.dbs.Load(webhookID); ok {
+		return asGormDB(val, webhookID)
+	}
+
+	m.mu.Lock()
+	defer m.mu.Unlock()
+
+	return m.getDBLocked(webhookID, isNew)
+}
+
+// getDBLocked is getDB's slow path, run with m.mu held. It looks in the
+// cache again first: a caller that raced another one to the lock then
+// gets its handle instead of opening a second one.
+func (m *WebhookDBManager) getDBLocked(
+	webhookID string, isNew bool,
+) (*gorm.DB, error) {
+	if val, ok := m.dbs.Load(webhookID); ok {
+		return asGormDB(val, webhookID)
+	}
+
+	// Checked before opening, which creates the file. See GetDB.
+	path := m.dbPath(webhookID)
+	replaced := !isNew && missingOrEmpty(path)
+
+	db, err := m.openDB(webhookID)
+	if err != nil {
+		return nil, err
+	}
+
+	if replaced {
+		m.log.Warn(
+			"created a new, empty database",
+			"webhook_id", webhookID,
+			"path", path,
+		)
+	}
+
+	m.dbs.Store(webhookID, db)
+
+	return db, nil
+}
+
 func (m *WebhookDBManager) dbPath(
 	webhookID string,
 ) string {
@@ -285,17 +371,7 @@ func (m *WebhookDBManager) openDB(
 		)
 	}
 
-	err = purgeTargetRows(db, m.log, webhookID)
-	if err != nil {
-		_ = sqlDB.Close()
-
-		return nil, err
-	}
-
-	// Run migrations for event-tier models only
-	err = db.AutoMigrate(
-		&Event{}, &Delivery{}, &DeliveryResult{},
-	)
+	err = migrations.Apply(db, migrations.Events)
 	if err != nil {
 		_ = sqlDB.Close()
 
@@ -305,6 +381,19 @@ func (m *WebhookDBManager) openDB(
 		)
 	}
 
+	err = parseModels(
+		db, &Event{}, &Delivery{}, &DeliveryResult{},
+		&EventTotals{}, &TargetTotals{}, &EntrypointTotals{},
+	)
+	if err != nil {
+		_ = sqlDB.Close()
+
+		return nil, fmt.Errorf(
+			"connecting to webhook database %s: %w",
+			webhookID, err,
+		)
+	}
+
 	m.log.Info(
 		"opened per-webhook database",
 		"webhook_id", webhookID,