Files
selfpost/internal/store/queryplan_test.go
T
mixandClaude Opus 5.5 242515c305 audit 3: backup CLI, envelope budget, directory sync, docs; findings of the reviews
Steps 3-6 of stage 3 and what the two reviews found in steps 1-6, in one
commit: the review fixes sit in the same hunks.

Step 3, CLI backup (M3, M5, L1, L2; L4 of the stage's list):
- backup.snapshotDB refuses a database that is not there and opens the
  source mode=ro (measured: mode=ro creates no file).
- selfpost-backup holds an encrypting password to
  validate.MinSecretFilePasswordLen; -o of both directions writes a
  temporary file beside the name and renames it whole; -decrypt peeks the
  first chunk (password and type authenticated) before the output exists.
- what a backup leaves out (a link under data/, a link under certs/ to a
  directory, a socket...) is told to OnWarn; certs/ with no file is
  backup.ErrNoCerts, refused by Check and Create, named by the panel.
- parseTrustedProxies: a bare address takes /128 when written with a
  colon (::ffff:10.0.0.1/32 was ::/32).
Step 4, secretfile (M4, L3): scrypt's V at most 128 MiB, r <= 64, p <= 2;
bytes after the last chunk are ErrCorrupt.
Step 5 (L7): atomicfile.SyncDir after the rename, used by Write,
replaceSASLDB and the CLI; atomicfile_test.go.
Step 6: security.md and guide on backup and restore.

Reviews (technical, security):
- H1: a restore of a server with DMARC on was refused on every start - the
  archive records no owner, tar as root left the DMARC maps root's, and the
  entrypoint only chowned the maps it named. It now hands every file beside
  queue/ in /data/postfix to panel:selfpost 0640; e2e writes an extra map
  before the backup and finds it panel:selfpost 640 after a root unpack.
- the comparison reads regular files only (Lstat, size, LimitReader); a
  record unpacked again wins over the earlier check's mark; ConsumeRestore
  removes both; the mark is synced; a journal file beside a freshly unpacked
  database is refused.
- AttachRefusalLine refuses an empty line as the old statement did; skipped
  entries named in words; -decrypt of an empty payload is no failure; guide
  wording on the shell's '>' and a killed CLI; the in-place restore's
  'mv .' (older than this stage) fixed.

Tested on the test server: go vet + go test of 25 packages, make e2e (all
pass, 643 s) on this tree.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
2026-10-15 10:38:39 +03:00

114 lines
5.0 KiB
Go

package store
import (
"strings"
"testing"
)
// explain returns SQLite's plan for query, one step a line.
func explain(t *testing.T, s *Store, query string, args ...any) string {
t.Helper()
rows, err := s.db.Query("EXPLAIN QUERY PLAN "+query, args...)
if err != nil {
t.Fatalf("explain: %v\n%s", err, query)
}
defer rows.Close()
var plan []string
for rows.Next() {
var id, parent, notused int
var detail string
if err := rows.Scan(&id, &parent, &notused, &detail); err != nil {
t.Fatal(err)
}
plan = append(plan, detail)
}
return strings.Join(plan, "\n")
}
// The send log is the one table that grows with the mail. The questions
// asked of it by time or by scope - per message (the level-2 count), per log
// line (a refusal line), every few minutes (the sweep, the notifier), per
// page and per statistics view - are answered from an index: measured with
// EXPLAIN QUERY PLAN against the statements the store runs, not copies of
// them (audit 2026-10-12, M2; stage 3). Those by queue id (UpdateStatus,
// ExpireMessage, RecoverRefusal) go by idx_send_log_queue_id and are not
// pinned here. SQLite chooses without statistics here, as it does on a
// server - nothing runs ANALYZE.
func TestSendLogQueriesUseTheirIndexes(t *testing.T) {
s := openTestStore(t)
const since = "2026-10-01T00:00:00Z"
page := func(f SendLogFilter) (string, []any) {
where, args := sendLogWhere(f)
return sendLogPageQuery(where), append(args, 50, 0)
}
oneDomain, oneDomainArgs := page(SendLogFilter{DomainIDs: []int64{1}})
oneApp, oneAppArgs := page(SendLogFilter{AllDomains: true, AppLogin: "app1"})
byName, byNameArgs := page(SendLogFilter{AllDomains: true, Domain: "example.com"})
for _, c := range []struct {
name string
query string
args []any
want []string // steps the plan must have
sorts bool // whether it may sort the rows it reads
}{
{"level-2 count of a domain", countMessagesQuery(domainByName), []any{"example.com", StatusRejected, since},
[]string{"SEARCH send_log USING INDEX idx_send_log_domain_id_created_at (domain_id=? AND created_at>?)"}, false},
{"level-2 count of an application", countMessagesQuery(appByLogin), []any{"app1", StatusRejected, since},
[]string{"SEARCH send_log USING INDEX idx_send_log_app_login_created_at (app_login=? AND created_at>?)"}, false},
{"busiest hour of a domain", peakPerHourQuery(domainByName), []any{"example.com", StatusRejected, since},
[]string{"SEARCH send_log USING INDEX idx_send_log_domain_id_created_at (domain_id=? AND created_at>?)"}, true},
{"busiest hour of an application", peakPerHourQuery(appByLogin), []any{"app1", StatusRejected, since},
[]string{"SEARCH send_log USING INDEX idx_send_log_app_login_created_at (app_login=? AND created_at>?)"}, true},
{"open rows", listOpenQuery, []any{since},
[]string{"SEARCH send_log USING INDEX idx_send_log_open (created_at<?)"}, true},
{"open rows counted", countOpenQuery, []any{since},
[]string{"SEARCH send_log USING INDEX idx_send_log_open (created_at<?)"}, false},
{"a page of one domain", oneDomain, oneDomainArgs,
[]string{"SEARCH send_log USING INDEX idx_send_log_domain_id (domain_id=?)"}, false},
{"a page of one application", oneApp, oneAppArgs,
[]string{"SEARCH send_log USING INDEX idx_send_log_app_login (app_login=?)"}, false},
{"a page of a domain by name", byName, byNameArgs,
[]string{"SEARCH send_log USING INDEX idx_send_log_domain (domain=?)"}, false},
{"a refusal line", attachRefusalLineQuery,
[]any{"line", ReasonLimit, ReasonClient, "a@example.com", "192.0.2.1", since, since, since, "app1"},
[]string{
"SEARCH send_log USING INDEX idx_send_log_rejected (created_at>? AND created_at<?)",
"SEARCH send_log USING COVERING INDEX idx_send_log_refusal_line (refusal_line=?)",
}, true},
{"refusals under a limit", limitRefusalsQuery, []any{since},
[]string{"SEARCH l USING INDEX idx_send_log_rejected (created_at>?)"}, true},
} {
t.Run(c.name, func(t *testing.T) {
plan := explain(t, s, c.query, c.args...)
for _, want := range c.want {
if !strings.Contains(plan, want) {
t.Errorf("the plan has no %q:\n%s", want, plan)
}
}
for _, line := range strings.Split(plan, "\n") {
if strings.HasPrefix(line, "SCAN send_log") || strings.HasPrefix(line, "SCAN l") {
t.Errorf("the plan walks the whole send log:\n%s", plan)
}
if !c.sorts && strings.Contains(line, "TEMP B-TREE FOR ORDER BY") {
t.Errorf("the plan sorts the rows it reads:\n%s", plan)
}
}
})
}
// The partial indexes are used because the statuses are written into the
// statements as the index's WHERE has them; the constants must say the
// same.
for _, st := range []string{StatusQueued, StatusDeferred} {
if !strings.Contains(openRows, "'"+st+"'") {
t.Errorf("openRows does not name status %q: %s", st, openRows)
}
}
for _, q := range []string{attachRefusalLineQuery, limitRefusalsQuery} {
if !strings.Contains(q, "status = '"+StatusRejected+"'") {
t.Errorf("a refusal query does not name status %q", StatusRejected)
}
}
}