security(alerts): decouple event query allocation

Change-source: pulse-maintainer

internal/alerts/alerts_test.go

@@ -50,6 +50,16 @@ func TestAlertEventLogDoesNotInventFiringFromActiveStorage(t *testing.T) {
 	}
 }
 
+func TestAlertEventLogBoundsRequestDerivedLimit(t *testing.T) {
+	manager := newEventLogManager(t)
+	manager.recordAlertEvent(eventlog.TypeResolved, nil, "bounded-event", "resolved", "resolved", nil)
+
+	events := queryAlertEvents(t, manager, eventlog.Filter{Limit: math.MaxInt})
+	if len(events) != 1 || events[0].AlertID != "bounded-event" {
+		t.Fatalf("oversized-limit query = %+v, want the bounded event", events)
+	}
+}
+
 func TestGuestAlertIncludesTagsForNotificationRouting(t *testing.T) {
 	m := newTestManager(t)
 	m.ClearActiveAlerts()

internal/alerts/eventlog/eventlog.go

@@ -376,7 +376,12 @@ func (s *Store) Query(filter Filter) ([]Event, error) {
 	}
 	defer rows.Close()
 
-	events := make([]Event, 0, limit)
+	// Do not use the request-derived limit as an allocation hint. The SQL
+	// query is capped above, but keeping the result slice allocation independent
+	// of caller input makes that memory-safety boundary explicit and prevents a
+	// future query refactor from turning an oversized limit into an eager
+	// allocation.
+	events := make([]Event, 0, defaultQueryLimit)
 	for rows.Next() {
 		var event Event
 		var occurredAt, details string

internal/alerts/eventlog/eventlog_test.go

@@ -1,6 +1,7 @@
 package eventlog
 
 import (
+	"math"
 	"testing"
 	"time"
 )
@@ -99,6 +100,20 @@ func TestQueryLimitCaps(t *testing.T) {
 	}
 }
 
+func TestQueryOversizedLimitDoesNotControlAllocation(t *testing.T) {
+	store := newTestStore(t)
+	store.Append(Event{OccurredAt: time.Now(), Type: TypeResolved, AlertID: "a1"})
+	store.Flush()
+
+	events, err := store.Query(Filter{Limit: math.MaxInt})
+	if err != nil {
+		t.Fatalf("query with oversized limit: %v", err)
+	}
+	if len(events) != 1 || events[0].AlertID != "a1" {
+		t.Fatalf("events = %+v, want the one stored event", events)
+	}
+}
+
 func TestNilStoreIsSafe(t *testing.T) {
 	var store *Store
 	store.Append(Event{Type: TypeResolved, AlertID: "a1"})