Files
Anand bb99771f20 Second audit pass: fix cross-conversation AI streaming, node form clobbering, and CI docker build hang
Fixes regressions from the previous audit-fixes commit (SSH host-key TOFU
race/silent-swallow, webhook durability, guest-switch exec race, dashboard
save dirty-flag misattribution) plus new findings across both frontend and
backend: AI Assistant streaming into the wrong conversation on switch,
NodeSystemPanel forms getting clobbered by background refetch, stale
ClusterPage vnet/connection selection, NaN-producing numeric form fields,
PBS oversized-response parity with the PVE client, gauge/sparkline gradient
ID collisions, PBS GC progress surviving tab switches, digest fleet-average
skew from fully-offline connections, unbounded console/SSH sessions, and
Postgres "?" rebinding corrupting literal "?" in string literals.

Also fixes three UI bugs reported directly: the dashboard meter glow being
clipped on one side, the "Available widgets" sticky label showing scrolled
content through its padding gap, and ClusterActivityWidget's generic error
message hiding the real upstream failure reason.

Separately: fixes the Release workflow's docker job hanging for GitHub's
360-minute hard cap — the web/go build stages were running under QEMU
emulation for the linux/arm64 target instead of natively, which is known to
hang Node/npm outright. Pinned both stages to --platform=$BUILDPLATFORM
(Go cross-compiles without needing to execute target-arch code) and added
a 30-minute job timeout so a real hang fails fast instead of burning hours.
2026-09-18 22:19:47 +05:30

50 lines
1.6 KiB
Go

package store
import "testing"
func TestRebindLeavesSQLiteUntouched(t *testing.T) {
db := &DB{driver: "sqlite"}
query := `SELECT * FROM users WHERE id = ? AND name = ?`
if got := db.rebind(query); got != query {
t.Fatalf("rebind(sqlite) = %q, want unchanged %q", got, query)
}
}
func TestRebindConvertsPlaceholdersForPostgres(t *testing.T) {
db := &DB{driver: "postgres"}
got := db.rebind(`SELECT * FROM users WHERE id = ? AND name = ?`)
want := `SELECT * FROM users WHERE id = $1 AND name = $2`
if got != want {
t.Fatalf("rebind(postgres) = %q, want %q", got, want)
}
}
func TestRebindHandlesNoPlaceholders(t *testing.T) {
db := &DB{driver: "postgres"}
query := `SELECT COUNT(*) FROM users`
if got := db.rebind(query); got != query {
t.Fatalf("rebind with no placeholders = %q, want unchanged %q", got, query)
}
}
func TestTxRebindMatchesDBRebind(t *testing.T) {
tx := &Tx{driver: "postgres"}
got := tx.rebind(`UPDATE t SET a = ? WHERE b = ? AND c = ?`)
want := `UPDATE t SET a = $1 WHERE b = $2 AND c = $3`
if got != want {
t.Fatalf("Tx.rebind(postgres) = %q, want %q", got, want)
}
}
// A literal "?" inside a quoted string (a LIKE pattern, or Postgres's JSONB
// "?"/"?|"/"?&" operators) must not be treated as a placeholder — only the
// real one outside the string should be renumbered.
func TestRebindIgnoresPlaceholdersInsideStringLiterals(t *testing.T) {
db := &DB{driver: "postgres"}
got := db.rebind(`SELECT * FROM t WHERE name LIKE '%?%' AND id = ?`)
want := `SELECT * FROM t WHERE name LIKE '%?%' AND id = $1`
if got != want {
t.Fatalf("rebind(postgres) = %q, want %q", got, want)
}
}