Deploy main eacf1e7 to prod

Replaces #559, which conflicted.

Model: opus-5-5

internal/gormlog/firstboot_test.go

@@ -3,6 +3,7 @@ package gormlog_test
 import (
 	"context"
 	"database/sql"
+	"log/slog"
 	"os"
 	"path/filepath"
 	"testing"
@@ -13,6 +14,7 @@ import (
 	"go.uber.org/fx/fxtest"
 	_ "modernc.org/sqlite" // Pure Go SQLite driver.
 	"sneak.berlin/go/webhooker/internal/config"
+	"sneak.berlin/go/webhooker/internal/config/configtest"
 	"sneak.berlin/go/webhooker/internal/database"
 	"sneak.berlin/go/webhooker/internal/globals"
 	"sneak.berlin/go/webhooker/internal/logger"
@@ -117,8 +119,8 @@ func readFirstBootSecrets(
 }
 
 // bootAtDebug starts and stops the real application graph against
-// dataDir with DEBUG=true, and returns everything it wrote to standard
-// output.
+// dataDir with DEBUG=true and nothing else set, and returns everything
+// it wrote to standard output.
 //
 // config.New reads DEBUG from the environment exactly as the binary
 // does, internal/logger builds the handler it builds in production,
@@ -128,6 +130,7 @@ func readFirstBootSecrets(
 func bootAtDebug(t *testing.T, dataDir string) string {
 	t.Helper()
 
+	configtest.ClearEnv(t)
 	t.Setenv("DEBUG", "true")
 	t.Setenv("DATA_DIR", dataDir)
 
@@ -137,9 +140,14 @@ func bootAtDebug(t *testing.T, dataDir string) string {
 
 	app := fxtest.New(
 		t,
+		// fx's own log is discarded, not sent to t.Logf: a hook still
+		// running after a start or stop timeout would write there after
+		// the test has returned.
+		fx.NopLogger,
 		fx.Provide(
 			globals.New,
 			logger.New,
+			func(l *logger.Logger) *slog.Logger { return l.Get() },
 			config.New,
 			database.New,
 			session.New,

internal/gormlog/gormlog.go

@@ -7,7 +7,7 @@
 // SQL — parameters and all — for every statement that returns an
 // error, including gorm.ErrRecordNotFound. Two of this service's
 // lookups miss by design on unauthenticated routes: the entrypoint
-// lookup on /webhook/{uuid}, whose path segment the client picks
+// lookup on /h/{uuid}, whose path segment the client picks
 // outright, and the user lookup behind the login form, whose username
 // the client picks outright. Under the default logger each of those
 // misses printed an unbounded, attacker-chosen string, at no level the
@@ -111,9 +111,9 @@ func (l *Logger) LogMode(gormlogger.LogLevel) gormlogger.Interface {
 //
 // One GORM path does not consult this: (*gorm.DB).Scan records the
 // statement through gorm's own traceRecorder, which does not implement
-// this interface. No production code path calls it; its one caller is
-// internal/database/database_test.go:91, whose SELECT 1 binds nothing.
-// scan_guard_test.go fails if a non-test file calls it.
+// this interface. No production code path calls it; only tests do, and
+// what a test binds is fixture data. scan_guard_test.go fails if a
+// non-test file calls it.
 // (*gorm.DB).Pluck, Row and Raw all run through the normal callback
 // processor and are filtered.
 func (l *Logger) ParamsFilter(

internal/gormlog/gormlog_test.go

@@ -135,16 +135,18 @@ func openDB(
 	)
 	require.NoError(t, err)
 
-	require.NoError(t, gdb.AutoMigrate(&thing{}))
+	require.NoError(t, gdb.Exec(
+		"CREATE TABLE things (id text PRIMARY KEY, name text)",
+	).Error)
 
-	// Migration chatter is not what any of these cases is about.
+	// Creating the table is not what any of these cases is about.
 	buf.Reset()
 
 	return gdb
 }
 
 // assertBounded holds every line the adapter wrote to the stated
-// ceiling and proves each was cut rather than merely short.
+// ceiling and proves no line carried a whole client value.
 func assertBounded(t *testing.T, out string) {
 	t.Helper()
 

internal/gormlog/scan_guard_test.go

@@ -14,18 +14,16 @@ import (
 	"github.com/stretchr/testify/require"
 )
 
-// minNonTestFiles guards the walk below against passing because it
-// found nothing to look at. The tree held 60 non-test .go files when
-// this was written.
-const minNonTestFiles = 40
-
-// isRowProducer reports whether name is a method that returns a
-// database/sql row handle. GORM's Row and Rows return *sql.Row and
-// *sql.Rows, so Scan on the result of one of them is database/sql's
-// Scan and never (*gorm.DB).Scan.
+// isRowProducer reports whether name is GORM's Row or database/sql's
+// QueryRow or QueryRowContext, which return a *sql.Row whose Scan is
+// database/sql's and not (*gorm.DB).Scan. GORM's Rows is not listed:
+// it also returns an error, so Scan is never called on its result
+// directly. It matches the method name only and resolves no types, so
+// a repo-local method with one of these names that returns *gorm.DB
+// gets past it: Scan on that method's result is not reported.
 func isRowProducer(name string) bool {
 	switch name {
-	case "Row", "Rows", "QueryRow", "QueryRowContext":
+	case "Row", "QueryRow", "QueryRowContext":
 		return true
 	default:
 		return false
@@ -50,9 +48,14 @@ func receiverIsRowHandle(x ast.Expr) bool {
 }
 
 // unguardedScans returns the position of every Scan call in file whose
-// receiver is not a row handle. It fails closed: a receiver it cannot
-// resolve syntactically — a local variable, a struct field — is
-// reported rather than assumed safe.
+// receiver is not a call to a row producer. It fails closed: any other
+// receiver — a local variable, a struct field, a call to any other
+// method — is reported rather than assumed safe.
+//
+// It sees only calls written x.Scan(...). A method value, f := db.Scan
+// followed by f(&v), is out of scope: Scan is never the called
+// expression there, and nobody writes a query that way by accident,
+// which is the mistake this check exists to catch.
 func unguardedScans(
 	fset *token.FileSet, file *ast.File,
 ) []token.Position {
@@ -111,15 +114,15 @@ func skipDir(name string) bool {
 	}
 }
 
-// walkNonTestGo parses every non-test .go file under root and returns
-// how many it parsed along with every unguarded Scan it found.
-func walkNonTestGo(t *testing.T, root string) (int, []string) {
+// walkNonTestGo parses every non-test .go file under root. It returns
+// the directories, relative to root, it parsed a file in or below,
+// along with every unguarded Scan it found.
+func walkNonTestGo(t *testing.T, root string) (map[string]bool, []string) {
 	t.Helper()
 
-	var (
-		parsed int
-		hits   []string
-	)
+	walked := map[string]bool{}
+
+	var hits []string
 
 	fset := token.NewFileSet()
 
@@ -147,7 +150,17 @@ func walkNonTestGo(t *testing.T, root string) (int, []string) {
 				return err
 			}
 
-			parsed++
+			dir, err := filepath.Rel(root, filepath.Dir(path))
+			if err != nil {
+				return err
+			}
+
+			// The directories above count too, so that one holding
+			// only a nested package, as internal/db does, is not
+			// taken for one the walk skipped.
+			for ; dir != "."; dir = filepath.Dir(dir) {
+				walked[dir] = true
+			}
 
 			for _, pos := range unguardedScans(fset, file) {
 				hits = append(hits, relPosition(root, pos))
@@ -157,7 +170,7 @@ func walkNonTestGo(t *testing.T, root string) (int, []string) {
 		},
 	))
 
-	return parsed, hits
+	return walked, hits
 }
 
 // isNonTestGo reports whether a file name is Go source this check
@@ -189,19 +202,39 @@ func relPosition(root string, pos token.Position) string {
 // logged with its values interpolated. The package comment states the
 // limit; this fails when someone adds a call site anyway.
 //
-// The current tree has one caller, internal/database/database_test.go,
-// which this check does not govern: it is test-only and its SELECT 1
-// binds nothing.
+// Test files are not governed: what a test binds is fixture data.
 func TestGormScanIsNeverCalledOutsideTests(t *testing.T) {
 	t.Parallel()
 
-	parsed, offenders := walkNonTestGo(t, moduleRoot(t))
+	root := moduleRoot(t)
+	walked, offenders := walkNonTestGo(t, root)
+
+	// The module's packages are static, templates, and every directory
+	// directly under cmd and internal. Each holds non-test code, itself
+	// or in a package below it, so one the walk parsed nothing in or
+	// below was skipped, and a Scan there would pass unseen.
+	packages := []string{"static", "templates"}
+
+	for _, parent := range []string{"cmd", "internal"} {
+		entries, err := os.ReadDir(filepath.Join(root, parent))
+		require.NoError(t, err)
+
+		for _, entry := range entries {
+			if !entry.IsDir() {
+				continue
+			}
+
+			packages = append(packages, filepath.Join(parent, entry.Name()))
+		}
+	}
+
+	for _, dir := range packages {
+		require.True(
+			t, walked[dir],
+			"the walk parsed no non-test .go file in %s", dir,
+		)
+	}
 
-	require.GreaterOrEqual(
-		t, parsed, minNonTestFiles,
-		"parsed %d non-test .go files, so this check found "+
-			"nothing to look at", parsed,
-	)
 	require.Empty(
 		t, offenders,
 		"Scan called on a receiver this check cannot show is a "+
@@ -222,18 +255,51 @@ type scanGuardCase struct {
 	want int
 }
 
+// scanGuardCases covers each receiver form unguardedScans names, plus
+// each row producer isRowProducer lets through. Each body is valid Go
+// inside plantedFile.
 func scanGuardCases() []scanGuardCase {
 	return []scanGuardCase{
-		{"gorm chain", `db.DB().Raw("SELECT 1").Scan(&v)`, 1},
-		{"gorm receiver", `gdb.Scan(&v)`, 1},
-		{"gorm via variable", "q := gdb.Raw(\"x\")\nq.Scan(&v)", 1},
-		{"gorm model chain", `gdb.Model(&x).Scan(&v)`, 1},
-		{"sql row", `gdb.Raw("SELECT 1").Row().Scan(&v)`, 0},
-		{"sql rows", `gdb.Raw("SELECT 1").Rows().Scan(&v)`, 0},
+		{"local variable", "q := gdb.Raw(\"SELECT 1\")\n\tq.Scan(&v)", 1},
+		{"struct field", `s.db.Scan(&v)`, 1},
+		{"gorm chain", `gdb.Raw("SELECT 1").Scan(&v)`, 1},
+		{
+			"sql rows in a variable",
+			"rows, _ := gdb.Raw(\"SELECT 1\").Rows()\n\trows.Scan(&v)",
+			1,
+		},
+		{"gorm Row", `gdb.Raw("SELECT 1").Row().Scan(&v)`, 0},
+		{"sql QueryRow", `sqlDB.QueryRow("SELECT 1").Scan(&v)`, 0},
+		{
+			"sql QueryRowContext",
+			`sqlDB.QueryRowContext(ctx, "SELECT 1").Scan(&v)`,
+			0,
+		},
 		{"unrelated call", `gdb.Find(&v)`, 0},
 	}
 }
 
+// plantedFile wraps one case body in a function that declares every
+// name the bodies use, so each body is the Go it stands for. The result
+// is parsed, never compiled.
+const plantedFile = `package p
+
+import (
+	"context"
+	"database/sql"
+
+	"gorm.io/gorm"
+)
+
+type store struct{ db *gorm.DB }
+
+func f(ctx context.Context, gdb *gorm.DB, sqlDB *sql.DB, s store) {
+	var v int
+
+	%s
+}
+`
+
 // TestScanGuard_ReportsPlantedCalls proves the check fires. Without it
 // a detector that matched nothing would satisfy the walk above no
 // matter what the tree contained.
@@ -245,9 +311,7 @@ func TestScanGuard_ReportsPlantedCalls(t *testing.T) {
 			t.Parallel()
 
 			fset := token.NewFileSet()
-			src := fmt.Sprintf(
-				"package p\n\nfunc f() {\n\t%s\n}\n", tc.body,
-			)
+			src := fmt.Sprintf(plantedFile, tc.body)
 
 			file, err := parser.ParseFile(
 				fset, tc.name+".go", src, 0,